Cloud-based security thrives during downturn

iSheriff didn’t set out to be a cloud provider. Initially the company planned to focus on selling its software to telcos and other cloud-based providers, and that is still one sales channel for the company. But it opted to become a cloud-based provider itself in response to market demand and as a way of maximizing its return on investment.

Identity management

Viruses and malware aren’t the only concerns organizations face as the Internet becomes increasingly important to their business. As more and more employees use multiple Internet-based applications such as salesforce.com, another important concern is to manage employee access. If an employee leaves an organization, the organization wants to ensure that the employee can no longer access company applications. And if an employee needs access to multiple Web-based apps, it’s more convenient for the employee to be able to log in just once and gain access to all of those applications, rather than having to log on to each one separately.

Symplified is a cloud-based provider that was created with the goal of addressing these concerns. “We have a unified solution across internal and external Web pages, with one point of administration,” said Eric Olden, its CEO.

Symplified’s offering is based on a managed appliance that can be located on the customer premises or within Amazon’s cloud. Even if it is located on the premises, Symplified handles management of the device. Olden likens it to a cable company set-top box, where all configurations and updates are pushed out from the service provider.

An important benefit of using Symplified, Olden said, is that “we give customers the ability to enforce the same audit capabilities for external applications as for internal ones.” These audit capabilities are based on logs that Symplified keeps on behalf of the customer, keeping track of who uses an application and how long the person uses it.

In addition to enterprise organizations, Symplified also sells its service to other cloud providers, which  use it to give their customers a single sign-on to multiple cloud-based applications.

Online retail security

Organizations that accept credit cards online have their own unique security requirements, and those organizations are a key target market for Alert Logic. The cloud security provider offers cloud-based security services such as intrusion management, vulnerability assessment and log management, many of which are mandated by payment card industry (PCI) guidelines.

As Misha Govshteyn, chief technology officer for Alert Logic, explained, “PCI is an industry standard put in place by the credit card companies to reduce fraud.” PCI requirements, he said, “mandate that you have intrusion protection capability in place, specify how you handle and test software, and cover physical control in the data center.” Online retailers are also required to collect and retain activity logs. About 60% to 70% of Alert Logic’s business is driven by PCI compliance, Govshteyn said.

“The PCI standard is a fairly big deal,” he said. “It drives a lot of spending. A lot of companies that historically underspent on security are being forced to take it more seriously.”

Alert Logic’s approach is to provide an appliance at no charge to its customers, which is pre-configured before it is sent out. “They just have to rack it up,” Govshteyn said. “It’s a fairly dumb device. It’s just for data collection. Most of our service happens within the cloud.”

The on-premises appliance collects and encrypts data and sends it to Alert Logic’s data center. The provider operates two data centers it built from the ground up that are 100% redundant. The company also provides a self-service dashboard that clients can use, for example, to request reports.

Alert Logic is another cloud provider that developed its own software. Initially the company expected to sell to telecom companies, but as Govshteyn explained, “Web hosting companies have moved in much faster,” and Alert Logic makes many of its sales through them. The company does have several communications service provider partners, however, and although most have not been formally announced, Govshteyn said one of them is VPN and connectivity provider Megapath.