SportsJunky.info

With the ailing economy putting a crimp in IT budgets, information security managers — like just about everyone else in the tech world — are feeling pressure to keep their costs in line.

Few expect to be hit with outright budget reductions, at least in the short term; regulatory requirements and the ever-expanding list of external and internal threats make it hard to devote less money to security efforts. But there is a growing push to curb or defer spending increases, according to IT managers and security analysts.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

"It's imperative to squeeze every penny of value out of everything you do," said Jim Kirby, senior network engineer at DataWare Services, an IT services firm in Sioux Falls, S.D. This is a good time to stop working on "marginal" projects and redirect resources to security capabilities that are absolutely necessary, Kirby said.

Matt Kesner, chief technology officer at Fenwick & West LLP in San Francisco, said the law firm's security strategy for next year is to "focus on basics." Its 2009 IT budget doesn't call for reduced spending on security — but neither does it include a funding increase.

And Fenwick & West is taking some steps to cut costs. The firm is deferring an earlier plan to hire a full-time networking and security expert because of the recession, Kesner said. It is also looking for opportunities to use open source alternatives to some of its security tools.

One of the few new IT projects approved for next year is a replacement of the anti-virus software installed on all of the law firm's PCs — an upgrade that Kesner said is being driven by the increased threats to corporate data from malware and phishing attacks. Fenwick & West also plans to train end-users more intensively on how to secure their PCs and mobile devices, and on the importance of creating strong passwords.

Even in an economy gone sour, a growing number of government and industry regulations impose security compliance costs that there is simply no getting away from. For instance, new data-protection laws in states such as Massachusetts, Connecticut, and Nevada require companies to use data encryption tools and implement other security controls to safeguard the personal information of state residents.

Similarly, the Payment Card Industry Data Security Standard, created by the major credit card companies, requires all businesses that accept credit and debit transactions to adopt a broad set of data protection controls. And the federal HIPAA law includes data security and privacy rules for health care providers in order to protect patient information.

Meanwhile, cybercrooks are targeting companies with increasingly sophisticated — and successful — attacks. For example, Symantec Corp. said in a report last month that at least $1.7 billion worth of bank accounts were compromised in the United States during the 12-month period that started in July 2007.

In light of all that, not making cutbacks in anti-virus subscriptions and purchases of frontline security tools such as firewalls and network intrusion-detection systems is a no-brainer, security managers said.

Kirby said investments in outbound-traffic inspection tools and controls for locking down portable media devices also are worthwhile because of the heightened risk of insider attacks at a time of increased layoffs. In addition, he thinks that cutting back on disaster recovery and business continuity projects wouldn't be wise.

Whittling away at risk management and compliance oversight functions is another bad idea, said the chief privacy officer (CPO) at a large financial services firm. That could leave companies facing potentially serious consequences for not complying with security requirements, he said.

What to cut
But there are other areas in which IT and security managers may be able ease up on spending. Kirby said that although intrusion-detection systems are a must-have item, many companies can live without intrusion-prevention tools, which are more sophisticated but also more expensive and harder to manage. He added that biometric security projects can often be postponed.

Paring back on third-party security education and training programs can also yield some extra dollars that can be used for other purposes, said the CPO, who asked not to be identified. "Companies have a lot of vendor-hosted or vendor-provided education programs — kind of, 'Here's how you do data security if you're covered by HIPAA or by PCI,' " he said. According to the CPO, the cost of individual programs can sometimes top $200,000 annually, depending on the number of employees being trained.

Marcin Czabanski, director of IT at LifeSecure Insurance Co. in Brighton, Mich., said companies should also look for ways to move applications — and their security functions — into the computing clouds offered by vendors such as Google, Microsoft, and Amazon.com.

By doing so, Czabanski said, "you can outsource a lot of the headache" of managing and securing desktop applications — and do so for less money than keeping the work in-house.

E-mail is another application that can move to the cloud. The Henssler Financial Group in Kennesaw, Ga., is a user of Google's Postini e-mail security and archiving services. Tim O'Pry, Henssler's chief technology officer, said the arrangement has enabled the financial services firm to offload to Google the hassle and expense of securing its e-mail system.

In addition, using the hosted services has "dramatically" reduced Henssler's e-mail archiving costs while making it easier for employees to search for and retrieve old messages, O'Pry said.

Moving e-mail to a cloud infrastructure such as Google's can also help organizations lower the costs of complying with e-discovery rules in legal cases, said David Jordan, chief information security officer for Virginia's Arlington County.

For instance, Google earlier this year launched a Postini service called Message Discovery that is designed to help businesses comply with e-mail retention regulations and speed up the process of retrieving messages in response to lawsuits or other legal matters. Such setups can also help customers trim their e-mail hardware, software, management, and security costs, Jordan said.

Another possible cost-saving option, he noted, is deploying virtualization and thin-client technologies that let employees access a set of centralized applications. Jordan said he thinks that thin-client architectures are inherently more secure — and thus less costly to manage and control — than traditional client/server computing models.

Any cutbacks should be carefully weighed, though.

Phil Hochmuth, an analyst at Yankee Group Research Inc., said it's understandable that companies might want to rein in their security spending (see related story, at left). But on a longer-term basis, "it would probably be a mistake if they backed off strategic initiatives" just to cut costs now, Hochmuth said.

O'Pry agreed. "Trying to scrimp and save on security in this economy would be a penny-wise, pound-foolish thing to do," he said. O'Pry noted that as a financial services firm, Henssler is "affected more than anyone else" by the downturn. Even so, there's little talk within the company about cutting security spending. "Your most valuable nontangible asset is your reputation," O'Pry said. "You can't risk taking any hits to that."

Computerworld is an InfoWorld affiliate.

With the ailing economy putting a crimp in IT budgets, information security managers — like just about everyone else in the tech world — are feeling pressure to keep their costs in line.

Few expect to be hit with outright budget reductions, at least in the short term; regulatory requirements and the ever-expanding list of external and internal threats make it hard to devote less money to security efforts. But there is a growing push to curb or defer spending increases, according to IT managers and security analysts.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

"It's imperative to squeeze every penny of value out of everything you do," said Jim Kirby, senior network engineer at DataWare Services, an IT services firm in Sioux Falls, S.D. This is a good time to stop working on "marginal" projects and redirect resources to security capabilities that are absolutely necessary, Kirby said.

Matt Kesner, chief technology officer at Fenwick & West LLP in San Francisco, said the law firm's security strategy for next year is to "focus on basics." Its 2009 IT budget doesn't call for reduced spending on security — but neither does it include a funding increase.

And Fenwick & West is taking some steps to cut costs. The firm is deferring an earlier plan to hire a full-time networking and security expert because of the recession, Kesner said. It is also looking for opportunities to use open source alternatives to some of its security tools.

One of the few new IT projects approved for next year is a replacement of the anti-virus software installed on all of the law firm's PCs — an upgrade that Kesner said is being driven by the increased threats to corporate data from malware and phishing attacks. Fenwick & West also plans to train end-users more intensively on how to secure their PCs and mobile devices, and on the importance of creating strong passwords.

Even in an economy gone sour, a growing number of government and industry regulations impose security compliance costs that there is simply no getting away from. For instance, new data-protection laws in states such as Massachusetts, Connecticut, and Nevada require companies to use data encryption tools and implement other security controls to safeguard the personal information of state residents.

Similarly, the Payment Card Industry Data Security Standard, created by the major credit card companies, requires all businesses that accept credit and debit transactions to adopt a broad set of data protection controls. And the federal HIPAA law includes data security and privacy rules for health care providers in order to protect patient information.

Meanwhile, cybercrooks are targeting companies with increasingly sophisticated — and successful — attacks. For example, Symantec Corp. said in a report last month that at least $1.7 billion worth of bank accounts were compromised in the United States during the 12-month period that started in July 2007.

In light of all that, not making cutbacks in anti-virus subscriptions and purchases of frontline security tools such as firewalls and network intrusion-detection systems is a no-brainer, security managers said.

Kirby said investments in outbound-traffic inspection tools and controls for locking down portable media devices also are worthwhile because of the heightened risk of insider attacks at a time of increased layoffs. In addition, he thinks that cutting back on disaster recovery and business continuity projects wouldn't be wise.

Whittling away at risk management and compliance oversight functions is another bad idea, said the chief privacy officer (CPO) at a large financial services firm. That could leave companies facing potentially serious consequences for not complying with security requirements, he said.

What to cut
But there are other areas in which IT and security managers may be able ease up on spending. Kirby said that although intrusion-detection systems are a must-have item, many companies can live without intrusion-prevention tools, which are more sophisticated but also more expensive and harder to manage. He added that biometric security projects can often be postponed.

Paring back on third-party security education and training programs can also yield some extra dollars that can be used for other purposes, said the CPO, who asked not to be identified. "Companies have a lot of vendor-hosted or vendor-provided education programs — kind of, 'Here's how you do data security if you're covered by HIPAA or by PCI,' " he said. According to the CPO, the cost of individual programs can sometimes top $200,000 annually, depending on the number of employees being trained.

Marcin Czabanski, director of IT at LifeSecure Insurance Co. in Brighton, Mich., said companies should also look for ways to move applications — and their security functions — into the computing clouds offered by vendors such as Google, Microsoft, and Amazon.com.

By doing so, Czabanski said, "you can outsource a lot of the headache" of managing and securing desktop applications — and do so for less money than keeping the work in-house.

E-mail is another application that can move to the cloud. The Henssler Financial Group in Kennesaw, Ga., is a user of Google's Postini e-mail security and archiving services. Tim O'Pry, Henssler's chief technology officer, said the arrangement has enabled the financial services firm to offload to Google the hassle and expense of securing its e-mail system.

In addition, using the hosted services has "dramatically" reduced Henssler's e-mail archiving costs while making it easier for employees to search for and retrieve old messages, O'Pry said.

Moving e-mail to a cloud infrastructure such as Google's can also help organizations lower the costs of complying with e-discovery rules in legal cases, said David Jordan, chief information security officer for Virginia's Arlington County.

For instance, Google earlier this year launched a Postini service called Message Discovery that is designed to help businesses comply with e-mail retention regulations and speed up the process of retrieving messages in response to lawsuits or other legal matters. Such setups can also help customers trim their e-mail hardware, software, management, and security costs, Jordan said.

Another possible cost-saving option, he noted, is deploying virtualization and thin-client technologies that let employees access a set of centralized applications. Jordan said he thinks that thin-client architectures are inherently more secure — and thus less costly to manage and control — than traditional client/server computing models.

Any cutbacks should be carefully weighed, though.

Phil Hochmuth, an analyst at Yankee Group Research Inc., said it's understandable that companies might want to rein in their security spending (see related story, at left). But on a longer-term basis, "it would probably be a mistake if they backed off strategic initiatives" just to cut costs now, Hochmuth said.

O'Pry agreed. "Trying to scrimp and save on security in this economy would be a penny-wise, pound-foolish thing to do," he said. O'Pry noted that as a financial services firm, Henssler is "affected more than anyone else" by the downturn. Even so, there's little talk within the company about cutting security spending. "Your most valuable nontangible asset is your reputation," O'Pry said. "You can't risk taking any hits to that."

Computerworld is an InfoWorld affiliate.

While Google is often cited as having a golden touch, the company's productivity application suite is still a mere bronze competitor to Microsoft's Office and collaboration tools despite upgrades over the past year that focused on evolving and securing the online tools for corporate users.

Google Apps Premier Edition (GAPE), the vendor's $50 per user productivity suite targeted at businesses, has proven worthy in certain situations, most involving universities or small and midsize businesses (SMB) looking to cut costs.

[ For more analysis of Google Apps' chances of dislodging Microsoft Office, read "Can Google Apps move up market?" | And discover the top-rated IT products as rated by the InfoWorld Test Center. ]

The platform, however, still lacks some key features for large companies that build applications around productivity tools and demand tight integration and security, along with administrative controls.

GAPE is made up of messaging, including Google Gmail, Calendars and Talk; collaboration including Google Docs, Video and Sites; and e-mail security and compliance.

Over the past year, Google has been adding tools and APIs to satisfy customer demands, as well as Web 2.0 tools such as video that put a new twist on collaboration. But the work is far from over.

Model for success
Even critics, however, believe Google has the right model to succeed — delivering the software as a service to corporate users.

Microsoft , whose Office suite boasts more than a 90% share of the market, is among those critics.

It endorsed the online model in October when it introduced the first online versions of fully functional Office applications available via a browser. Office Web Applications are in private testing and are slated for inclusion with Office 14. Microsoft already has its toe in the water with Office Live Workspaces and with Exchange and SharePoint Online Services.

While the future may hold promise, the current position for GAPE is the role of worthy alternative and not as serious contender to replace Office or other collaboration platforms.

Google, however, may make its mark not by rising to the top of the heap, but by redefining collaboration and carving the most innovative turns around Web 2.0.

Growing up
"The Google model is not wrong, it is just immature," says Guy Creese, a Burton Group analyst who for years has been tracking Google's efforts to produce online productivity tools. This month he is releasing a report entitled: "Is It Time to Ditch Microsoft Office?"

It is an interesting question because Google isn't lagging for lack of trying.

The company is refining its platform to include new features and controls that appeal to — and are required by — corporate users. And it is adding Web 2.0 twists and integrating social software.

In July 2007, Google made its biggest investment yet toward satisfying corporate users when it laid out $625 million for e-mail hygiene vendor Postini, which provided the compliance, archiving and e-mail protection GAPE lacked.

The Postini service provides security for e-mail, instant messaging and the Web; archiving; message encryption; and policy enforcement of Transport Layer Security.

And because Postini's archiving and compliance only covers e-mail, Google last month released an API to address documents.

"We let you connect your Google Docs with the others systems you use for compliance," says Rajen Sheth, senior product manager for Google Apps. "We continue to mature the product set."

To further back that claim, Sheth also cites the addition of Google Sites, a wiki-based team sharing tool, and Google Video, based on capabilities inherited from its YouTube division.

Google also has added an service-level agreement and is working on an administrative dashboard that shows how its systems are running and their health. The tool comes after a string of outages that crippled GAPE in the past months.

And in November, Google earned its SAS-70 Type II certification, which public companies under the Sarbanes Oxley Act require from their hosting providers.

In addition, Google and its partners are busy ratcheting up the feature set , such as Panorama Software, which has developed a slick — and free — business intelligence tool called Analytics for Google Spreadsheets.

"This is not about replacing, it is about solving old problems in new ways with Google Docs," says Oudi Antebi, vice president of strategy for Panorama. Antebi, who came to Panorama after eight years at Microsoft, says one reason for lagging enterprise interest in GAPE is that many are looking at it as a replacement instead of an extension to what they already have.

Seeing is believing
One example of Google's potential power is seen in the District of Columbia government, which is using Google's productivity suite to foster cost reduction, anywhere access, mobile integration and a collaboration platform that evolves on Internet time for its 38,000 employees.

Vivek Kundra, the CTO for the D.C. government, is blazing such a path with his Google-based projects. He is rumored to be helping President-elect Barack Obama's transition team work through its technology agenda focused on "cutting-edge technologies to create a new level of transparency, accountability and participation for America's citizens."

Kundra's innovations around Google Apps include a video job board, where D.C. hiring managers post descriptions of openings; a wiki built with text and video explaining and soliciting participation in D.C.'s procurement process; and his latest project where he has provided a list of contractors D.C. has hired, the projects they are working on and their pay rates.  

"What we have created is transparency," Kundra says. "Taxpayers can hold us accountable."

Kundra also launched Apps for Democracy, a contest to build applications on top of the Google platform using any of the 216 data feeds from the D.C. Data Catalog, including most recent road-kill pickups.

The contest yielded 47 applications in 30 days at a cost of $50,000. Kundra estimated the price would have been $2.6 million if done using D.C.'s old form of in-house development. Seven of the applications are now running in production.

"This is the power [you get] when you greatly democratize the ability to create, publish and distribute content," Kundra says. "Before, you relied on a massive IT operation with developers, Web editors and writers. Now we shift power to the individual employee."

But Kundra recognizes Google Apps also has its weaknesses.

D.C. still uses Microsoft Office, which he says is better suited for creating complex documents, and he is still waiting for Google integration with Exchange calendars.

Climbing the mountain
One barrier to Google's success is the fact that it is a crowded race to become second fiddle and take a run at Microsoft's dominance.

Since launching GAPE in February 2007, Google has earned $4 million compared with $12.2 billion for Microsoft's Office, according to Gartner. Google won't clarify its number of paid users other than to say it has "hundreds of thousands."

And there are a host of other competitors including IBM Lotus Symphony, Corel WordPerfect Office, OpenOffice.org, Sun StarOffice, ThinkFree and Zoho, as well as lesser known vendors such as Ability Office, Celframe Office, Koffice, GNOME Office and Softmaker Office.

In a study released last month, ClickStream found that use of free versions of productivity tools such as Google Docs and OpenOffice remain low and that use of Microsoft Office showed no decline.

ClickStream spent six months tracking usage among 2,400 adults using the tools at home and found that 51 percent used Microsoft Office, while only 5 percent used Open Office, 1 percent Google Docs, and 0.3 percent Google Spreadsheets.

ClickStream concluded that "although Google Docs and Spreadsheets has been touted as a potential competitor to the Microsoft Office suite, OpenOffice is currently the more likely app to take that position, possibly indicating the value of offline and local processing enabled by installed applications."

What's missing?
Critics and Google agree there is work to do.

Burton Group's Creese says Google provides only rudimentary e-mail distribution lists, lacks the ability to do administration via roles, and does not support Office 2007 file formats.

"If you standardized on [Office 2007] you are in trouble," he says. The software also does not translate all graphics from Word documents, supports only a dozen or so fonts, does not provide in-box delegation features and imposes file size limitations when importing documents.

"If you are trying to collaborate on PowerPoint you could hit the limit," Creese says.

He thinks SMBs may be able to go completely to GAPE, but "a large corporation cannot do that. It will always have a mixed environment and you have to worry about these translation issues."

He adds that for Google Apps to take off it has to present new ways of working rather than just making software less expensive. "In the long run, we will see a movement to the software-as-a-service office suite in some form," he says.

Google's Sheth would not provide details of coming features for GAPE, but agreed with the list of issues cited by Creese and others. "I think we already have a robust enterprise offering, of course there is more we can do. We are building that list and adding more and more functionality," he says.

The challenge is clear to many.

"Google needs to keep innovating around new ways that people work," says Tony Safoian, president and CEO of SadaSystems, a consulting and development firm that is both a Microsoft and a Google partner. "I can work with five people at the same time on the same spreadsheet and get the work done. That is how people work today. Google needs to continue to move along the lines of the collaborative work environment where people find things in a few seconds instead of hours or days. That is where Google's edge is now."

SadaSystems has made a significant investment in building Google Apps implementations and will continue to move users to the cloud.

"We are betting big on this technology," Safoian says.

Now the question is whether corporate users bet big on Google and its innovations or stick with Microsoft as it moves to its hybrid world of software and services.

Network World is an InfoWorld affiliate