How to sell security solutions - part two

There is no shortage of IT security products, but resellers should choose their partners with care. Security threats change so quickly that products must be continually revised and updated.

"There are lots of vendors and products," said Bernie Dodwell, sales and marketing manager at specialist security distributor Allasso. "But many are not updated regularly, or the companies behind them are relatively small. They have had a great idea but they don't have the resources to keep their products up to date."

And no vendor has the complete solution. "It's not a case of one product fits all," said Karen Campbell, channel marketing manager at enterprise security vendor Axent, which was recently acquired by Symantec. "Each customer, no matter what their size, needs to examine what they want to secure, and tailor the solution to fit. Resellers are best positioned to match a customer's needs to the range of available products."

The most popular products are those that counter the biggest perceived threats. Warren Wilson, marketing executive at security distributor E92plus, said: "Antivirus [AV] software and firewalls are probably our best sellers, because they reflect the basics of what people are trying to do - stop viruses spreading and protect their corporate data."

Leading AV software vendors include Computer Associates, F-Secure, Content Technologies, Sophos, Network Associates, Symantec and Trend Micro. Major firewall vendors include Axent, Check Point, WatchGuard and Cisco. Both markets are becoming increasingly commoditised, with correspondingly lower margins, but vendors argue that there is still a place for the skilled reseller.

"There is a perception that AV software is a commodity, and there will always be a market that buys from retailers," said Paul Brettle, product consultant at F-Secure. "But although 95 per cent of PCs have AV software, one in seven PCs will catch a virus sometime this year. That means a lot of people aren't using their AV software correctly. Resellers shouldn't sell AV software and run away. They need to be in constant contact with the customer."

AV software is expected to polarise into commodity software for small businesses and lone PCs - perhaps supplied via managed services such as Star Internet - and corporate products that will include remote management, automatic updating, user transparency and integration with a customer's security policy.

Firewalls under control
Firewalls - the software that provides sophisticated access controls, ancillary services such as AV, control of internet access and basic encryption - are also becoming more straightforward, which is good news for less specialist resellers that want to provide security as part of a wider solution.

Ian Kilpatrick, group managing director at distributor Wick Hill, said: "We stayed out of firewalls when they were desperately complicated because resellers wanted to install them themselves. Now, installing a firewall is no more complex than installing a network server. We do WatchGuard, which is so easy that the geography teacher at Cheltenham Girls' School installed it himself."

So-called Appliance firewalls - dedicated machines with stripped-down, super-secure operating systems - are gaining ground over pure software firewalls. Nokia is the market leader, and other vendors include NetScreen, SonicWall and WatchGuard. Filtering routers offer a simpler alternative to full-blown firewalls.

Firewalls react to security threats when they arise. More proactive managed service firewalls, or session walls, can detect possible hacking attempts and denial-of-service attacks, where a server is bombarded with messages until it crashes. It can also monitor staff use of the web and fix security threats automatically.

Intrusion detection software, such as RealSecure from Internet Security Systems (ISS), performs similar functions, while intrusion testing software, such as ISS's Scanner series and Computer Associates's eTrust, can pinpoint potential weaknesses in an end user's security. Intrusion detection and testing are becoming more popular as companies try to be proactive about preventing hacking instead of just trying to block hackers when they arrive.

Ecommerce and the web are spawning products for web reporting such as Radware, which monitors performance, availability and security. And ecommerce application servers are increasingly using super-secure 'trusted operating systems', including Pitbull from Argus, and Seos from Computer Associates.

Proactive protection extends to scanning employees' email to check for viruses or content that is libellous, obscene or commercially sensitive. Content Technologies' MimeSweeper, Nokia's WebSense and software from WorldTalk can do this, as well as letting managers define what users are allowed to do on the internet.

"Content inspection software is nice and straightforward for the channel because it's not difficult to install or maintain," said Kilpatrick.

The growth of virtual private networks (VPNs), which use the internet as a cheap alternative to private voice and data networks, is creating demand for VPN management and encryption products. But these functions are being included in firewalls rather than sold separately.

"Our experience is that pure VPN vendors are being blown out of the water by the ability of firewalls to perform much the same functions," said Dodwell. "VPN vendors will find it very difficult to sell their products against firewalls."

Encryption was given a boost in the summer by the lifting of a US government ban on the export of 128bit encryption software. RSA, Network Associates and Vanguard are among the leading encryption vendors, although their software is often incorporated into other products like firewalls, remote access software and ecommerce servers.

Vendors with pure VPN and encryption products, including F-Secure, are switching their focus to remote access and internal security, especially with the advent of 'always on' internet connections via asymmetric digital subscriber line and cable, where teleworkers' remote connections could be left unattended.

"Most people understand the risks to do with the internet," said Brettle. "The next phase is understanding that things on their internal networks are not secure either."

Who's calling?
The explosion in teleworking, extranets and the internet has created a need for authentication to verify who is at the other end of the line.

Authentication products, including those from Baltimore, Entrust and RSA, create unique digital signatures that can prove the identity of a caller or the author of an electronic document.

Nokia's WebSense can control access to websites, and ISS's new Online Scanner can perform a 'health check' on remote PCs, searching for viruses before allowing the PCs to connect or perform ecommerce transactions.

Wap authentication is likely to be the next big growth area. Because of the perceived complexity of security and the continuing trend towards outsourcing, managed security services are becoming increasingly popular.

"A lot of our [resellers] are moving into managed services," said Dodwell. "It's great for the bigger [resellers], but a lot of smaller ones don't have the resources to compete with those kinds of services, so there's a move to distribute services as well as products to the channel."

A simple product like a firewall can still require a day's consultancy to install, and because security is so critical, customers are prepared to pay their resellers to do it properly. Moreover, the original sale may account for only half the total value of a contract, since many customers invest as much again in ongoing maintenance and upgrades during the life of the system.

Serving many masters
Even a small security reseller may sell up to 40 products from a dozen or more vendors, so support is a crucial issue. Security vendors and distributors have an above average reputation for supporting the channel, perhaps because above average margins mean they can afford to.

Pre-sales support is generally good, with vendors or distributors willing to provide presentation and direct marketing materials and even help with the sales pitch. Technical resources are also readily available - at a price.

Increasing numbers of vendors run accreditation schemes. Training usually forms a significant part of accreditation, and although this is expensive to acquire and maintain, resellers agree that it offers commercial benefits.

The real challenges for resellers mostly lie at the customer end of the transaction. "The credible reseller is the one who is selling solutions based on the needs of the customer," said Dodwell. "The problem is that customers don't always know what their needs are."

Conclusions:

• Commodity products such as firewalls and AV software are continuing to sell well.
• Proactive measures such as prevention and detection are gaining ground over simple barriers to unauthorised access.
• Remote access and portable security are growth areas.
• Managed services are on the increase, but considerable resources may be required.
• Product margins remain very healthy at 20 to 30 per cent.
• Security vendors are above average at providing support and accreditation to resellers.