Carrier security outsourcing making connections

Massive telecommunications carriers, including AT&T, BT, and Verizon, are promoting their ability to take over a significant portion of customers' IT security operations, and some enterprises are already buying into the model.

Over the last several years, the sprawling carriers have acquired and introduced a range of technologies and services that promise to help protect customers from the growing wave of IT-based threats, including denial-of-service attacks and Web-borne malware programs.

And while the carriers all concede that delivering safe telecommunications and Internet access to their customers' doorsteps is a fundamental requirement of their core business, the companies also maintain that they are uniquely positioned to become broader security outsourcing partners for their clients.

Florida-based First Advantage is already outsourcing a significant portion of its IT security operations to its carrier partner, Verizon Business.

The publicly held risk management services company had previously seen a payoff from outsourcing elements of its call center and software development operations, and the increasing complexity of its security and compliance concerns made it a natural to enlist Verizon to take over more of the work, executives said.

"Compared to the cost of internal operation, price was obviously a major consideration, but it was also the idea that these are specialists in security who we would be turning to," said Isabelle Theisen, chief security officer at First Advantage.

"They can provide a level of monitoring and correlation that would not have been possible for us to achieve internally," she said. "And we wanted to take a more leading-edge approach to matching potential threats to specific assets, something that alone would demand a full-time team for us otherwise."

Theisen estimates that First Advantage, which specializes in employee background screening and insurance fraud investigation, has already ceded approximately 70 percent of its IT security operations to Verizon.

Among the services it consumes from the carrier, which include everything from AV (anti-virus) and IPS (intrusion prevention systems) to Web applications firewalls and operation of compliance-mandated server farms, many came to Verizon via its July 2007 acquisition of CyberTrust.

However, the seeds that have grown into the company's portfolio of security outsourcing skills were taking root years before the deal for the MSS (managed security services) company came to pass, Verizon Business officials said.

"We saw tremendous growth in demand for additional security services starting in 2005 and knew we needed to scale up; adding CyberTrust has helped us expand rapidly, and we're seeing even greater demand today, especially among multinational customers," said Cindy Bellefeuille, director of solution and product marketing at Verizon Business.

Some industry watchers have said that customers will increasingly expect carriers to eliminate many security threats as part of their core connectivity services just as they require the companies to guarantee network performance speeds in their SLAs (service level agreements).