In a major study of the SaaS messaging market that we will be publishing
this week, we address the perception of many IT decision makers that the
security of a SaaS solution is inferior to that of on-premise systems. For example, in response to the question,
“What level of security do you feel that hosted/SaaS providers offer versus
internally managed systems?”, 25% of IT decision makers told us that
hosted/SaaS providers offer a lower level of security. By contrast, only 20% of decision makers
believe that SaaS providers’ security is better than their own, while the bulk
of them believe there is no difference.
What are the specific fears that decision makers have with regard to
hosted/SaaS solutions? Among the reasons
given in the research were the following, in order of concern:
·
Non-authorized users from providers will have access to the data
·
Lack of familiarity with providers’ security procedures
·
Data may be compromised during transmission
·
Security of in-house solutions can be enhanced by having multiple layers
of protection
I believe there are two key takeaways from this data:
·
First, SaaS providers need to embark on a serious education program to
help IT decision makers understand just how secure their infrastructure and
data transmission really is. That might
include white papers, online videos, in-person tours, etc. that demonstrate the
logical and physical security that all leading SaaS providers offer.
·
As a corollary to this, SaaS providers need to help decision makers
understand the gaps in many of their prospective customers’ internal security
procedures that may be giving them a false sense of security. For example, SaaS providers need to point out
that in many organizations, any employee can gain access to a server room or a
backup tape quite easily, leaving the organization vulnerable to serious data
loss.
I want to be clear that it’s not our position that internal security is
always inferior to the level of security offered by SaaS providers. Many organizations have deployed very robust
security that can protect their data from unauthorized access. However, on average, SaaS providers – at
least the leading ones – offer better security than most of their prospective
customers because they have a) the resources to do so and b) they have much
more to lose if they don’t.
OR Commentary for Messaging Wire
Week of 09/14/09