Increasing revenue through information protection services

Transcription

1 Increasing revenue through information protection services Selling new cloud and mobile services with confidence

2 Contents Introduction 2 About this report 3 Profit from new revenue opportunities 3 Meet customer demand 4 Build trust and confidence in the cloud 6 Managed M2M connectivity 8 Bring the right decision makers together 9 Meet market demand 10 Meet business objectives 11 Conclusion 12 The right partner for information protection 12 References 12 1

3 Introduction The communications industry is undergoing a major transformation. The traditional voice market has flattened and is now in decline. Communication Service Providers (CSPs) are experiencing increased competition from other Telcos, and new Over the Top (OTT) players and web-based providers are entering the market. As the latter are using existing CSP network resources to offer price-attractive service offerings, this opens up a complex new battleground for customers and revenue. The convergence of IT and network operations is driving the implementation of an all-ip communications network that promises huge cost savings. As a result, investments in service-enabling initiatives for cloud, mobile, machine to machine (M2M) and content delivery are becoming a priority. Protecting infrastructure and information assets as well as the customer experience is of high importance. Security is a key concern to customers and is integral to priority investments around cloud, mobile and M2M. This is further complicated as the threat landscape is changing to include mobile devices, putting Android, Windows Mobile, and even ios devices at increased risk. This trend looks set to continue as enterprises are introducing mobile technology for business purposes and supporting BYOD (Bring Your Own Device) programmes. The shift from securing the perimeter to protecting an organisation s information is becoming harder for CSPs, due to three trends: The volume of data is growing exponentially. Information has gone beyond IT data centers and PCs to the need for access from any device in any location and the cloud. The value of a company has changed from physical assets to how it uses information. CSPs already have experience in protecting and managing internal IT information. This gives them a great advantage as their customers, including enterprises, SMBs, and consumers, are experiencing the same challenges with information protection but most don t have the resources to deal with them. This presents a huge opportunity for CSPs to monetise skills and investments to provide information protection services to their customer base and target markets, turning information protection from a pure internal cost and risk perspective into an opportunity for growth. In addition, CSPs can position themselves as cloud services brokers (CSB) or aggregators for security and information protection services. They can protect customers accessing public cloud services over the Internet in an innovative way, via both fixed and mobile networks. 2

4 About this report Stakeholders Business Challenges Risks CMO/Product Management Sales Management cto/technical Architects CFO/Finance department Brand reputation, customer satisfaction and churn, delivering innovative services that sales can successfully sell New business generation, increased ARPU Build and maintain service portfolio Total cost of ownership, return on investment Competitive differentiation, services roadmap, time-to-market Upsell opportunities from existing core business products, sales enablement and succussfully selling new IT related services Integration into existing infrastructure, vendor complexity, agility and flexibility, achieving planned SLAs Upfront investments, sales forecasts, payment models and cash flow This report supports CSPs exploring innovative information protection offerings that they can successfully sell to their existing customers and target markets. It addresses the important business challenges faced by key stakeholders and provides recommendations based on Symantec s experiences of working with CSPs worldwide. The report utilises Symantec research, analyst commissioned research, and Symantec s breadth of knowledge and experience within this industry to provide in-depth analysis of both business opportunities and risk. Profit from new revenue opportunities Existing relationships with large consumers, SMBs and the enterprise customer base offer CSPs another key differentiator against competitors. The potential to seamlessly grow from consumer services into SMB or even enterprise solutions shouldn t be underestimated. CSPs are running huge service delivery platforms, billing systems and customer care centres which can be optimised for new types of services. They also have a reputation for guaranteeing strong service level agreements (SLAs) in their core communications business; therefore customers perceive CSPs as very trustworthy. If they are able to manage similarly strong SLAs in trust and security for cloud and mobile services, then they are in a great position to succeed in the new world of services. Develop a services roadmap and catalogue Unlike their competitors, CSPs can develop a straightforward information protection and management roadmap: starting from core network competencies then leveraging all other differentiating assets and moving up the service stack. So, they are in a superb position to create huge upsell opportunities for their sales operations. This roadmap should include details on how CSPs can offer and manage: Communication networks (pipes). Performance and availability of the pipes. Security of the pipes (clean pipes). Policy-based network security and management services. (CSPs are in a unique position to provide highly scalable, network-based and device-independent security by analysing network traffic.) Endpoint management, application management and protection services for connected servers, PCs, tablets, and smartphones. Strong user authentication and encryption services. Backup and archiving services of network-connected systems. Storage and disaster recovery services. Personal cloud and secure file sharing services. 3

5 IT compliance and data loss prevention services. Cloud Brokerage Services for Information Protection. Secure M2M connectivity services for vertical markets. CSPs who partner with just one or a limited number of vendors to develop such a roadmap for their customers will benefit significantly from technical and contractual simplicity and faster time to market. Swisscom IT Services and Slovak Telekom (part of Deutsche Telekom AG) experienced significant network resource savings and reduced costs for their customer care centres as the result of their clean pipe solution. Swisscom s CPU server performance increased by 50%, allowing the organisation to reduce its messaging transfer server infrastructure by half. The help desk administration effort required to resolve related customer cases also decreased ten-fold. Optimise networks before adding services An existing network is an important advantage for generating top line business. But as traffic is increasing, often through OTT players and third-party content providers, it becomes more difficult to manage network resources properly. CSPs are constantly being pressurised to increase network bandwidth in order to satisfy customers, which ultimately reduces profitability. Another area of concern is the level of unsolicited and malicious traffic, much of which is caused by botnets. CSPs that neglect solving this problem risk: Unsatisfied customers and higher churn. Bad brand reputation through blacklisting. Higher total cost of ownership of the network infrastructure and customer care centres. Poor foundation for revenue generating services. Meet customer demand There is increasing evidence that many customers, from consumers, small home offices and SMBs, up to large enterprises would rather buy into an information protection roadmap and purchase cloud and mobile services from CSPs, than try to solve the challenges by themselves. Companies of all sizes are suffering from targeted attacks As security attacks become more sophisticated, many organisations are experiencing significant difficulties dealing with the resources, time and money required to maintain effective security architecture. In particular, SMBs are presenting as a core target market for CSPs as they are suffering the most due to limited resources. Symantec research found that out of 26,000 targeted attacks in 2011, almost half were aimed at SMBs and 18% of the companies targeted had 250 or fewer employees 1. CSPs are strongly advised to optimise networks using a Clean Pipe strategy. Traffic management projects, using Deep Packet Inspection (DPI), can be easily complemented by network-based security policy management, which will significantly reduce malicious and unsolicited traffic. The impact will be a further gain in networking resources in inbound and outbound data streams and an increase in the messaging reputation. The gains in bandwidth and server resources can be invested in new value-added services for customers, thereby increasing revenue. Organisations of all sizes at risk of targeted attacks ,428 <250 18% 13,518 2,500+ Source: Symantec Internet Security Threat Report 17, 2012 This presents an opportunity to offer managed security services and cloud-based security to this market to help mitigate these risks. 4

6 Mobile computing risks are increasing Symantec research found that 2011 was the first year that mobile malware presented a tangible threat to businesses and consumers 1. For years, attackers focused on Windows PCs because the widespread prevalence of the platform meant the return on investment was greater. However, in 2012, the attentions of the attackers shifted towards Windows Mobile, Android, and even ios devices. The network-centric information protection approach gives CSPs unique opportunities to offer highly scalable services for enterprises and consumers which can include parental controls, corporate controls, personal screening, mobile security and data retention. SMBs struggling with data protection and disaster recovery Businesses are aware of these risks and when a Symantec survey asked IT to rate the risk associated with 10 common computing initiatives, 41% of the respondents placed mobile computing within their top 3 risks 2. As a result, protecting information and devices is becoming a key market consideration. Symantec research discovered that many SMB customers are at risk when it comes to disaster recovery 3. Although good backup technology is available, SMBs often don t have the right personnel and processes in place to manage the volume of data within their existing infrastructures. Enterprises already purchase mobile security from Telco suppliers Symantec research found that enterprises already purchase or plan to purchase security safeguards from Telco Service providers 2. From whom do you currently purchase security safeguards? Software vendor 48% <50% back up data weekly or more frequently 31% don t back up 21% don t back up application data 17% don t back up customer data Only 23% back up daily In a disaster 44% would lose at least 40% of their data Our Telco service provider 52% Source: Symantec SMB Disaster Preparedness Survey, 2011 Source: Symantec State of Mobility Survey, June 2012 As a result, there is an excellent opportunity to support SMBs (and larger enterprises) with information protection and disaster recovery services. 5

7 Build trust and confidence in the cloud Develop cloud and mobile business models The cloud holds significant potential for CSPs to deliver innovative information protection services that are perceived as trusted and available. However, this marketplace is growing rapidly and looks set to become a battlefield. There is also still some resistance to the cloud from companies who fear the loss of intellectual property, customer data, reputation, malicious activity and outages. A 2011 Symantec survey found that security is still the number one concern for enterprises moving parts of their IT into the cloud 4. It showed organisations are conflicted about security 88 percent believed the cloud would not impact on and could even improve security postures, while still rating security as their major concern on moving to the cloud. To succeed, CSPs need to provide superior cloud services that are more trusted than those offered by the current generation of ott players and other web-based cloud providers. Product Managers within CSPs need to address security and regulatory requirements, providing customer driven and service-appropriate security across multiple deployment methods, while guaranteeing highest performance and SLAs. The guidance by the Cloud Security Alliance (CSA) provides an excellent starting point. CSPs can differentiate themselves by designing CSA controls (policies, procedures and processes for 14 defined security domains) into their cloud architectures. They should also ensure any third-party cloud service partners implement these controls. In addition, with the adoption of the 4G mobile technology LTE, which is based on the all-ip protocol, CSPs should integrate IPsec protocols for secure connectivity. CSPs should analyse various deployment options for their cloud service offerings. The right choice will depend on target markets and size, competitor offerings, time-to-market requirements, cloud partner ecosystems, and their own IT service delivery skills. Resell existing services from trusted cloud partners CSPs without extensive IT and cloud services experiences, or for whom time-to-market is critical, should partner with established cloud providers to resell information protection services. CSPs need to select a cloud partner that supports the security guidelines and best practices of the CSA and provides the most suitable SLAs for their business models. Availability, security efficiency, delay times, service and support, as well as transparency of the service, are important considerations in the selection process. CSPs should have the option to resell these services under their own brand, co-branded, or marketed completely under the partner s brand. Build cloud services CSPs with advanced IT services skills are able to build cloud services that they can adjust to the special needs of their customers: for example, regulatory requirements in certain countries or vertical industries can be exactly addressed. This deployment model provides more flexibility and margins can be higher. Following the Security by Design principals from the CSA, security and availability controls should be embedded into cloud architecture from the beginning. Everything depends on how you secure your data. If there s no security, there s no point in going for the new technology. CTO of a small technology company 6

8 Extend on-premise customer environments via cloud Prepare for the future above the cloud CSPs can use this as a migration step for customers moving gradually into the cloud while leveraging existing on-site investments. On-premise security software can be managed via cloud-based management portals hosted by the CSP. On-premise backup and archiving solutions can automatically back up the data into the cloud-based data centers of the CSP, where skilled personal and certified processes will guarantee high availability and disaster recovery SLAs. Our goal is by 2014 everything should be in the cloud. CTO of a small technology company The recent beta phase of a new Symantec cloud security brokerage solution demonstrated that CSPs are keen to offer security for cloud services above the cloud. Their network-centric position between enterprises and third-party cloud providers allows them to act as cloud service aggregators and cloud brokers for policy-based security management. In this expanded role as an ecosystem manager, CSPs can ensure enterprises migrating to the cloud can maintain the same risk posture; enabling them to extend their internal information protection policies to data migrated to the cloud. There is a great opportunity to enrich the customer experience and assist compliance with data protection regulations and internal IT security policies. This is especially important, as public cloud services are often not transparent about security implementations. A new security layer above the clouds CSP Business Customers CSP Information Protection Brokerage Service Access control Information protection Cloud visibility Control Security Compliance Private cloud Cloud Services of all kinds To embrace the cloud with confidence 7

9 Investment 2012: Business Strategy Services / Technology Currently Sought Less than 12 Months Number of Delegates Cloud Billing (Converged & Real Time) Broadband Infrastructure BSS Business Transformation Carrier Ethernet Charging & Policy Management Cloud Computing Software Complex Programmes & Managing Risk LTE M2M Mobile VAS Customer Care & CRM/CEM Customer Loyalty/Churn Management Data Center Optimisation Location-based Services LTE/4G Machine to Machine Mobile Backhaul Mobile Marketing Mobile Value Added Services Mobile Workforce Management Network Management & Optimisation Network Performance Management OSS Outsourcing/Managed Services Real Time Business Intelligence-Event Processing Security (Network, Customer, Mobile) Network Power/Energy Storage & Management Investment Priorities Security Smart Card & Contactless Technology Video based services Subscriber Data Analytics Test & Measurement Video-based Services Wireless Infrastructure Source: Symantec sponsored GDS International NGT Summit 2012 Investment Priorities of leading European CSPs Managed M2M connectivity Although M2M has been available for many years, it has recently become an investment priority for providers. As CSPs migrate from pure connectivity via managed connectivity towards multiple forms of complete service enablement, different models in the M2M value chain have been developed. Most providers are focusing on vertical markets such as Smart Metering or mhealth, which are highly security sensitive. Driven by scalability requirements, Public Key Infrastructure (PKI) solutions are experiencing a renaissance within M2M security as they ensure that only trusted devices are communicating and also guarantee authenticated firmware updates. For example, the German Federal Office for Information Security (BSI) mandates PKI as the security measure for authentication and encryption in smart meter gateways for the German market 5. Few CSPs can justify running a secure, large-scale PKI infrastructure for their customers. Partnering with managed PKI providers that perform all these security processes on their behalf will allow CSPs to quickly enhance the value of M2M service offerings to vertical markets with securely managed connectivity requirements. Information Protection Services opportunities Cloud Mobile Cloud Brokerage Strong Convergence Information Protection Services M2M 8

10 Bring the right decision makers together Successfully selling new services requires good planning and a common direction for all major stakeholders. Bringing the right stakeholders to the table early enough, to discuss and agree on service abstraction layers, deployment models and the service target segments with specific go-to-market strategies, is as important as the industrialisation of the service offerings is critical to achieving profitability. Symantec has developed a Cube model that acts as a framework to support CSPs in analysing, architecting and deploying information protection services. As a result, the stakeholder groups will better understand the service strategies, business and technical requirements and financial models which can be tailored to the paying cycles of the CSP s customers. The framework also helps to answer the following important questions: SaaS PaaS Portals Web Services Communication Services End User Services Systems Management Monitoring Security Availability Archiving as a Service? Storage as a Service Security as a Service CSP Product Management and Marketing: Do I have the right roadmap of information services? CSP Sales Management: Can I sell these services to my target markets? Are there easy upsell opportunities from one service to another? CSP Technical Architect: Can I build, integrate and maintain these services under SLA considerations? CSP Finance: What are my upfront investments for sourcing the appropriate building blocks? What is my financial risk? Can I generate revenue? Do these services fit with the paying models of my enterprise and consumer customers? This model is a useful tool for maximising the industrialisation potential of different service offerings and ensuring business processes are aligned. Virtual Desktop Backup as a Service IaaS Network Power Compute Storage Distributor Enterprise SMB Public Hybrid Community Virtual Private The Cube Consumer Private Framework for services 9

11 Storage and Security Software as a Service Forecast (IDC) Million US $ Continuity Archiving Backup Mail security Web security Source: IDC Meet market demand Exploit and optimise existing infrastructures Symantec has worked with analysts including Gartner and IDC to analyse the demand for information protection services. The diagram above exemplarily illustrates the attractiveness of the market for five services. Analysts expect a CAGR (Compound Aggregate Growth Rate) of 30% or more for some of the information protection solutions delivered as services. CSPs have an advantage against prior established system integrators and traditional outsources. By using the existing consumer subscriber base and by offering services such as Personal Clouds and secure content management that grow seamlessly from consumer needs into enterprise requirements, these opportunities can be leveraged further. Most service providers have standardised their data centers on a common storage, server and high availability layer. By building services on existing infrastructures, CSPs can utilise an IT foundation that is not locked-in to specific hardware or software. Technical Architects, responsible for the design of the service, benefit from increased agility and flexibility. Additionally, they are able to easily migrate from legacy Unix systems to more cost-efficient Linux OS without losing any existing investments. Differentiate in the market Trust and confidence in cloud offerings give a key differentiator compared to low cost offerings from OTT players and content providers. 10

12 Meet business objectives Successfully selling information protection services will have a positive impact on all major business objectives. Business generation Brand protection and compliance Information protection solutions are essential IT services valued and demanded by customers. Depending on the target customer, type of service and SLAs, the additional ARPU could range from a few dollars to double-digit numbers per month. Different customer segments have different and constantly changing needs, and some expect basic information protection services as standard. While this will not generate direct revenue, the positive impact of lower churn will drive new business. CSPs can help customers comply with worldwide data protection regulations. For example, financial institutions need to archive mobile traffic for industry legislation, and a network-centric role makes CSPs an ideal partner to fulfil these requirements. Again, trust and confidence are absolutely crucial for building a strong brand. Even when soft regulations are only on a voluntary basis, they should be fully supported. This not only increases customer satisfaction, but also creates a route to sell premium services on top of free-of-charge offerings. Increase customer satisfaction and reduce churn Total cost of ownership and time-to-market CSPs can industrialise and offer services much more cost-efficiently than customers can build and maintain by themselves. Information protection delivered by service providers frees up resources for customers core business objectives and offers a welcome single point of contact for protecting information. A detailed services roadmap and intuitive self-service portals will increase the cohesiveness of the customer relationship. CSPs can leverage the investment in internal information protection solutions by sharing the cost with revenue generating business units. Industrialisation and reusable building blocks guarantee profitability. If time-to-market is a challenge, companies should partner with a leading cloud vendor that already brings a strong brand and a rich portfolio to the business. 11

13 Conclusion References CSPs are excellently positioned to offer information protection services and exploit upsell opportunities within the market. There is increasing evidence that many customers, particularly within the key SMB market, would rather buy into an information protection roadmap and purchase cloud and mobile services from CSPs than try to solve information protection challenges by themselves. To profit from these new revenue opportunities it is vital to leverage the existing network and infrastructure, develop a services roadmap, build trust and confidence, adapt to cloud and mobile business models, and use existing experience to differentiate within the marketplace. 1 Symantec Internet Security Threat Report 17, Symantec State of Mobility Survey, June Symantec SMB Disaster Recovery Preparedness Survey, Symantec State of Cloud Survey, German Federal Office for Information Security (BSI) Technical Directive BSI TR idc Worldwide Storage in the Cloud Forecast # idc Worldwide Messaging Security Forecast and 2011 Vendor Shares # idc Worldwide Web Security Forecast and 2011 Vendor Shares # The right partner for information protection Symantec protects the world s information, and is the global leader in security, backup and availability solutions. Our innovative products and services protect people and information in any environment from the smallest mobile device, to the enterprise data center, to cloud-based systems. Our industry-leading expertise in protecting data, identities and interactions gives our customers confidence in a connected world. Glossary BYOD Bring Your Own Device CSA Cloud Security Alliance CSB Cloud Services Brokerage CSP Communication Service Providers LTE Long Term Evolution (4G mobile) M2M Machine to Machine ott Over the Top PKI Public Key Infrastructure SLA Service Level Agreement SMB Small Medium Business Symantec has a strong focus on the Communication Service Providers industry and protects 17 out of the 18 largest telecoms companies worldwide. Symantec successfully supports Communication Service Providers generating new revenue streams by delivering mobile security and information protection services to their customers and target markets. Author Frank Bunn, Symantec Corporation Since 1995, Symantec has been operating the largest and most comprehensive PKI solutions for enterprises and service providers available on the market. More than 200 million device certificates have been issued to date. 12

14 Notes 13

15 Notes 14

16 Symantec World Headquarters 350 Ellis St. Mountain View, CA USA +1 (650) (800) Symantec is a global leader in providing security, storage and systems management solutions to help customers secure and manage their information and identities. Copyright 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. 07/12