Essay Against Outsourcing
The Case for Outsourcing Security
Deciding to outsource network security is difficult. The stakes are high, so it's no wonder that paralysis is a common reaction when contemplating whether to outsource or not:
- The promised benefits of outsourced security are so attractive. The potential to significantly increase network security without hiring half a dozen people or spending a fortune is impossible to ignore.
- The potential risks of outsourcing are considerable. Stories of managed security companies going out of business, and bad experiences with outsourcing other areas of IT, show that selecting the wrong outsourcer can be a costly mistake.
If deciding whether to outsource security is difficult, deciding what to outsource and to whom seems impossible. Over the past few years, we've seen many different companies offering different capabilities under the general category of “managed security services.” The field is so confusing that even the industry analysts can't agree on how to categorize the services offered. This company manages firewalls. That company offers periodic vulnerability scans. Another offers to manage security policies, or monitor the network, or install the IDS, or host the computers. Some of these businesses make sense, and some of them don't. Some will survive; some won't.
What to outsource
Companies won't outsource everything, because some things just don't outsource well. Either they're too close to the business, or they're too expensive for an outsourcing company to deliver efficiently, or they simply don't scale well. Knowing what to outsource is key.
Medical care is a prime example of outsourcing that works well. Everyone outsources healthcare; we don't act as our own doctor. More to the point, no one hires a private personal doctor. And we all know what aspects of medical care we like: the ambulance arrives in seconds and rushes us to the hospital, a team of medical experts spares no expense in running tests to figure out what's wrong and in doing whatever it takes to cure us, and (for many people) the insurance company pays (all or most of) the bill. We all also know what aspects we don't like: ill-equipped and ill-staffed hospitals, HMOs telling us that we can't have that particular test or that a specialist isn't warranted, and getting stuck with an outrageous bill.
The aspects of outsourced healthcare we like involve immediate access to experts. Any medical emergency requires experts, and the faster they can pay attention to us the better off we'll be. The aspects of outsourced healthcare we don't like involve management. Our healthcare is our responsibility, and we don't want someone else making life and death decisions about us.
Network security is no different. Companies should outsource expert assistance: vulnerability scanning, monitoring, consulting, and forensics, for example. But they should not outsource management.
The industry has already proven this point. Salinas Network Services was the largest firewall management company. Earlier this year, it disappeared. There just wasn't a profitable business in managing firewalls for other companies. Firewall management is simply too central—companies outsourcing to Salinas had no choice but to treat their Salinas contractors as employees. And, for the money they were willing to pay, the companies demanded too much individual attention. Another example: Pilot Network Services offered secure network management. Its business was to host computers securely, manage all security devices, and test applications before putting them up on the network, effectively becoming the security management group. They're gone now too—same problem.
Some consulting companies are doing well and some are not. This is primarily a function of the quality of the service they offer. Consulting is, and always will be, a profitable business. Outsourcing occasional requirements for expertise transcends any single area. The outsourced security companies that are doing well offer clearly defined services organizations need. For example:
- Consulting companies (such as VeriSign, @Stake, Foundstone) provide expert advice and assistance: strategic security consulting, penetration testing, forensics, and so forth.
- Security Value-Added Resellers (VARs) provide product installation and configuration.
- TruSecure provides certification and expert assistance.
- Qualsys has an automatic vulnerability scanning service.
- Counterpane provides network security monitoring.
In all of these cases, the company buying the security services retains management and ultimate control. Conversely, by not demanding a management role, the security providers offer useful, effective, and scalable services. Both win.
Why outsource security
The primary argument for outsourcing is financial: a company can get the security expertise it needs much more cheaply by hiring someone else to provide it. Take monitoring, for example. The key to successful security monitoring is vigilance: attacks can happen at any time of the day, any day of the year. While it is possible for companies to build detection and response services for their own networks, it's rarely cost-effective.
Staffing for security expertise 24 hours a day, 365 days a year, requires five full-time employees—more when you include supervisors and backup personnel with specialized skills. Even if an organization could find the budget for all of these people, it would be very difficult to hire them in today's job market.
Retaining them would be even harder. Security monitoring is inherently erratic: six weeks of boredom followed by eight hours of panic, then seven weeks of boredom followed by six hours of panic. Attacks against a single organization don't happen often enough to keep a team of this caliber engaged and interested.
This is why outsourcing is the only cost-effective way to satisfy the requirements. Think about healthcare again. I might only need a doctor twice in the coming year, but when I need one I might need him immediately, and I might need specialists. Out of a hundred possible specialties, I might need two of them—and I have no idea beforehand which ones. I would never consider hiring a team of doctors to wait around until I happen to get sick. I outsource my medical needs to my clinic, my emergency room, my hospital. Similarly, companies will outsource network security monitoring.
Aside from the aggregation of expertise, an outsourced monitoring service has other economies of scale. It can more easily hire and train personnel, simply because it needs more employees. And it can build an infrastructure to support them. Vigilant monitoring means keeping up to date on new vulnerabilities, new hacker tools, new security products, and new software releases. Outsourced security companies can spread these costs across all customers.
An outsource company also has a much broader view of the Internet. It can learn from attacks against one customer, and use that knowledge to protect all its customers. It also faces attacks much more frequently. No matter how wealthy we are, we don't hire a doctor to sit in our living room, waiting for us to get sick. We get better medical care from a doctor who sees patient after patient, learning from each one. To an outsource security company, network attacks are everyday occurrences; its experts know exactly how to respond to any given attack, because in all likelihood they have already seen it many times before.
How to choose an outsourcer
It is difficult to choose an outsourcer because it's hard to tell the difference between good and bad computer security. By the same token, it's hard to tell the difference between good and bad medical care. Because most of us aren't healthcare experts, we can sometimes be led astray by bad doctors who appear to be good. So how do we choose a doctor or a hospital? I choose one by asking around, getting recommendations, and going with the best I can find. Medical care involves trust; I need to be able to trust my doctor.
Security outsourcing is no different; companies should choose an outsourcer they trust. Talking with others and asking industry analysts will reveal the best security service providers. Go with the industry leader. In both security and medical care, you don't want a little-known maverick.
Companies buying security services should also avoid outsourcers that have conflicts of interest. Some outsourcers offer security management and monitoring. This worries me. If the outsourcer finds a security problem with my network, will the company tell me or try to fix it quietly? Companies that both sell and manage security products have the same conflict of interest. Consulting companies that offer periodic vulnerability scans, or network monitoring, have a different conflict of interest: they see the managed services as a way to sell consulting services. (There's a reason companies hire outside auditors: it keeps everyone honest.) Outsourcers offering combined management and monitoring services will be among the next to disappear, I believe. If a company outsources security device management, it is essential that it outsource its monitoring to a different company.
In any outsourcing decision requiring an ongoing relationship, the financial health of the outsourcer is critical. The last thing anyone wants is to embark on a long-term medical treatment plan only to have the hospital go out of business midstream. Similarly, organizations that entrusted their security management to Salinas and Pilot were left stranded when those companies went out of business.
Modern society is built around specialization; more tasks are outsourced today then ever before. We outsource fire and police services, government (that's what a representative democracy is), and food preparation. Businesses commonly outsource tax preparation, payroll, and cleaning services. Companies also outsource security: all buildings hire another company to put guards in their lobbies, and every bank hires another company to drive its money around town.
In general, we outsource things that have one of three characteristics: they're complex, important, or distasteful. Computer security is all three. Its distastefulness comes from the difficulty, the drudgery, and the 3 a.m. alarms. Its complexity comes out of the intricacies of modern networks, the rate at which threats change and attacks improve, and ever-evolving network services. Its importance comes from this fact of today's business world: companies have no choice but to open their networks to the Internet.
Doctors and hospitals are the only way to get adequate medical care. Similarly, outsourcing is the only way to get adequate security for today's networks.
Categories: Business of Security, Computer and Information Security
Tags: IEEE Computer
In today’s global business competitive environment, business organizations must innovative and adapt new strategies to sustain revenue generation, value while remaining competitive. Organizations have embraced outsourcing principles and adopted them to help in expanding to new markets (Odu 19). Outsourcing has enabled US multinational corporations to reduce costs and compete effectively in the global market. While the proliferation of outsourcing has been beneficial to short term growth by taking advantages of; low wages, taxes and investment incentives in developing countries, it will significantly dissolve the competitive advantages the United States enjoys. The outsourcing approach changes the historical model of economies of scale, the resulting intangible and hidden trade costs of outsourcing shall have a heavy bearing on the US economy. The competitive advantage of high technology, support for startups will be gradually eroded, enabling developing countries to compete directly with the United States.
Economist view outsourcing as new form of international trade. Currently more commodities are traded than it was in the past, this can be either good or bad from differing perspectives. Most Americans hold the assumption that jobs, skills, money, and experienced are being shipped to foreign countries, and recipient countries are making financial, socio-economic and development progress while the U.S economy stagnates (Currie 47). This view has been strongly expressed leading up to the last two presidential elections, with candidates pledging to bring back “jobs”.
Consumers have been accustomed and aware to the fact that significant proportions of manufactured goods are produced abroad by corporations taking advantage of low production costs. A new trend catching is outsourcing services with India taking a huge chunk of call centers catering for the American consumer.
The notable divisions which companies outsource are customer support, human resources, accounting and manufacturing. This has not been limited to these divisions, skilled personnel in information technology, engineering, pharmaceutical and Research and Development are facing greater threats to losing workers abroad. No American worker or politician is keen on promoting outsourcing. For example, a software engineer at an Information Technology firm can embrace the thought of losing his/her job to an engineer in India, willing to take half of the pay. There is the prediction that by 2015, more than 3.3 million white-collar jobs and wages amounting to over US$136 billion shall be lost in the economy. In addition the economy will be affected by worker dissatisfaction combined with risks occurring as a result of outsourcing (Hira and Anil 63).
The resolution to outsource is most arrived at the interest of lowering firm’s operational costs, increasing competency, making efficient use global capital, labor, scarce resources, infrastructure and technology. Outsourcing differs from off shoring, it is relative to the firm restructuring and organization of labor within and between societies. Off shoring takes place when a segment of production process is moved off shore; sold or still under the control of a national firm.
Companies outsource tactically to reduce and control operational coasts, am most importantly increase profits. Access to low operation costs, college-educated workforce at a fraction of U.S national’s wages compels firms to take advantage of short-term outsourcing benefits. Partnership with other organization abroad provides U.S companies with access to new technology, tools and techniques that they may not posse, structured methodologies, procedures, documentation, and expanded skills offering competitive advantages. The partnership between Apple Inc. and Foxxcon Group provides a good example, in this arrangement Apple is freed up from manufacturing while taking advantage of Foxxcon capabilities. Outsourcing has been used successfully to achieve cost saving propelling companies to venture into foreign markets, these benefits however, do not offset the projected long-term impacts on United States industries and the economy.
Countries trade to achieve and maximize economies of scale in production. No single country can produce want it requires domestically. Each country specializes in producing goods or services at large scale to lower costs which formulate a comparative advantage in exports. This trade advantage allows it to import goods that have high production costs domestically.
Benefits of Outsourcing
Cost reduction is the key reason why a company might consider outsourcing. Tasks that are costly to be done in-house get outsourced to partners who can offer the services at lower prices. For example, if a firm requires urgently a specialized software engineer it will be much cheaper to outsource the service than training a staff member. The hired expert will accomplish the task faster, efficiently and cost effectively. Access to experts does not only lower long term costs but providers companies with opportunities to explore new possibilities and venture into diverse work specialization enabling them to prosper in this changing times.
Outsourcing presents firms with opportunities to enhance competitive strategies suited for the global market. By outsourcing product quality can be improved, lowering production costs which in turn are passed down to the consumer and increasing overall productivity of the business.
With outsourcing, firms enjoy increased operational flexibility presented in several ways. For one, a firm has access to a large workforce at its disposal relived of maintaining it on permanent basis. This means that a firm is able to benefit from contact personnel minus the stress of worrying about layoffs or idle workforce. This flexibility presents companies with freedom to adjust workforce capacity and production capacity according to changing requirements and market trends. Additionally, with outsourcing firms are equipped to handle unforeseen events like unanticipated delays, work errors or changes in management or production plans. More importantly, by being flexible firms can deliver on projects timely to the satisfaction of the clients (Ching 34).
Proponents of outsourcing point out that by doing so firms can free up capital funds and limited time to focus on core business activities. Ancillary jobs can be performed by contacted firms or individuals. Firms especially in manufacturing are able to access latest production technologies and equipment without purchasing or maintaining them. Good outsourcing relationship presents firms with unmatched opportunities to access a network of business partners. For example, electronic assembling firms in China partner with more than two electronic manufactures, firms sharing one assembler can benefit from the supply chain such as sourcing from a chip maker or glass display maker.
The United States has a comparative advantage in industries that require highly skilled labor and capital investment. The highly skilled workforce with a strong knowledge base gives the U.S edge in the global economy. No other country has a high turnover rate of business startups as compared with the U.S. Corporations by shifting some of these jobs overseas to benefit from reduced costs distribute knowledge and facilitate spillovers. Economies such as India or China, receive spillover benefits from influx of knowledge enabling them to advance their economies. A direct result is that competitiveness of U.S technology is placed at risk as its competitive edge advantage is lost from the U.S control (Mascarenhas 53). Additionally, the U.S must compete directly with emerging economies in highly specialized areas that it has enjoyed greater monopoly. Aerospace manufactures that now outsource subassemblies are at risk in the long term of creating competitors. These partners now building components may one day build whole jets largely due to technology, trainings and contacts provided by U.S firms. U.S aerospace firms do not have guarantees that their intellectual properties shall be protected.
Manufacturing is vital to a nation, it fosters a strong domestic economy, generates employment sustaining family wages and salaries, resulting in decent standard of living for the working class. Manufacturing firms large and small are bastions of state and local economies, supplying jobs and tax revenues to finance essential public services. Manufacturing creates economic activity spillovers in other sectors that supply intermediate goods and services. It also stimulates creation of numerous high-end job services such engineers and programmers in software technology within local economies. Additionally it drives economic productivity, innovation and engine of overall economic growth.
Manufacturing of semiconductors, the basis of modern electronic devices, prominently add value to the U.S economy proving high-value-added production, high-wage jobs, efficiency and productivity gains, and wage growth. Notwithstanding this, the United States is losing capacity and leadership in production of semiconductors. William J. Spencer (Emeritus of International Sematech chair), summarizes the leadership concerns by suggesting that a blend of market forces and foreign policies is creating powerful incentives to reallocate new chip fabrication overseas. If the trend persists, U.S leadership in chip design and manufacturing will erode with unpleasant consequences. Productivity growth will slump down severely impacting the economy spilling over to military security and might. These warnings have been raised by the National Security Agency and independent institutes.
The semiconductor business demonstrates the problems arising from outsourcing key industrial sectors critical for preservation of critical national security requirements. Natural disasters in South East Asia were chip production is being outsourced; possess a fundamental threat to electronics supply chain. For example the 1999 earthquake measuring 7.6 on the Richter scale that struck Taiwan shut down factories in Hsinchu industrial district disrupting the supply of wafers. Additionally, offshore sourcing and production of chip presents a potential threat to classified information embedded in chip designs. It greatly increases the possibility of unfriendly governments or non-state actors embedding Trojan horses, worms or malware in foreign manufactured chips to be used in military or intelligence applications.
As other nations execute strategic industrial policies to build up their technological capacities and strong, modern manufacturing base, U.S. policies continue to encourage U.S. manufacturers to shift their operations offshore. A comprehensive strategy aimed at reversing the decline in the nation’s manufacturing base will be sufficient for safeguarding and revitalizing the industrial base in the coming decades in face of looming competitive global commerce.
Another long term affect that poses much greater in addition to knowledge spillovers is the lack of local talent available to be utilized in the economy. College enrollment for courses leading to high skilled jobs as suffered a setback due to uncertainties associated with outsourcing of these jobs. In addition, the U.S economy is at risk of losing its attractiveness to skilled immigrants.
Outsourcing disrupts education evident with the college students shunning to pursue high-tech fields and opting for business oriented courses. Students are concerned that by pursuing these course coupled with instability in the labor market they face risks of losing out due to outsourcing. Studies show the proportion of graduates planning to major in computer science or engineering is now 70% below its peak in the early 1980s (Santos 87). With companies shipping IT operations to countries such as India and China, these countries are capitalizing by investing heavily in education and training to continue to attract, retain best talents, and maintain competitive edge in the global IT industry.
The increasing deficit in trade posse’s long term effects on the growth of the U.S economy. The U.S economy consumes more than it produces. This deficit cannot be scaled down if economic activities continue to be exported overseas. Goods and services produced and provided by U.S firms are being imported back to the U.S worsening the deficit situation. Outsourcing also diminishes the purchasing power of workers and shrinks their presence in the consumer market.
Most outsourced jobs to developing countries are not replaceable and present difficulties returning them back. It also means that the few remaining positions, individuals willing to take them must accept wage cuts and reduced benefits that they would have received if these jobs were not outsourced (Bureau of Economic Analysis and Bureau of Labor Statistics). Outsourcing creates a population of underemployed and severely affects the middle class purchasing power.
Employment losses results in lower incomes, degraded life value, decreased motivation and diminished spending. Failure by consumers to spend puts a strain on the economy; if money is not ploughed back the economy struggles to grow (Schniederjans, Ashlyn and Dara 6). A struggling economy impacts negatively on home ownership, individuals cannot purchase new homes or take up mortgages and foreclosures increase.
Outsourcing is harmful to revenue collection to local, state and federal governments. Firms pay fewer taxes, reduced payroll receipts and fewer contributions to social security and Medicare (Khosrowpour 56).
If foreign outsourcing on balance raises economic well-being, policies aimed at arresting that activity would have a net economic cost. There are, however, other avenues for policy response that most economists think could be generally beneficial. One avenue is to work to expand overseas markets through further removal of foreign trade barriers against American exports. A second avenue would be to use policy to boost the benefits of trade by correcting deficiencies in the economy’s ability to create new products and processes that could become attractive exports.
A third avenue is to use economic policy to remove any unwarranted bias against the economy’s tradable goods sector caused by an elevation of the incentives toward foreign outsourcing that arise from the economic forces generating the trade deficit (Taylor and Akila 26). A fourth avenue would be to use policy to address the hardships and inequities arising from trade and foreign outsourcing by extending compensation and more effective tools for adjustment to those who are hurt by the disruptive effects of foreign outsourcing and other market forces.
Signs of Changing Trends
The U.S. Congress of recent has taken action to limit outsourcing and off shoring by adjusting the nation’s inter-national commerce policies, however, further measures must be done. The President has backed creation of more employment opportunities rallying for greater investments in infrastructure and moving rapidly towards clean energy driven economy. State like Ohio have implemented policies and passed laws limiting the flow of public funds to foreign firms. In addition, some corporations and entrepreneurs have begun to question the wisdom of outsourcing, deciding to set up new facilities in the United States, expand their operations within the country and establish firms taking advantage of American workforce skills, knowledge and capabilities. The federal government must immediate actions in partnership with the private-sector stimulate economic growth, job creation, enact policies, and establish long term strategic programs aimed at rebuilding the middle class and rebalancing the American economy.
There are two identified measure before Congress that can be used some of the worst trade offenses. The first recognizes the manipulation of the Chinese currency, undervalued approximately 40 percent with respect to the U.S. dollar. Thus, costing the U.S. economy more than 3 million jobs. The Chinese government continues to violate its international obligations with respect to championing and safeguarding workers’ rights, human rights, illegal subsidies, currency manipulation, and respect for intellectual property rights by its citizens. Congress has been urged to enact a comprehensive trade bill enabling the federal government with tools to address these challenges combined with strengthening trade laws and their enforcement.
The current tax regulations permits U.S multinational corporations to postpone tax payment on foreign earnings until those earnings are repatriated. These provisions encourage continued investment in foreign economies with low tax rates at the expense of creating jobs in the U.S economy, and further tilting trade deficit in favor of emerging economies. Comprehensive tax reforms reflecting the changing situations need be recommended and enacted. These regulations must be punitive to businesses or hinder foreign investments and expansion by U.S firms.
Outsourcing has transformed the ways in which nations interact. Corporations have fragmented their operations internationally in order to concentrate exclusively on their core competencies. Short-term benefits, such as cost savings were identified, however several intangible consequences and hidden costs were overlooked that will have an effect on the U.S. economy in the subsequent years ahead. There is still a lot we do not know about outsourcing, largely because the available data does not provide information needed to fully understand its magnitude, the reasons behind it, and the actual effects it has on the economy. However, there is still substantial information that can be examined to analyze the long-term consequences that will alter our economic status. The sudden increase in outsourcing highly skilled professional jobs may be suspending our position in the world as a lead economic power. Companies must realize that their strategic advantages will thrive based on maximizing their knowledge-base, which is achieved through employing highly educated U.S. workers.