Sure it Saves Money, but is SaaS Security Better?

Stop me if you’ve heard this before: The Cloud can save you money! If you’re anything like me, you’re pretty much exhausted hearing about how much money and time that cloud-based services can save you. We get it already.

While cost savings are important, what you, me and every other IT person on the planet really wants to know is whether Cloud-based solutions are any better? Is Email or Web SaaS security better than using an appliance and doing it myself? No amount of costs savings would justify moving to a “less secure” solution.

Of course, the term “better” is a relative term. It’s also quite subjective, particularly when it comes to comparing apples and oranges. The simple – albeit un-gratifying – answer I’ve come up with so far when asked whether SaaS security is better is, “In some cases, yes. In other cases, no.”

The fact of the matter is that SaaS security solutions – or any Cloud-based solution for that matter – has its proper place and usage. This is particularly true when it comes to security for organizations. No two businesses are alike, and no two security infrastructures are alike. So trying to make a blanket statement that SaaS or on-premises solutions are best, well, is silly.

That said, there is data supporting that some SaaS-based solutions can be more effective than traditional hardware or software solutions. For example, in 2010 Aberdeen published a series of reports comparing email and web SaaS security solutions against on-premises solutions. In the case of email, they found that the users of the SaaS email security solution reported 47 percent fewer cases of spam and malware. For web, users of SaaS reported more than 50 percent fewer cases of malware outbreaks.

Why the difference? According to Aberdeen, the answer isn’t entirely clear. Aberdeen surmises that the 24x7 managed nature of SaaS security solutions ultimately makes the difference in effectiveness, not to mention that the SaaS solutions are managed and optimized daily by the engineers who designed them.

Still, this information alone doesn’t necessarily mean SaaS email security is “better”. An IT organization with the resources and expertise to manage their on-premises solution full time are just as capable of doing a great job managing an on-premises solution.

The question is, would their time and expertise be better spent elsewhere?