McAfee getting more aggressive on cloud-based security

McAfee Monday says it intends to expand its security-as-a-service offerings in recognition that customers are opting more and more to adopt cloud-based deployments.

"We already have a good foundation for this," says Marc Olesen, McAfee's senior vice president and general manager of the new software-as-a-service business unit. McAfee Total Protection Service, which has about 5 million users, is primarily cloud-based for endpoint and mail security scanning. In addition, McAfee's Web Protection Service, wholly in the cloud, provides URL filtering and reputation analysis, while the company's Vulnerability Assessment service can scan Internet-facing systems to discover software vulnerabilities.

But McAfee anticipates a much wider push into security-as-a-service in the course of the coming year.

For instance, the company envisions "adding an inside scan, which is not something we deliver today as security as a service," Olesen says. "Today, it's still outside the firewall."

McAfee's Foundstone Enterprise product can be used to scan the corporate intranet, but the company is looking at how to make use of the underlying technology to provide an internal scanning service.

Another area of focus is further developing a cloud-based management console, according to Olesen. "Customers are telling us they want the management in the cloud," he says. "They can get started quickly with it."

One customer, Philadelphia-based Gemino Healthcare Finance, has found it much easier to use McAfee's Web-based management in the cloud for the past two years than having to install and maintain an antimalware management console in-house on a server.

"It's a huge reduction in maintenance," says Peter Herschel, director of IT at the 18-person outfit. He says he's more or less on his own managing all the servers and desktops for the company, which provides financing to hospitals and others healthcare organizations. "I need basic security kept simple."

McAfee is examining methods for log archiving in the cloud, and in particular will be looking at three vertical industries -- telco providers, financial and healthcare -- where new security-as-a-service offerings can be delivered.

McAfee will look at services that telco providers can not only use themselves but offer as services to their customer base. The vendor also intends to expand its e-mail filtering offering to include continuity services.

Not all types of security protection readily lend themselves at this point to a cloud-based deployment, Olesen acknowledges. Data-loss prevention and unified-threat management products, for instance, do not appear to be candidates, but the management of them could.

"It's a gradual shift to the cloud," Olesen says, adding McAfee will be making investments there, mindful that key competitors such as Symantec are also zeroing in on cloud-based services. While not announcing a specific timeframe to achieve the efforts described, McAfee expects that many of its goals will be accomplished within the course of the year.