12.5 Outsourcing

Mail servers and web servers are unique in that they are intended to be public. People from all over the world have to be able to reach an organization's web and mail servers to find out information and communicate. The uniqueness of these servers requires special security consideration, and the security monitoring and maintenance takes up an inordinate amount of time, compared to other servers.

Many organizations may choose to outsource the management of mail and web services to an ISP or Application Service Provider (ASP). Outsourcing mail and web service needs has several advantages, the primary one being that it can increase the security of the corporate network. Web server attacks are the most common type of external network attack. If the web server is removed to a remote location, even if it is successfully compromised, the rest of the network will most likely remain intact. In addition, outsourcing allows security administrators to tighten network security and further restrict the type of access allowed into the network, increasing overall network security.

Managed hosting and mail providers also usually have staff onsite 24x7 monitoring for network anomalies and looking for security breaches. Non-technical organizations may not have the staff, or the resources, to monitor systems around the clock in this manner.

Some companies specialize in secure web and mail server hosting. These companies generally use secured versions of operating systems and provide very restrictive access to servers.

Setting up these services can be outsourced as well. A Managed Service Provider (MSP) will help an organization create secure web and mail solutions, either at the customer site or in a remote data center. These MSPs build the web infrastructure and handle the day-to-day maintenance of the servers. Some will also handle any security monitoring needs for an organization.

An organization that does not have a lot of experience with mail and web server maintenance should consider the possibility of outsourcing. The monthly costs involved are minimal compared to the costs of hiring competent staff, and certainly are nothing compared to the potential damage that can be caused if a web server is compromised.