With a growing trend in moving to cloud hosted IT solutions such as Microsoft Office365 and Google Apps, its only a matter of time before other building services follow.
But what exactly is Security as a Service and is it right for your organisation?
What is Security as a Service?
Security as a service or SaaS, is a security system where the server is usually hosted by a third party company as a cloud based application, not physically purchased and installed on a customer site.
Microsoft already offer SaaS based access control as part of its Global Security Operations Centre (GSOC) service to large multi-national organisations, and also Brivo, a US based company also has a SaaS based access control solution available.
How it works
As we have already established, in a SaaS installation, the server is remote to the customer site and is managed by a third party company, in this case a specialist cloud hosting provider.
Controllers are installed locally on site as per a non SaaS based system, but communicate over the internet with the server, these communications are usually either encrypted or secured using a VPN tunnel.
Administration of the system by the end user is usually achieved by logging into a website based portal.
How SaaS compares to a conventional solution
In an on-premise traditional installation, the server is purchased by the customer and is installed locally on the customer site.
Controllers are installed locally on site and communicate over network with the server, they do not require access to an internet connection.
Administration software is usually installed onto individual workstations to enable the customer to manage the system.
Minimal capital expenditure
One of the biggest benefits is minimal capital outlay, in some cases, there is no capital cost.
The cloud hosting provider may choose to loan the customer the hardware, and bundle installation and maintenance costs into the package, similar to a cable or satellite TV provider.
When you consider the average server for an access control system including software costs around £5,000, and with an average access controlled door costing around £750-£1,500 per door to install and supply all equipment, there is a major benefit to cloud based solutions.
The service provider manages patches, updates and security vulnerabilities
The cloud based service provider is likely to have an operations team monitoring the servers and systems 24 hours a day 7 days a week, supported by a team of network, server and IT security specialists.
They will also ensure that all systems are regularly patched, updated and secured to reduce the risk of a system malfunction or security loophole being exploited by an attacker.
Enables access to enterprise grade features with the Enterprise price tag
This is great for small and medium sized companies who may have a need for good quality sand cubit and some entreaties security features, but cannot justify the capital purchase of an enterprise system with the price tag that goes along with it.
With a cloud based solution, the costs are spread between customers by the cloud provider so it can be really cost effective for a small or medium company to obtain an enterprise grade solution.
Someone else manages the server and could potentially compromise the system
While this is very unlikely as cloud service provider is going to be more security focussed than a small or medium sized company with limited IT resources, for some, this may be enough to select an on-premise solution.
This would also not be suitable for sensitive high security sites that cannot accept the risk of security systems being exposed to the internet or a remote third party.
Requires active internet connection
Care should be taken on what level of functionality is possible in the event of an outage.
Usually, most enterprise control equipment such as access control can operate offline for a period of time, it’s not usually possible to update any permissions or block any card while the server is offline, but the doors continue to operate and remain secured.
This is however a particular concern for video surveillance systems if the video is being streamed to an offsite recording system rather than an onsite storage solution – in this situation, a local storagesolution that backs up to a remote cloud server may be more optimal.
Limited choice currently in the market
While it’s only a matter of time before other companies gear up for this, there is currently limited choice for an organisation, especially in Europe looking to purchase a service based security solution.