Cost-Cutting Through Green IT Security: Real or Myth?

Some say the concept of green IT security is a stretch, but others see a real opportunity to cut costs as well as carbon emissions. (Part two in a series: How to Manage Security in a Recession)

About this series:

Smaller staff. Deflated security budgets. In-store thievery. When economic times are tough, these are the things security pros must contend with. In this ongoing series, CSOonline looks at ways to ensure the best security possible during a recession.

John Petrie likes the idea of low-cost security as much as the next guy. But while some see green technology as a way to achieve that goal while also helping the environment, Petrie has his doubts.

"You can gain some cost savings with an over-arching green strategy and then take advantage of investments that can achieve green security. But by itself, green security would fail," says Petrie, CISO of San Antonio-based Harland Clarke, a financial services firm with more than 5,000 employees and multiple locations. The problem, he says, is that companies with centralized security programs already make the efficient use of existing people, processes and technology.

Richard Stiennon, CEO of managed security services firm Seccom Global, says one can argue that unified threat management (UTM) appliances are green because they reduce the need for multiple power-consuming boxes, but that doesn't mean the technology is the best security fit for everyone. "While power and heat saving may be something enterprises start to push vendors on, the primary requirement for security devices - blocking threats - will always take precedence," he says.

Nevertheless, a growing number of security pros are looking into the cost-saving benefits of green security in this time of economic uncertainty. Helping the environment is just a bonus, and those who have explored the idea of green security have found they can maintain their defenses just as well with a smaller carbon footprint.

"Going green is no longer optional from a business vantage point," says Joseph Guarino, CEO and senior consultant for Boston-based Evolutionary IT, which specializes in security tools and management. "If you embrace that idea in your future plans, you will reduce your costs while saving the planet."

Cut air travel, cut emissions

Security professionals say green security is about more than shrinking the number of boxes that suck up power and expand a company's carbon footprint.

For Richard Bejtlich, director of incident response at General Electric, the biggest green security challenge is in how the company moves people around. Incident response investigations often require people to fly to offices spread across the country. But travel can be expensive and the environment certainly doesn't benefit from the jet fuel that's burned in the process.

Bejtlich's solution is to find more remote ways for employees to conduct incident response.

"Rather than have the carbon footprint of a plane trip, we can instead focus on moving the data we need (for incident response) instead of moving the people," he says. Bejtlich says a lot of the work can get done using virtual technology without reducing the quality of the security.

To achieve this at GE, Bejtlich has made use of F-Response, a vendor neutral, patent-pending software utility that allows an investigator to conduct live forensics, data recovery, and e-discovery over an IP network using the tools of their choice. "For $5,000 we can use the F-Response enterprise product throughout the company," he says. "It's a very good deal."

Bejtlich is also a believer in letting employees work from home. Like the reduction in air travel, working from home means fewer people burning gas on the way to the office.

"We encourage people to work from home so they don't waste energy on travel. The incident response team is all over the world anyway, so we really don't need to be in an office," he says. "Doing the job virtually makes budgetary sense, we spend more time getting the work done, and the bonus is it lowers our carbon footprint."

Virtual wonders virtualization as a key to consolidating the IT environment and achieving green security.

Bejtlich's success with virtual technology is music to the ears of Evolutionary IT's Guarino, who sees

Another true believer is Ray Stanton, global head of business continuity for BT, a major UK-based telecommunications provider operating in 170 countries. He pitched the green security concept several times during a recent interview to announce BT's deployment of Crossbeam Systems' X-Series security platform.

Stanton says BT saved money and overhead that would otherwise be spent to maintain and manage 40-plus security devices. BT can now deliver a virtual firewall across its far-flung operation by deploying just three Crossbeam platforms, he says.

"People can either talk green or live it," Stanton says. "We are trying desperately to live it and Crossbeam lets us do it. If you can maintain security while improving your cost base and green position, that can't be wrong, can it?"

Security with fewer bells and whistles

For those looking to consolidate the machinery without increasing risk, a thorough vetting of technology is a must, says Sandra Kay Miller, an independent security analyst based in Harrisburg, Penn. From her own research, she has come across a variety of products that will reduce power consumption without shortchanging security.

As one example, she says she is looking at the latest Endpoint Security and Control product from Sophos and has found that it could probably be used in place of several best-of-breed appliances and their combined functionality.

"So many security products today are covering multiple bases and doing it well," she says. "The challenge is to decide which products best meet the needs of the organization effectively enough to warrant the consolidation of products."

Beware of the hype

Of course, as the green IT movement grows, so does the crush of publicity from vendors trying to cash in on it. Illinois-based security consultant and writer John Bambenek sees a lot of hype building around the green IT movement, and it makes him skeptical.

"'Going green' is the fad du jour right now, so [vendors] are trying to jump on that bandwagon," he says.

Copyright © 2008 IDG Communications, Inc.

The 7 best password managers for business