our customizable newsletter, sends you security alerts, product updates and software patches on the products you use. Sign up now at www.networkcomputing.com /express/

That's the strategy for MediaFlights, a fictitious print and video publisher that wants to expand its online presence and increase electronic communication with suppliers and clients. MediaFlights is Network Computing's latest RFP creation: a company with several hundred employees and consultants at four locations. Remote staff and freelancers connect via local ISPs or through MediaFlights' remote-access servers. Network access at MediaFlights' sites is secured by packet filters on WAN routers and each site is connected to the Internet through a local ISP. There is no common WAN at this time. Recognizing its vulnerability, MediaFlights determined that it must secure its network without distracting its network administrators from the company's core business needs--reliable electronic publishing.

Firewall equipment vendors want you to believe their products' intuitive interfaces and intelligent engines enable anyone to install and manage a firewall; MediaFlights justifiably believes otherwise. Network administrators must be familiar with TCP/IP, Internet services, firewall methodologies, VPNs (virtual private networks) and encryption to roll out and manage a firewall. And that experience takes time to develop.

And then there's the training expense. We estimated the costs for one of MediaFlights' network administrators to spend 30 percent of his or her time managing four firewalls during the first year of installation. Total cost: $126,000 in time, training and materials. Add existing WAN costs of $84,120, and the grand total balloons to $210,120 for the first year (see p. 70).

For an Adobe Acrobat format version of the MediaFlights' Do-It-Yourself Costs, click here.

Compare that with the alternative: a managed firewall that's developed, maintained and supported by outside providers. Managed firewalls off-load the complexities of firewall operation while providing essential security 24x7, 365 days a year. ISPs and other providers have the resources to hire and train experts who actively maintain and monitor your security perimeter.

We sent the RFP to nine vendors we identified as actively trying to tap this market. Four companies responded: DIGEX, PSINet, Technologic and WorldCom Advanced Networks. Of these, DIGEX, Technologic and WorldCom fit their ICSA-certified firewalls into MediaFlights' network. PSINet proposed replacing the existing WAN with a solution that encompasses WAN connectivity via PSINet's backbone.

As for the vendors that turned down MediaFlights' request: MCI was selling its security services to Cable & Wireless; Pilot Networks said the RFP was an inappropriate fit; "logistical problems" prevented U S West from submitting a timely response, and UUNET and CompuServe have been acquired by WorldCom.

Key Features In choosing managed firewall services, cost isn't the only consideration. After all, MediaFlights' total cost doesn't account for 24x7 monitoring, the expertise and experience gained by using a firewall service provider, and the initial and ongoing security monitoring and assessment.

It's these extra features that shaped MediaFlights' decision to outsource: value-added support such as initial consulting and security auditing; ongoing, proactive security management; daily, weekly and monthly reporting and remote-access support--all backed by a sound SLA (service-level agreement).

The four vendors' value-added security services varied widely, but we were primarily looking for the depth of both initial and ongoing security assessment, as well as security policy building.

MediaFlights expects expert advice from its selected vendor. The security assessment doesn't stop at the initial consultation; rather, MediaFlights' network must be probed and monitored regularly. Three of the four vendors have a plan for such assessments; only Technologic fell short.

Once the needs are assessed, the firewall is built and the vendor is monitoring the arrangement, communication between MediaFlights and the vendor becomes key. Events such as security policy modification, notification of active network attacks and user changes often need to happen quickly. DIGEX's proposal shone in this area. The company's detailed communication process and rapid event escalation shows that DIGEX is experienced in and committed to service management.

While the vendor needs to monitor the firewall actively, that provider must also supply good reports, so that MediaFlights can monitor the firewall's performance as well as the service. All four vendors offer useful reports for billing and chargeback, capacity planning, network analysis and utilization.

Picking the winning bidder was difficult, because all the vendors offered more services than the original RFP called for. Nevertheless, DIGEX covered all the bases with excellent planning support, problem-resolution procedures, active intrusion monitoring and a well-defined SLA policy, so it got the job.

Still, outsourcing may not make sense for everyone. The key factors to consider in addition to cost are in-house skill and staffing levels, special security requirements, and relative sensitivity to the information being protected. Following, in alphabetical order, are the edited summaries of the companies' solutions, plus our evaluations of each.

Send your comments on this article to Mike Fratto at mfratto@nwc.com.