Weekly Review: Security Begins With You

One of the first objections I heard raised against ASPs was security. Now I hear the same objection being raised against Web services. In both cases, my reaction is the same. Don't blame technology for your security risks; you only have yourself to blame.

Corroboration for my uncompromising point of view came in last week's report of security risks in e-business applications. (See @stake: 'Significant' Security Flaws in e-Biz Software.) At first glance, that headline just confirms all those old prejudices, doesn't it? E-business, avoid it; too many security risks.

Read and React

"It's time companies realized that, if they want to take advantage of all the commercial benefits the Internet represents, then they have to accept responsibility for security. The technology is there to ensure security to the nth degree. It's time to start using it. And ASPs should be setting an example, not cutting corners." Give us your feedback on matters of security in ASPnews Discussion Forum

But read the story and you'll find that these were applications companies had built themselves. And guess what? "Companies that fared best in the @stake examination tended to focus early in the design process on [security issues]".

Companies that fared less well were committing errors such as failing to encrypt passwords, not validating password and data formats, and leaving authorized sessions open.

My personal bugbear is companies that send me plain text emails confirming my ID and password. Sites that do that should carry a health warning — certain ASPs are guilty of this too. There's no excuse, especially not now that Verisign has launched a service to encrypt emails without having to charge the recipient (See All Aboard! VeriSign SecureExpress.)

It's time companies realized that, if they want to take advantage of all the commercial benefits the Internet represents, then they have to accept responsibility for security. The technology is there to ensure security to the nth degree. It's time to start using it. And ASPs should be setting an example, not cutting corners.

Why SFA and ASP go together
One of the most successful application categories for ASPs, particularly ASPs who deliver their own Web-native software, has been salesforce automation (SFA) and related customer services functions. Two of the world's leading ASPs are salesforce.com and UpShot, both of whom lead with SFA services. The latest new entrant to the ASPnews Top 20 list of ASPs is Salesnet, another SFA provider.

The reason why SFA has proven to be such a success for ASPs is that there are several characteristics that make it a particularly good fit. Identifying those characteristics provides a useful guide as to what other applications may or may not work well when delivered as an online service.

• Roaming — Salespeople are road warriors. The more time they can spend out of the office, meeting customers and prospects, the more revenues they can book for the business. Remote access enables them to keep in touch with the office without having to physically go back to their desk, so it makes them more productive. But setting up and maintaining the required wide area network capabilities often proves to be a serious burden on many companies' internal IT teams. Using an external provider circumvents this hurdle, and thus the need for reliable remote access is often a prime deciding factor in favor of using an external provider.
• Teamwork — Even though the salespeople are out on the road all the time, their manager needs to have a finger on the pulse of every deal. And each individual salesperson needs to know what's going on back at the office. Online applications provide a much-needed framework for communication and collaboration (what used to be called groupware), enabling team members to exchange messages, ideas and information, while managers can collate and analyse up-to-date performance data at either an aggregate or an individual level. Using a Web-centric platform brings the dual benefit of centralized information storage at the same time as distributed collaboration capabilities.
• Immediacy — There are two constituencies that no business can afford to keep waiting; its customers and its salespeople. Both are apt to lose patience and go elsewhere if they feel they are not getting results quickly enough. In stark contrast to conventional packages, online solutions can be deployed within days or weeks, and are easily adapted to changing business needs, a combination that appeals to sales managers with pressing targets to meet. Once deployed, they are tuned for real-time service delivery, giving users the information they need to resolve problems and take decisive action.
• Self-service — Putting information and functionality on the Web empowers customers to get answers and initiate actions for themselves. Nobody needs a training course to be able to use a browser-based application — Web-based self-service is instant. But making the shift to self-service sales and customer service depends on a rock-solid infrastructure that operates 24x7. Enterprises turn to online providers so that they can get the benefit of self-service without embarking on a lengthy and uncertain investment cycle before they can start reaping the benefits.

Tools:

Add aspnews.com to your favorites Add aspnews.com to your browser search box IE 7 | Firefox 2.0 | Firefox 1.5.x

Back to Analyst Columns