VALUE AND COST ANALYSIS of Microsoft Endpoint Protection Versus Best of Breed Solutions

Transcription

1 VALUE AND COST ANALYSIS of Microsoft Endpoint Protection Versus Best of Breed Solutions Richard Stiennon Chief Research Analyst IT-Harvest 2013 IT-Harvest 1

2 VALUE AND COST ANALYSIS of Microsoft Endpoint Protection Versus Best of Breed Solutions Value and Cost Analysis This white paper investigates the hidden costs in Microsoft s End Point Protection (formerly Forefront Security Suite). Four primary arguments are presented to demonstrate that the total cost of ownership of Microsoft End Point Protection is higher than using best of breed products from a third party vendors. 1. That there are additional investments in supporting Microsoft services that are not included in ECAL; most importantly, Software Assurance subscription. 2. That deployment, management and maintenance of End Point Protection requires additional investment in Microsoft infrastructure. 3. Microsoft s lack of protection for non-microsoft products means continued investment in security for Unix platforms and does not address the consumerization of IT. 4. Microsoft has begun to de-emphasize ForeFront security. Introduction Microsoft has recently announced (September, 2012) the end of life (EOL) of many of its Forefront security products. It is evident that Microsoft is de-emphasizing its security offerings. The Forefront protection suite has long been a loss-leader as Microsoft bundled it in ecal licensing and offered it for free as long as customers subscribed to Software Assurance. This EOL is an acknowledgement that Forefront, in particular the anti-malware components, are not of significant value to Microsoft, let alone the market. Microsoft s message to current customers with Enterprise Client Access Licenses (ecal) is that System Center 2012 Endpoint Protection (previously known as Forefront Endpoint Protection 2010) is FREE. From Microsoft s documentation: The convergence of client management and security eliminates the expense of purchasing and maintaining separate solutions by allowing you to remove existing endpoint protection solutions and repurpose those resources elsewhere. Is Microsoft s endpoint protection truly free or are there hidden costs? This white paper evaluates that free claim by examining the additional costs associated with deploying Endpoint Protection and abandoning third party anti-malware solutions. Direct costs include the additional licenses for server products, very high costs for support, and the hidden cost of Software Assurance licenses. We also look at the holes in Microsoft s protection strategy represented by the proliferation of devices (consumerization of IT), multiple OS platforms in most data centers, and the lack of cloud leverage for just-in-time protection IT-Harvest 2

3 Microsoft has successfully leveraged its dominance in enterprise desktop operating system and productivity tools to make deeper gains in the data center through its server offerings including: Windows Server, Forefront Threat Management Gateway 2010 Server, MSQL, Exchange, Certificate Server, and SharePoint Server. But, as of September, 2012, Microsoft no longer offers the Forefront TMG, or Forefront for Exchange and Sharepoint. One aspect of computing infrastructures that can be decoupled from network, desktop and server platforms is security. Ironically, the argument has been well made that the very security problems plaguing most organizations rapid spread of malware, targeted attacks, and drive-by downloads from malicious web sites, is attributable to Microsoft s domination of so many computers worldwide. This mono-culture of computing platforms means that malware created to infect home users with Trojans meant to steal their banking credentials also infects enterprise desktops, servers, and infrastructure. In other words, by successfully dominating both consumer and enterprise platforms, Microsoft has created a world wide security problem that entails investment, lost time, management, compliance and reporting requirements to control. Microsoft s Forefront product suite was acquired in an attempt to address these security issues and protect their dominant position in the enterprise. The EOL of much of the Forefront product suite is an indication that Microsoft is de-emphasizing stand-alone security products IT-Harvest 3

4 Enterprise Client Access Licensing Microsoft s Client Access License (CAL) is a blanket end user license agreement that is purchased on a per-server/per-end user basis. It is separate from desktop licensing for Windows, Office or other applications. The Core CAL agreement grants access to Windows Server 2008, Exchange Server 2010, Office SharePoint Server 2010 and Systems Center Configuration (formerly Systems Management Server). Access to additional services is available piecemeal, for either an ala carte pricing or bundled in the Enterprise CAL license (ECAL). These additional services were, until the recent EOL of much of the Forefront product line: Server CAL Core CAL Suite Enterprise CAL Suite Windows Server Exchange Server SharePoint Server Lync Server System Center Forefront Windows Server Standard Active Directory Rights Management Services Exchange server Standard Exchange Server Enterprise SharePoint Server Standard SharePoint Server Enterprise Lync Server Standard Lync Server Enterprise System Center Configuration Manager System Center Client Management Suite Forefront Protection Suite Forefront Endpoint Protection Forefront Unified Access Gateway These Enterprise additions to the Core CAL if purchased separately can cost $256.00/year (System Center Operations Manager Client OML is $32 per license for instance) but if purchased as an ECAL bundle cost $86 on top of the Core CAL pricing. Many Microsoft customers purchase the ECAL bundle to get the additional functionality of one or two services but do not use the full suite. Note that ECAL does not include MSQL or Terminal Services CAL, and that this would be an additional purchase if the customer is not currently licensed for these at a cost ranging from $ $187 per user license IT-Harvest 4

5 This gives rise to the question: Should an enterprise that has the full ECAL licensing drop their use of a third party anti-virus product because the ECAL suite incorporates End Point Protection? Enterprises considering this question should be aware that there are three reasons that using the marginally free security products entails additional costs. Sometimes free is not free. 1) Direct costs in additional Microsoft licensing requirements and support fees. Microsoft Endpoint Protection uses Microsoft System Center 2012 Configuration Manager which could require additional server acquisitions for most large enterprises. The management console is specified to support up to 10,000 clients. A large installment would involve multiple licenses for the management consoles along with the costs associated with maintaining the additional Microsoft servers. System Center 2012 Configuration Manager uses Microsoft SQL Server 2005 (Standard Edition or Enterprise Edition) for detailed report and log generation. SQL Server 2005 Enterprise Edition is needed to support more than 2,000 clients and can be purchased with the Server Subscription License (SSL) for Forefront Security. Microsoft customers interviewed for our research reported that getting premium support for the Forefront security solutions to resolve issues on a timely basis required them to upgrade their support contract for all of the products bundled in ECAL, it could not be broken out separately. This could be extremely expensive as Microsoft s top level of support. Premier Ultimate, can cost between $200K and $1 million annually based on the complexity of the deployment. Other levels of support; Premier Foundation, Premier Standard and Premier Plus, are available in hourly blocks whereas Premier Ultimate is a 24X7 service. Responding to virus outbreaks and security issues is one of the most critical services a vendor can supply and the support from most anti-malware vendors is one of the values that provides the most differentiation. A decision to switch to Forefront client and server security based on Microsoft claims that it is free should not be made until the support service costs have been accounted for as well as the server license costs for a large deployment. An anti-malware solution from a non- Microsoft source will have dedicated support options at lower total costs IT-Harvest 5

6 2) Hidden costs in expanding the Microsoft monoculture. Every business has to evaluate risks associated with vendor lock-in. Not only are there risks that the vendor could discontinue support for a particular offering (note the discontinuation of the Threat Management Gateway for instance) but it also creates a cycle of increased lockin as the vendor continues to offer more and more products inducing the customer to move to those new products, consolidate support contracts and billing, and ultimately lose the flexibility to choose optimal products or negotiate the best prices. In the particular case of buying security products from Microsoft some consideration is due the concept of diversification. Every Microsoft server product is a member of a community of end points that suffer from continuous cycles of attacks. Microsoft issues software fixes on a monthly schedule with emergency updates announced frequently outside that schedule. Not only do the desktops, web servers, file servers, communication servers, and data base servers have to be patched but the systems hosting the security products themselves have to be patched. This lends additional cost to the overall system maintenance task as well as introduces security issues because the security products are exposed to the same types of attacks that they are deployed to protect against. One IT security manager that we interviewed (prior to the integration of End Point Protection into the Configuration Manager) pointed out that Microsoft Forefront Security Suite had too many moving parts that required more resources to manage. Different skill sets and different people were involved in managing Forefront. Staff from security would handle the AV issues, a database specialist managed SQL Server, and another specialist was required for the server admin. Yet another group s services were required to administer WSUS on the Forefront Security Management server. Responsibility for managing a standalone security product resides with the AV team alone and is therefore less expensive. 3) Costs associated with not having a best of breed security solution. Microsoft has yet to demonstrate that its End Point Protection (same technology as Security Essentials for consumers) is a best of breed product. While there may be a cost tradeoff between the best products and good enough products in many areas, such as Certificate Servers, proxies, data base servers, and servers, that argument does not hold with security products where much of the value of those products resides in their ability to provide the best protection possible. For instance an anti-malware product that blocks 1% more malware than another provides more than 1% greater value. The additional costs of cleanup measured in lost productivity and direct IT support resources could be thousands of dollars a month for the typical midsize enterprise. A data breach resulting from a Trojan or Bot infection would lead to extraordinary costs from mandated disclosure and reparation requirements, 2013 IT-Harvest 6

7 damage to brand equity, and similar costs. According to the 5th Annual U.S. Cost of a Data Breach Study from the Ponemon Institute the average cost of a data breach is over $6 million. The current best practices for malware defense is to leverage the cloud to reduce the time to detection from first appearance of a new attack to when updated signatures are fully deployed. By default Microsoft End Point Protection reports malware infections to the cloud for retrieval of latest updates but does not leverage the cloud to detect and analyze new variants of malware. 4) ForeFront security is not a heterogeneous solution While Microsoft has recently added Endpoint Protection clients for OSX and Linux it has simultaneously discontinued support for Forefront Protection for Sharepoint, Exchange, and gateway. This means that enterprises will have to maintain products from a third party. In other words, most of the costs associated with best of breed AV solutions will still be required and only the endpoint client costs are potentially challenged by Microsoft Endpoint Protection. One of the predominant trends in IT computing is the move to mobile devices. Executives and knowledge workers are introducing new devices to the enterprise at an uncontrolled rate. ipads, smart phones from Blackberry, Google, and Apple, predominate and will need additional management and security products to accommodate this consumerization of IT or Bring Your Own Device (BYOD) IT-Harvest 7

8 Software Assurance Licensing In 2005 Microsoft began offering Software Assurance. This extra licensing regime serves to protect customers from the unpredictable release cycle of major new versions of Microsoft products such as Office Productivity and Windows. Because the typical contract is for three years and Microsoft releases often exceed that, many customers opt out of Software Assurance. However, as of August 1, 2011 in order to get signature updates for Endpoint Protection customers must have a paid up Software Assurance license. This could significantly add to the cost of using End Point Protection. According to Forester a desktop Software Assurance License is 29% of the cost of the underlying software and for a server 25%. Product use rights: End Point Protection are those in effect during the term of corresponding Enterprise CAL Suite Software Assurance coverage. In other words, a customer must enroll in Microsoft Software Assurance licensing for all of the licensed products to get the benefits from End Point Protection. Number Of Seats ecal Cost Per Seat Annual Software Assurance , ,350 10, ,375 In the chart above the standard ecal pricing per seat of $175 was discounted 5, 10, and 15% for increasing organization size. Software Assurance, required for signature updates is an annual cost of 29% of the ecal license. Very few organizations of these sizes will be able to afford Microsoft Premium Support and will have to do without. IT-Harvest estimates that a typical mid to large enterprise will face over $431K annual increases in the cost of providing anti-malware defense across the enterprise. This model does not take into account other drawbacks associated with Microsoft Endpoint Protection such as lack of available training, poor reporting, or the increased costs of supporting (updating, patching, cleaning) additional Windows servers. It also does not include costs associated with potentially higher malware infection rates, which are hard to predict and may vary widely from customer to customer. Enterprises would do well to also factor in these and other potential costs when considering a move to Microsoft End Point Protection IT-Harvest 8

9 Changes to Forefront in 2012 Forefront Endpoint Protection 2010 is being folded into System Center 2012 Configuration Manager and will be called System Center 2012 End Point Protection. With this change Microsoft has bundled all of its end point management capabilities into System Center including configuration management, data protection, operations manager, and virtual machine management. Note that End Point Protection does not yet support Windows 8. The following Forefront products are no longer available but existing customers can get up to five years of support: Forefront Protection 2010 for Exchange Server (FPE) Forefront Protection 2010 for SharePoint (FPSP) Forefront Security for Office Communications Server (FSOCS) Forefront Threat Management Gateway 2010 (TMG) Forefront Threat Management Gateway Web Protection Services (TMG WPS) With the discontinuation of the Forefront server security products Server Security Management Consoles are no longer needed. Cost for core CAL has increased by 10% while ECAL pricing has remained the same. However the new components of ECAL as well as Forefront Protection cannot be enacted unless Software Assurance is purchased. Conclusion Microsoft Enterprise Client Access Licensing gives the enterprise desktop protection from the End Point Protection product, but additional Microsoft products, hardware and support must be purchased for management. Most organizations maintain servers and devices that are not from Microsoft. Abandoning a third party AV vendor completely will not be possible. Security should be treated as a separate layer in IT infrastructure. Basing malware defense on 100% Microsoft products decreases an enterprise s overall security posture because the management and control systems are subject to the same attacks that they are protecting against. The way Microsoft has made Software Assurance a requirement for signature updates to Forefront components is an abject example of the entanglement that can occur when enterprises single source a vendor IT-Harvest 9

10 Enterprises considering abandoning third party AV solutions should use the following checklist in their TCO calculations: Additional costs associated with upgrade to ecal licensing Additional costs for MSQL licenses for System Center 2012 Configuration Manager Additional costs for Software Assurance across the ecal suite Costs of additional IT resources for managing the required components Clean up costs of infections from using good-enough versus best-of breed solution including additional IT support costs and secondary loss of productivity. Enterprises should not switch to Microsoft End Point Protection. Even though client and server licenses are included in the Enterprise Client Access License bundle, the additional costs could exceed $500,000 annually and the overall value delivered is less. This white paper was produced with the sponsorship of F-Secure. Its conclusions and opinions expressed are solely those of IT-Harvest and not necessarily those of our sponsors. References: 1. Microsoft Changes Forefront Roadmap 2. Microsoft System Center 2012 Endpoint Protection 3. Microsoft CAL guide: 4. Forrester Examines Strategies for Microsoft Licensing 5. Dell Licensing Center CAL FAQ: en&s=bsd&~page=5 6. Microsoft pricing for Forefront Client Security: aspx 7. Microsoft Service Offering Plans: 8. Forefront Team blog: 9. System problems Microsoft Premier Mission Critical Description: mspx 11. New level of premium support Microsoft Forefront TCO WhitePaper Miscrosoft Forefront Server Security Management Console Pricing Planning and Deploying the Server Infrastructure for Configuration Manager library/bb aspx 15. Schedule and Strategy Update for Forefront Endpoint Protection. schedule-and-strategy-update-for-forefront-endpoint-protection.aspx Network World Magazine Microsoft customers sour on Software Assurance news/2007/ microsoft-customers-sour-on-software.html 18. Microsoft Premier Support page IT-Harvest 10