What's the difference between web-enabled and web-hosted products?

We all know that getting to the truth sometimes requires a little digging through marketing hype, hyperbole, and perhaps a bit of deception. I’m sure we’re all stunned to find that some are disputing the marketing claim that Cocoa Krispies cereal will help to boost a child’s immunity to illness.

In the Internet domain there is no shortage of products which claim to have some form of “webification.” With the explosive growth of internet technologies, companies are scrambling to ensure that their solutions are perceived as being compatible with the Web. Coupling that with all of the media attention on “cloud computing” and Software as a Service (SaaS) there is growing confusion on the differences between Web-enabled and Web-hosted systems.

Here are the main characteristics of Web-enabled and Web-hosted systems;

Web-hosted Products:
Web-hosted products are centrally operated at a data center and shared amongst thousands of different companies. This is called a multi-tenant SaaS application, and it’s the reason that they are very robust and cost-effective. The entire application is accessible from a browser and can generally be used on any computer or mobile device. Web-hosted solutions are also self-provisioned, scalable on demand, and typically purchased on a “pay as you go” basis. It should not be necessary for you to purchase any application software to operate a Web-hosted product.

Web-enabled Systems:
Web-enabled systems are often mistaken for Web-hosted systems because they both use a browser for their user interface. That’s generally where the similarities end.

Web-enabled systems fall into two basic categories, 1) native Web and 
2) after-market Web. Native Web systems are designed from the ground up to operate over the Internet using an on-board Ethernet connection and providing Administrative access to the application via a standard Web browser. Aftermarket Web-enabled products are typically client/server applications accompanied by hardware that does not communicate natively over Ethernet. It’s fairly easy to spot these products since they will have to be paired with external Web servers to “webify” the application and terminal servers to add Ethernet connectivity to the devices. If a product cannot stand on its own without the auxiliary devices, then it is an aftermarket Web-enabled solution.

Aftermarket Web products tend to suffer from some large deficiencies as compared to native web products. The first obvious problem is that other devices are required to make the solution work over the web. This increases their complexity and cost while decreasing the chances that the overall solution will migrate well as web technologies evolve. Another obvious problem is that information security gaps can appear between the original product and its bolt-on components. Both of these issues should raise serious concerns if you are evaluating an after-market web solution.

What’s a Buyer To DO?:
It is sometimes difficult to sort through the “webified” marketing descriptions associated with products. However, a little close examination and some pointed questions will help you get to the information you need to make the best decision.

-John Szczygiel

The Federal Security Trifecta

I chose the term ‘Trifecta’ for today’s column because in horse racing, it designates three winners.  And I think that’s what we have here.

First, there’s the federal government, with ICAM, which stands for Identity, Credential and Access Management.  In a sense, it’s the other bookend to HSPD-12, which said “You must have a high quality credential.” And now ICAM comes along and says, “Here’s how you should use it.”

Second, there’s the cloud.  Or Software as a Service.  As we’ve discussed here before, it’s a new paradigm for procurement and delivery of software that says it’s smarter and more efficient for everyone concerned—both suppliers and users—to rent rather than own, consolidate rather than distribute, and by all means don’t pay for anything until you absolutely have to—which is to say, as a subscription. 

Last but not least, physical security is a big winner in all of this because it’s moving from having no seat at the IT table, to having an essential role due its newfound connection to identity and privacy.  Physical security providers have been quick to adopt cloud technologies and leverage them for a variety of new offerings informally known as Security-as-a-Service.

If you’d like to hear more, watch the Webcast on our Federal Government page.  Just click on the “Federal Security Trifecta” link in the second paragraph.

Privacy Best Practices—How important is TRUSTe Certification for Security as a Service Platforms?

Recently, Brivo joined other leaders in the online community such as Intuit and Salesforce.com in completing the process to become certified in the TRUSTe® Privacy Program. A TRUSTe® certification means that Brivo abides by the Safe Harbor Framework as outlined by the U.S. Department of Commerce and the European Union.

TRUSTe’s program requirements are based upon the Federal Trade Commission’s (FTC) Fair Information Principles, which include:

• Notification of how personal data is collected and used
• Choice/consent regarding uses of such data
• Access by individuals to their personal information so that it can be reviewed and corrected
• Security to protect against unauthorized access, destruction, use, or disclosure of the data
• Redress/enforcement to ensure compliance

Complying with the TRUSTe framework provides Brivo the benefit of a peer review from experts in online security and privacy. It also allows us to measure ourselves against the best practices of industry leaders. We are focused on building the maximum level of confidence in how we protect the privacy of our customers, and we believe that being a TRUSTe seal holder is further evidence of that commitment.

Do you know if your SaaS providers are similarly committed to such high standards of data and privacy protection? Or, if you’re a SaaS provider, what level of importance do such industry standards hold for your organization?

- John Szczygiel