InformationWeek

Some of the emerging ESPs are startups. Telenisus Corp., which is run by former Ameritech executives, is one example of a company founded explicitly to deliver extranet services to business customers. Other self-proclaimed ESPs such as Aventail Corp. and Pilot Network Services Inc. have their roots in providing security services but are evolving to offer more pieces of the extranet puzzle (see story, p. 172). Still others are existing Internet and Web-hosting companies, systems integrators, and application service providers looking to deliver a more complete approach to providing E-commerce services.

The ESP market is just beginning. There aren't many market projections yet for extranet services, but analysts say the potential is huge. "Customers are interested in outsourcing extranets because it changes the cost model drastically," says John Pescatore, research director for Internet security at Gartner Group. "ESPs are developing a business model that charges per user per month," he says. "That eliminates a huge up-front expense for companies."

Scudder Kemper Investments Inc. would have liked the option of outsourcing its extranets to a service provider, says David Schwartz, senior VP of E-commerce systems for the New York financial-services company. Scudder Kemper decided two years ago to build its own extranets, giving retail mutual-fund customers and 401(k) plan participants access to their accounts online. At the time, there weren't any ESPs, so Scudder Kemper took the do-it-yourself approach, acting as the integrator of services from several providers.

"If I look to the next generation of these extranets, I'd definitely like to have the option of going to an ESP," Schwartz says. "As an officer of the company, it's my responsibility to spend our money wisely." Schwartz won't say how much Scudder Kemper spent building its own extranets, but he says the ESP approach likely would have been much cheaper.

Money isn't the only reason to consider a managed extranet service. FMC Corp., for example, needed to outsource the development and management of its extranet because it just didn't have the staff to build one on its own.

"We have a skeleton IT staff, so it was a no-brainer that our extranet would be outsourced," says Suzanne Pawlisz, project manager for extranet technologies at FMC, a Chicago conglomerate with businesses operating in many industries. "We quickly found that we could outsource the extranet, but we'd need an army to manage all of the pieces." Then FMC found Aventail and its Aventail.net service, which it's using to build an extranet linking FMC employees with the companies that supply their benefits.

Aventail, a developer of secure extranet software, rolled out Aventail.net late last year. As part of the service, which is priced at $30 per user per month for a minimum of 5,000 users, Aventail helps customers plan their extranets. The service provider also installs and manages all the necessary hardware and software and offers partners that can deliver added security services and systems integration. Aventail promises to have a company's extranet running within 10 weeks, and it provides service-level agreements covering service availability and the time it takes to complete access policy changes, user activation, and user revocation.

"Aventail appealed to us because it covered everything we needed," Pawlisz says. With 260 locations worldwide, FMC operates 100 factories and mines that do everything from manufacture offshore oil-drilling machinery and restaurant equipment to develop chemicals and food additives. FMC prefers to let its businesses manage themselves locally, so the company maintains a relatively small IT staff, IT director Dave Banaszak says. Three IT executives manage a staff of about 400 IT professionals.

When FMC started looking for an ESP, it first turned to GTE Internetworking, which supplies Internet access and firewall services to FMC. GTE Internetworking suggested setting up a virtual private network and using digital certificates to authenticate users on the network. But FMC wanted the service provider to go a step further and host the public key infrastructure, meaning the service provider would be responsible for the configuration and operation of the certificate-authority software.

"GTE Internetworking couldn't include a public key infrastructure service," Pawlisz says. "Without it, we would have to become the certificate authority, and we just didn't want to get into that." FMC discovered Aventail, which partners with VeriSign Inc. for its public key infrastructure service. FMC and Aventail are in the process of setting up the FMC extranet, which initially will let FMC's employees dial in remotely using their own Internet service provider connections to access human-resource and other software applications residing on the company's intranet. Eventually, FMC employees will be able to use the extranet to communicate with companies such as Fidelity Investments, which provides financial benefits to FMC employees. A pilot of the extranet is about to begin.