WEB-BORNE MALWARE has skyrocketed in recent years. To fight this threat, organizations have been shifting their protection from end-users’ machines to the company gateway. The idea is that placing solutions on the perimeter protects company operating systems and servers in addition to end-users’ machines. Now, a small but growing group is taking the fight a step further, handing over Web scanning and filtering to third parties, using Security as a Service (SaaS).

SaaS, or “in the cloud,” vendors are promising better security and reduced hardware, labor, and power expenditures.

“If [malware] doesn’t touch us, it can’t hurt us,” says Lance Knittig, chief security engineer at NetApp, a 125-employee Chicago-based technology marketing firm. The firm recently installed a Web-filtering product from Zscaler, of Santa Clara, California.

With an in-house device, malware could still infect the gateway, he says. Moving protection to the cloud adds a layer of insulation. Moreover, handing the work over to a third party removes another burden from his IT department.

Zscaler acts like a Web proxy, intercepting all Web traffic at a number of global servers. The Web-filtering product provides protection from viruses, spyware, peer-to-peer networks, and known phishing sites.

Customers can choose sites they want blocked. Knittig’s firm grew concerned about employees’ personal surfing in recent years, both in terms of productivity and malware risks. IT began blocking sites with the old gateway solution, but that was cumbersome because of the administration of exceptions. Sites blocked might need to be accessed by one department or employee for some special need. Knittig would receive e-mail requests. Then, using command line entries, he would change access for one employee at a time.

Controls on the new product are far more granular. He can now determine access by group, department, or individual. Time limits can be added to Web site access as well, allowing administrators to give a certain employee, say, 30 minutes maximum on MySpace.

About once or twice a year, he says, managers will request reports on individual employees’ surfing habits. Knittig says Zscaler provides a highly readable summarized report, whereas the old system contained too much information.

Another vendor now offering cloud-based Web filtering is Boulder, Colorado-based Webroot.

SaaS for e-mailing makes up about a quarter of the e-mail filtering market, according to IDC, the Framingham, Massachusetts-based consulting firm. Only about 5 percent of Web filtering is in the cloud. But this could change. Many solutions begin as a “cottage industry,” says Jay Chaudhry, Zscaler founder. “But almost all of it shifts to a service over time.”