As cybersecurity is a core responsibility for all organisations of all sizes, many companies recognise the need to allocate resources for their information security. However not every company has the resources to manage cyber security in house. Having in-house security expertise can be expensive, and not every security expert is an expert in all fields of cybersecurity. So how do you choose the right MSSP?
Hiring an MSSP is a less expensive, more effective option than creating your own security team. By appointing an MSSP (Managed Security Service Provider) you can benefit from the expertise of an entire team, and gain value for money. What’s more, cyber crime isn’t a mon-fri 9-5 activity, to stay alert and to be able to respond quickly to suspicious events, your business needs round-the-clock cyber-protection 365 days of the year.
However, how do you go about hiring an MSSP? As with any supplier selection it’s important to ask the right questions. Here’s our top 10 questions to ask:
- How Focused Are They On Cyber Security?: Many IT companies, network providers or ISPs provide cyber as part of their broader offering. However whilst they can no doubt provide a level of advice and support for your business, are they really as focused on your cyber security as you need them to be? Is cyber security simply a bolt on for them, or are they focused and committed to ensuring your business is safe and cyber compliant in what can be very complex environments and fast moving security landscapes. In our experience to be as secure as possible you need to utilise the best expertise that you can, and that means working with a security partner who focused on just that, your security.
- How Established Are They?: New business pop up all the time, of course we all have to start somewhere, and no doubt many are great at what they do. However there is something to be said for a company that’s been around the block a few times. Aside from gaining essential cyber experience and knowledge, if a company has been in business for a significant amount of time then its been through many of the growing pains of business survival and expansion. From developing and and maintaining strong relationships with market leading vendors, to hiring and retaining the best talent (in an industry suffering a chronic skills shortage), to having critical support business functions such as Finance, IT, Customer Service, working with an established cyber business certainly does being stability and peace of mind.
- How Much Relevant Experience Do They Have?: Whilst there are similar security challenges across all industry sectors and/or businesses of varying sizes, there are differences too. Types of sensitive data, compliance and regulation, and even systems and software, will vary by verticals and size. An MSSP with experience in your sector or with businesses of your size will appreciate the challenges you face and be able to add extra value to the relationship.
- Do They Tailor Solutions?: One size certainly does not fit all. Your business is unique. Its network, environment, organisational structure, processes, people, data, assets, plans, all are unique. An off-the-shelf solution may leave your business exposed. A cyber security business that offers both consultancy and managed services will be able to create and manage a cyber programme designed to keep your organisation cyber safe.
- Do They Use Market Leading Technology?: Researching, purchasing, installing, monitoring and maintaining security products and platforms can be a minefield. With thousands of products and resellers in the market, how do you ensure you are efficiently using the latest tech for emerging threats? A good cyber consultancy and MSSP will do the leg work for you. They will have established relationship with leading tech providers so will be able to utilise their purchasing power to get you the best price. They will also have the experience, skills and resources to recommend, install, configure, monitor and manage a range of products and solutions to ensure you have the most comprehensive security protection that your business needs.
- Do They Have The Necessary Talent?: The cyber security industry is experiencing a chronic skills shortage, as a result experienced and qualified cyber experts are in high demand. Appointing an MSSP with the necessary talent is essential. Qualifications, accreditations, and certifications are all very important in the industry as they demonstrate commitment and dedication, plus convery experience and knowledge. Ask those MSSPs you are considering to share the details of key staff with you, plus an overview of their business wide credentials, any MSSP worth their salt will they will gladly share this with you.
- Do They Outsource Anything?: An established MSSP should have all the necessary skills and resources inhouse to be able to fulfil their contracted obligations. Some younger or smaller MSSPs may actually outsource arrangements to third parties. Make sure you understand how they chose and work with suppliers and what assets are passed between, as it’s essential their supply chain is secure.
- Are Their Support Provisions Transparent?: Who will be your first port of call should you have a question? How responsive are they? Will you have a dedicated team of experts? What’s the process for raising a support request? What are their SLA’s? What’s their operating hours, especially over weekends and bank holidays? Will you have regular meetings? What reporting will they provide? Is there an online portal for use to make use of? And so on! Ask for as much details as possible regarding how they plan to support, liaise and communicate with you.
- How Much Of Your Existing Cyber-Tech Can They Utilise?: Your organisation may have already invested in security hardware and/or software. Whilst its likely that an MSSP’s approach will completely align with your infrastructure, it is always worth asking if they can adapt their approach to integrate with your any of your existing security technologies.
- Do They Provide Actionable Intelligence and Incident Response?: Whilst there will be mountains of data logged and reports generated from the various tools and platforms installed, there is a risk of information overload. A good MSSP will sift through all the information, correlate and analyse it to provide actionable reports for end-users that recommend tweaks to tactics and ways to strengthen strategies. They will also quickly take action should they suspect a breach, so its important to ask them about their mean time to detect (MTTD) and mean time to respond (MTTR) metrics. As its a case of not if but when a breach occurs, ask MSSPs about how they help organisations to be prepared. Cyber awareness training and cyber breach rehearsals can optimise your incident response. Even if you are not a fully Managed Services client, a good MSSP will also be able step in and assist emergency response support.
Here at Infosec Partners we provide a range of consultancy services and customisable managed security service solutions. If an informal chat or discovery meeting would help set you on the right path to strengthening your cyber security then please get in touch. With nearly 20 years experience of focusing on cyber security, we’ve got what it takes to help you become more cyber secure.
