Managing Your Managed Security Service Provider: Improve Your Security PostureReturn to TOC
No ratings
Presented at FIRST 2014 by
Do you have an MSSP or an SSP? In this session, I will discuss what a Managed Security Service Provider means to you and your organization and how to derive the right balance in the relationship to make sure you are seeing the best view of your network’s threats. Much of the success of a successful partnership rests in what your definition of an MSSP. For example, do you believe that an MSSP should manage your security, tell you what alerts are important to you, and make sure all of your devices are reporting properly? If you believe that your MSSP should manage your company’s security autonomously, you are leaving your organization open to risk. An MSSP should be managed, directed, lead and monitored by you. Critical questions to ask: • Does your MSSP know where critical infrastructure is? • Does your MSSP know what traffic is important to you? • Does your MSSP know what you are vulnerable to? • Who accepts financial responsibility if you get breached? • Who’s reputation is damaged when a breach is reported? For almost 15 years I have worked with MSSPs. I have seen clients that managed the relationship between the MSSP and had a good security posture. These clients were rare and probably one in a thousand. In more cases, I've experienced clients who depend on the MSSP to manage themselves. This is a critical error by the client and we will discuss some of what needs to be done by you, the client in order to properly manage the MSSP thereby decreasing you risk and improving your security posture. Your MSSP can only be as good as the management you provide the “SSP”. As the data holder you alone are held responsible and suffer if your data gets breached. It is up to the client to hire security professionals that understand data security, know how to identify threats, know proper incident response, and know how to manage your MSSP. Your MSSP contractually acts as “Tier 1” only, meaning they receive alerts from your systems and only escalate what they think should be viewed by your internal “Tier 2” analysts. In this session we will get into the details on how you can get a better view of your threats and effectively manage your risks.