PDF version of this report
You must have Adobe Acrobat reader to view, save, or print PDF files. The
reader is available for free
download.

Managed Security Services Providers

by James G. Barr

Copyright 2022, Faulkner Information Services. All
Rights Reserved.

Docid: 00018026

Publication Date: 2205

Publication Type: TUTORIAL

Preview

With cyber and other information security professionals in short supply –
and demanding top dollar – many enterprises have turned to outsourcing to
satisfy their local and global digital security needs, enlisting the
assistance of a third-party firm to manage and maintain their security
infrastructure. The firms that furnish such services are known as managed
security services providers (or MSSPs). While each MSSP offers its own
unique portfolio of managed security services, the standard service set
usually includes, at minimum, managed anti-virus, firewall. intrusion
prevention, virtual private network, and vulnerability scanning.

Report Contents:

• Executive Summary
• Related Reports
• MSSP Market
• MSSP Advantages and
  Disadvantages
• MSSP Selection
• Web Links

Executive Summary

[return to top of this
report]

With cyber and other information security professionals in short supply –
and demanding top dollar – many enterprises have turned to outsourcing to
satisfy their local and global digital security needs, enlisting the
assistance of a third-party firm to manage and maintain their security
infrastructure. The firms that furnish such services are known as
managed security services providers (or MSSPs).

While each MSSP offers its own unique portfolio of managed security
services, the standard service set usually includes, at minimum, managed:

• Anti-virus,
• Firewall.
• Intrusion prevention,
• Virtual private network, and
• Vulnerability scanning¹

Value-added services might include:

• Penetration testing – staging simulated cyber attacks to reveal and
  repair weaknesses in network defenses; and
• Compliance monitoring – ensuring adherence to security and privacy
  regulations, such as GDPR, CCPA, HIPAA, and PCI DSS.²

MSSPs normally operate from one or more highly-secure, highly-available
security operations centers (SOCs), from which they can render their
services 24X7.³

Figure 1. NASA Security Operations Center

Source: NASA

By engaging a managed security services provider, a client company is
free to pursue its core competencies (which usually omits present-day
cybersecurity). Importantly, for small-to-medium-sized enterprises
(SMEs), the cost of MSSP services are known or, at least, predictable – a
must in turbulent economic times.

MSSP Market

[return to top of this
report]

According to MarketsandMarkets. the global managed security services
market is projected to grow from $22.8 billion in 2021 to $43.7 billion by
2026, representing a fairly robust compound annual growth rate (CAGR) of 13.9
percent during the forecast period.

The increased enterprise commitment to managed security services is
attributed to several factors:

• The emergence of increasingly-stringent government regulations;
• Greater acquiescence among enterprise officials to the bring your own
  device (BYOD), and choose your own device (CYOD) movements;
• Expanded remote work opportunities, boosted by the COVID-19 pandemic;
• The increasing number and severity of security breaches;
• Ransomware and other devastating malware strains;
• The potential for inter-enterprise (i.e., supply chain) cyber attacks;
  and
• The cost-effectiveness of security outsourcing.⁴

Prominent players in the MSS market space include:

• IBM (US)
• AT&T (US)
• NTT (Japan)
• SecureWorks (US)
• BT Group (UK)
• Atos (France)
• Verizon Communications (US)
• Wipro (India)
• Accenture (Ireland)
• The Herjavec Group (Canada)⁵

MSSP Advantages and Disadvantages

[return to top of this
report]

As with most business relationships, partnering with a managed security
services provider has both advantages and disadvantages, a careful
consideration of which can help influence provider selection and
oversight. Table 1 offers a side-by-side view of MSSP pros and cons.

MSSP Selection

[return to top of this
report]

Considering the stakes – the integrity and confidentiality of enterprise
information, and the smooth and reliable operation of enterprise information
systems which support critical enterprise business functions – the selection
of a managed security services provider is a matter of strategic importance
to the enterprise, and a key predictor of enterprise success.

The search should be conducted through the enterprise request for
proposal (RFP) process, in which enterprise stakeholders, including IT,
Security, and Finance, are afforded the opportunity to probe the
credentials and qualifications of prospective MSSPs. Below are key
questions for provider candidates.⁶

Relevant Experience

• How many outsourcing contracts do you have currently in force? What percentage of your clients renew their contracts upon expiration?
• How many of your clients participate in similar businesses? With similar infrastructure? With similar security needs? Can you provide references?

Asset Separation

• Are the physical assets associated with each client dedicated or
  shared? If shared, how is cross-contamination avoided?

Tier Two Providers

• Are any subcontractors involved in service delivery? If so,
  what are their roles and responsibilities? And how are these “tier
  two” partners vetted?

Independent Evaluations

• Do you enlist third-party providers to perform independent security
  audits? With what frequency? What did the last several
  assessments reveal?

Background Checks

• How extensive are employee background checks? Are criminal,
  financial, and substance abuse screens standard? Are business
  partner personnel subject to the same level of pre-employment
  investigation?
• As part of this RFP process, are key service personnel available for
  one-on-one interviews?

Personnel Training

• What type of training do service personnel receive? How often
  do they take refresher courses?
• Are service personnel credentialed? For example, what
  percentage are Certified Information Systems Security Professionals
  (CISSPs)?
• Are service personnel trained to conduct forensic
  examinations? What standards are applied in the collection
  and preservation of criminal evidence? Are service personnel
  experienced in offering expert testimony?

Intellectual Property

• Is all intellectual property created by the outsourcer on behalf of
  the client owned by the client?
• What measures are employed to ensure that sensitive, confidential, or
  proprietary client information, such as personally identifiable
  information (PII), is safe from loss, theft, unauthorized alteration, or
  misappropriation?
• Is all enterprise information encrypted – whether at rest or in
  transit? If not, why not?

Service Level Agreement

• Does the standard service level agreement (SLA) provide for
  client-specific requirements? Under what circumstances can a SLA
  be amended or renegotiated?
• What is the process for addressing alleged service violations? How are severe or protracted incidents escalated?

Crisis Management

• If an incident becomes public, what crisis management resources are
  available to address it?
• Are crisis communications coordinated with the effected clients?

Site Visits

• Are unannounced site visits permitted (as a means of validating
  provider performance and the accuracy of provider information)?

Service Reporting

• What types of information are available in standard network
  reports? How often are these reports issued? Can custom
  reports be commissioned?
• Can trend analysis reports be generated?
• Is real-time access to network and system security status provided
  via a Web interface?

Intrusion Detection/Prevention

• What is the precise process for managing a detected intrusion?

Governance

• Are managed security services
  managed
  according to a
  recognized IT and security governance standard such as the Control
  Objectives for Information and related Technology (COBIT)?

Regulatory Compliance

• Are managed security services compliant with all relevant national
  and international security and privacy statutes, such as the US Health
  Insurance Portability and Accountability Act (HIPAA), the EU
  General Data Protection Regulation (GDPR), and the California Consumer
  Privacy Act (CCPA)? 
• How is adherence to these standards assured and reported?

Business Continuity

• In the event of a disaster affecting the delivery of client services,
  what disaster recovery and/or business continuity provisions are in
  place to preserve client interests and assets?
• What is the worst case scenario for the restoration of critical
  managed security services?
• How are clients notified about disasters (or potential disasters),
  and how are they “kept in the loop” relative to recovery options and
  recovery progress?
• What is the disaster recovery/business continuity posture of key tier
  two providers?

Contract Termination

• If the outsourcing agreement expires or is terminated, what is the
  process for transitioning network security support to a new provider?

Try Before You Buy

• What types of managed security support can be provided on a trial
  basis? How are such pilots or “demos” arranged?

Technology Awareness and Preparation

What specific strategies are employed to
ensure information security in the following areas:

• Cloud Computing?
• Virtualization?
• Edge Computing?
• Internet of Things (IoT)?
• Artificial Intelligence (AI)?

Web Links

[return to top of this
report]

Continuity Central: http://www.continuitycentral.com/
SANS Institute: http://www.sans.org/
US National Institute of Standards and Technology: http://www.nist.gov/

References

¹ “Managed Security Service Provider (MSSP).” Gartner, Inc.
2022.

² Eyal Katz. “The 9 Most Common MSSP Security Services.” Exigence Ltd. 2020.

³ “Managed Security Service Provider (MSSP).” Gartner, Inc.
2022.

^4-5 “Managed Security Services (MSS) Market by Security Type
(Managed IAM, Managed SIEM, Managed Firewall, and MDR), Service Type
(Fully MSS and Co-managed), Organization Size, Vertical (BFSI, Government,
and Healthcare), and Region – Global Forecast to 2026.” MarketsandMarkets
Research Private Ltd. October 2021.

⁶ Adapted in part from “Request for Information (RFI) on
Information Security Outsourcing.” Network Computing | CMP Media, LLC.

About the Author

[return to top of this
report]

James G. Barr is a leading business continuity analyst
and business writer with more than 40 years’ IT experience. A member of
“Who’s Who in Finance and Industry,” Mr. Barr has designed, developed, and
deployed business continuity plans for a number of Fortune 500 firms. He
is the author of several books, including How to Succeed in Business
BY Really Trying, a member of Faulkner’s Advisory Panel, and a
senior editor for Faulkner’s Security Management Practices.
Mr. Barr can be reached via e-mail at jgbarr@faulkner.com.

[return to top of this
report]