Managed Security Service Providers have gained popularity as organizations seek to enhance their security posture. Companies often turn to MSSPs for their greater efficiency and specialized knowledge compared to internal teams. Selecting the right MSSP is crucial due to the high stakes involved. Here are five simple steps to guide you in choosing the right MSSP.
Seek specialized expertise and extensive experience
When selecting an Managed Security Service Providers, look for tailored expertise and relevant experience. Consider their track record with companies in your industry and region, or opt for a provider with global expertise. Verify the provider’s tenure in the industry, as established providers are often more reliable. Assess the qualifications and certifications of the MSSP’s personnel to ensure they possess the necessary education and industry-recognized credentials.
Additionally, evaluate the Managed Security Services Provider’s research capabilities. This can be determined by their publications on new Advanced Persistent Threat (APT) groups, tools, techniques, and investigations. Strong expertise in this area contributes to effective threat detection, hunting, and incident prevention or mitigation.
Evaluate the Managed Security Service Providers technology stack: Is it an enterprise solution or a proprietary tool?
Before finalizing your MSSP selection, ensure that they have the relevant technology and tools to provide effective security tailored to your company’s needs. It is essential to consider compatibility, for example, an MSSP specializing in Windows protection may not be suitable for a Unix-based environment.
MSSPs can generally be categorized into two groups. The first group utilizes well-established enterprise solutions available from reputable vendors, while the second group relies on self-developed or customized open-source tools. Your choice should be based on several factors, including alignment with your technologies, the MSSP’s ability to transition to an in-house Security Operations Center (SOC), the long-term value beyond the contract, and other relevant considerations.
Clearly define SLAs (service level agreements) and metrics.
Consider the metrics you plan to use to evaluate the effectiveness of a provider and how they will be tracked and calculated. Common metrics for MSSPs include reaction time and response time. Response time can be defined in various ways, ranging from the time of initial mitigation recommendations to the completion of the incident containment stage. However, you can also establish customized indicators based on your specific requirements. For instance, if your company is focused on rapid growth, the time it takes to cover new assets becomes a critical metric. Additionally, it is crucial to have the ability to set target values for the SLA that can be provided by the MSSP vendor.
Assess the security of the provider’s environment.
Determine if the vendor prioritizes security measures, including cybersecurity hygiene and regular assessments by external experts. Some MSSPs may prioritize handling more commercial contracts over investing resources in their own security. However, considering that the MSSP will become a part of your threat landscape and a potential attack vector, it is important to ensure that their security practices do not compromise your protection.
Consider the option of dividing the service among multiple providers.
During the initial planning stages, consider if it is beneficial to outsource security functions to multiple Managed Security Service Providers. While selecting specialized providers for specific services can be advantageous, there are potential synergies when bundling services from the same vendor. For instance, having monitoring and digital forensics and incident response (DFIR) services from one company enables teams to share historical incident information and indicators of compromise (IoCs), enhancing effectiveness.
When procuring defensive services, also consider offensive assessments. Review contract conditions for provisions regarding red teaming, penetration testing, or the establishment of cyber ranges. Any form of assessment can be valuable for validating maximum segment size (MSS) values and providing training to your team.
