|
Regardless of whether organizations choose to outsource or go in-house for security, the challenge lies in getting executive support and alignment between the business units and the security function. At worst, these relationships are adversarial and conflict between groups results in a decrease in productivity. At best, the security officer understands the business and is able to communicate the threats to business operations clearly and show that effective risk management actually enables the business.
Many enterprises make the mistake of outsourcing their security as part of a generic outsourcing agreement before obtaining this alignment. The outsourcing then leads to a false sense of security or a 'tick in the box'.
Recommendations
Organizations that simply cannot afford the investment in resources need to be sure of the services that they are buying and specifically what exclusions are in their outsource contract. Frequently, outsourcers offer low bids to secure the business and then try to make up for it in change or out-of-scope orders.
It is a fact that organizations will need to continuously adapt their security practices to suit the ever changing environment. Threats, vulnerabilities and mitigation procedures have changed dramatically over the years and organizations must be able to adapt their contract and the underlying security architectures used to keep pace.
If organizations have questions about the service level commitments or the verbiage in the contract, they should consult a trusted advisor. A technology partner, independent auditor or legal counsel can help them navigate the complexities. For international and multinational organizations, it is important to seek advice on compliance requirements in every individual country in which the organization is conducting business, and to find out how their service provider is addressing those requirements. Once organizations understand what the outsourcer intends to do, they need to figure out how to fill the gaps.
Considerations
Organizations should consider the following points when outsourcing security (either in its entirety or as part of a bigger infrastructure outsource contract):
| Network access control and other integrity architectures are emerging to take their place in the self-defending network of the future |
-
Note that compliance is the responsibility of the company, not the outsourcer.
-
How does the service organization's purchase enable them to better manage risk?
-
What are the terms of the agreement? Check SLAs, limitations and exclusions. Organizations need to know exactly what they are getting for their investment.
-
Be prepared to respond when incidents occur-this means that organisations need an incident response plan and someone to deal with the response. The contractor must support post-incident review.
-
Verify that the outsourcer is compliant with all relevant legislation and verify the security procedures and best practices deployed by the service provider.
-
Define security-related roles and responsibilities clearly and completely and specify clear security objectives in the SLA for integrity, confidentiality, availability, accountability and use control.
-
Appoint a security officer, even if it is initially in a secondary role. The security officer should have a direct reporting line to an executive who is empowered to address tough questions and make decisions that impact the risk exposure of the company.
-
Retain the ability to monitor and audit the outsourcer's environment to independently verify fulfillment of all the objectives and expectations.
-
Ensure contract terms are flexible enough to allow for changes in a rapidly changing threat landscape, and to avoid being blocked by the organizational walls that outsourcing erects and the difficulty of anticipating all the contingencies in a contract.
-
Measure contractor performance through security metrics such as number of incidents, time taken to respond to incidents, best practices, benchmarking, etc.
-
Even if an organization is using best practices frameworks such as the ITIL or CoBIT for SLAs, do not rely on these for security - use security specific frameworks such as ISO 17799: 005.
-
Customers need to try and include infrastructure "Security Assurance Level Agreements" with their standard SLAs in outsourcing contracts in the future, and minimize the number of people managing the network components.
-
The outsourcers' goal is to lock down and standardize to gain efficiencies and then sweat the assets. This is diametrically opposed to the adaptive nature required by modern day secure infrastructures.
Choosing a Partner
As applications such as Telephony, PP and Microsoft Live Messaging rapidly converge onto the network infrastructure, security becomes more complex and important. In addition, the industry is faced with strong convergence of networks, systems and security management as companies like Microsoft and Cisco embed more security functionality into their OSS and networking fabrics.
Network access control and other integrity architectures are emerging to take their place in the self-defending network of the future, which means configuration, identity and asset management are going to play larger roles in future managed, secure infrastructure. Also, infrastructure components themselves are subject to security vulnerabilities. Now the proactive 'Assurance' management of those devices themselves becomes as important as managing standalone firewalls and IDSs. This implies that enhanced configuration, security and patching management are going to play increasingly important roles in infrastructure management.
All this means is that careful deliberation needs to be given to the partners used in outsourcing contracts. Organizations cannot have a situation where multiple parties manage the same devices to achieve their respective goals. This can defeat security objectives because too many people are involved.
Many MSSPs will insist on full device control to provide their services. This scenario was suitable for standalone
Firewalls and IDS/IPSs, but will need consideration when the Firewall/IDS/IPS functionality becomes embedded into standard routers. The question of who will then manage the router bits and who will manage the security bits in that device becomes an issue.
Just as applications are converging onto the network, and security is converging into the network and applications/OS, outsourcing functions will converge. Customers will increasingly seek out systems integrators and outsourcers who have skills in network management, desktop and branch office life-cycle management, systems management and configuration management, in addition to world-class security expertise. This may very well spell the demise of the boutique security shop or niche-managed security services player, over time.
Manish Sethi, head, Security Solutions, Datacraft India
|
