Inside Track: The service option

Cyber Risk International Paul C Dwyer, CEO

Our software calculates a metric that corresponds to the maturity a company requires in a particular area. Instead of measuring an individual organisation’s risk profile against a general standard, the software asks specific questions in order to build a profile of the business. Effectively it is a kind of risk audit and it’s not a technical exercise but instead is about governance, risk management, relationships – the holistic view of cybersecurity.

The only intelligence that really counts is actionable information, and the software delivers this information in a form that boards can understand and use to make calculated decisions.

As clients go through the questions and the profile, they get instant access to an expert, so in a sense we’re providing the traditional consulting model as a managed service, by giving clients access to a pool of experts.

I believe that the looming changes around EU GDPR means that every organisation will need to rethink what they’re doing around managed security services. Given the scope of the changes, I would caution that what was OK last year might not apply when the new regulation comes into force in May 2018.

My interpretation of GDPR is that third-party organisations processing log data as a managed service on behalf of clients will come into the firing line. Between now and May 2018, I anticipate a lot of confusion. There could be a scenario where the operator of a managed security operations centre could be held legally responsible, and this could impact on cost models from the provider to the consumer of those managed services because GDPR mandates notification to the relevant data protection authority in the event of a breach — that has to have cost implications, from what I can see.

That said, everything is possible if organisations have the right governance model to begin with, and the right agreements with trusted service providers in place. The key now is for governance models to mature in line with an organisation’s use of managed services. It is no longer enough to sign the contract for the managed service and walk away; ultimately the buying organisation and the service provider must now share the responsibility.

edgescan Rahim Jina, COO

The second driver is technology change. Security assessments like vulnerability management and penetration testing used to be one-off annual events, back when large systems had one major release a year, and the code was developed with that single date in mind and then nothing changed for the following 12 months.

The huge push over recent years to using cloud, along with the rise of development methodologies like Agile, mean the single annual release has given way to frequent small releases — sometimes as often as daily. A once-yearly security assessment no longer fits the bill, because any change to the code can potentially introduce new vulnerabilities.

Fortunately, there are several managed security service providers [MSSPs] specifically addressing the vulnerability management and penetration testing space, and many sectors are adopting the model, which is helping to push it towards maturity.

For example, games developers were quick to embrace the agile and cloud trends, so managed security was an obvious fit for them. Financial services firms such as banking and insurance providers have also adopted MSSPs. For compliance or operational reasons, they have always needed strong security and many have in-house security teams themselves. These organisations often use external managed security providers in a very tactical way. Rather than using internal resources to sift through large volumes of events, they rely on the MSSP to identify bugs and vulnerabilities. This way, the organisation’s team can more productively work on fixing those weak points and focus on the real issues that impact on the business.

Reading through security tool output or alerts is hugely time consuming, so another huge advantage of a MSSP is that they have the expertise to look at this data and identify false positives. The benefit to the end business is time saving: they win more time back to carry out higher-value work because the MSSP has the expertise to filter out the signals from the noise – taking one headache away from the end customer.

Similarly, managed static application security testing (SAST) is a security code review that we perform for our clients. Like other services, SAST tools traditionally generate a lot of output and can often result in reports that run to hundreds of pages. As above, there are similar advantages for clients who can upload their source code to the MSSP who then scans that code for security bugs and provides them details on real issues only.

It should also be said the customer still needs to manage the managed service; it is pointless if no-one is taking action on the output. That means having to regularly reassess MSSP vendors, but there is a good choice in the market, and since managed services are remote by nature, buyers aren’t restricted to the Irish market for options. MSSP options like managed firewalls are especially suited to SMEs who don’t have the resources for in-house teams.

Full end-to-end managed security isn’t mature yet, in my opinion, but in the meantime, for specific tasks like full-stack application and network testing, or managed SAST, Irish organisations can have confidence in the available options.

Asystec Ryan O’ Donnell

Asystec as a Security Managed service provider have gained experience in deploying and maintaining security products in our customer environments, we adopt the ‘Learn, Do, Review’ methodology and continually push to improve our service offerings to ensure our customer don’t have to. We understand how to integrate security products into your environment from a process perspective as well as the technical integration. If heard it said often ‘you don’t know what you don’t know’, we know the product, we know the process. I believe this is where Asystec and our Security Managed Service offerings show their real value, let us be ‘just another brick in the wall’.