Organisations today look to outsourcing their security needs either partially or completely to managed security service providers (MSSPs), says Susan du Bois, principal consultant of operations at Symantec Africa.
This is done to remove the burden of managing and monitoring security devices and ease the pressures brought about by corporate governance legislation, she says.
"When companies embark on a search for a suitable MSSP, there are many companies that provide management and monitoring of security devices, but the definition and scope of the services they offer often vary from vendor to vendor," she explains.
"From a governance perspective alone, any MSSP must maintain facilities, processes and procedures validated and certified by a third-party auditor in accordance with industry standards.
"For example, an essential feature for any effective security monitoring service is correlation. Some MSSPs claim to correlate security data from various devices, but may lack the architecture and technology to perform this task. Many MSSPs address correlation simply by collecting security data from disparate security devices and consolidating the data into a single view."
Under this model, there are no automated processes to connect the pieces of data that logically relate to each other, which is the true definition of correlation, says Du Bois.
"Vast amounts of information are generated when mining data. Manual correlation, even on a small scale, is not reliable, and the problem increases as the amount of data increases. Without automation, detecting and responding to network attacks promptly become ineffectual," she explains.
Industry experts recommend that companies give preference to providers that offer automated event correlation, she states. "This is the automated grouping of individual signs of malicious activity by logical criteria, such as attack source, type and destination. The result is a rapid reconstruction of attacks, giving analysts at security operation centres (SOCs) a visual representation of an attack in its entirety, and to respond immediately."
According to Du Bois, Symantec has four SOCs monitoring thousands of devices on behalf of hundreds of customers in 74 countries. "There are 45 registered centres feeding back to the SOCs every security-related event, and with Symantec monitoring 30% of global e-mail traffic, new phishing threats can be dealt with quickly," she explains.
"An MSSP that provides the right combination of people, process and technology, coupled with continuous threat intelligence, can maximise the value of a customer's investment in technology and internal resources, and help optimise security spending. Perhaps most importantly, by effectively solving security problems, these services enable enterprises to focus on their core business issues."
Share
