Introduction
Having the right group of people to run your vulnerability management program is just as important as the actual program itself. Let’s face it; not all companies can keep up-to-date with the latest security trends as technologies continue to advance, all while bringing on more threats. Most organizations understand this and choose to bring on a Managed Security Services Provider (MSSP) to better their security team (if one already exists) and take over services such as running a vulnerability management program. Choosing a great MSSP is essential to the success of the programs the provider will run – in our case, vulnerability management program.
A Lasting Relationship
There are several essential points to consider when going through the process of choosing an MSSP. First and foremost, an indispensable part of bringing on a team is understanding that this isn’t just a case where you meet and greet, perform a job, and then go separate ways. The relationship between an organization and an MSSP should be long-term as there is never an end to vulnerability scanning. When talking with different providers, you should focus on whether or not the company is taking the time to get to know you and your business. A better understanding of what your company does, your goals for future growth, and what aspects of your business are most will only lead to a better-managed security service. If they aren’t interested in getting to know you, then you should look elsewhere.
An important piece to finish off the remediation process is to rescan the system in order to ensure your fix was effective. One of the last things you want to do is fall under the impression that you have eliminated the risk while it is still secretly lurking in the shadows.
Get to Know the Team
On the other hand, you should always make sure you know the people’s credentials that you propose to run your program. It should go without saying, but you want to bring on a team expert in the security field. Don’t be afraid to ask about members of the team and their respective security skills/expertise and any certifications they hold. If you have a specific area of your business that you know will need more attention, you want to ensure that the team you bring on will effectively handle those responsibilities. Ensure the team keeps up with the latest industry trends and never shies away from regular training to update their skills.
Up-to-Date Technology Stack
The technology that the team operates on is equally as crucial as the team members themselves. Your MSSP provider should be using the latest technology with advanced analytics designed to catch all of the relevant threats it may come across. Obtain a better understanding of all steps of the system from vulnerability scanning to the remediation process. The relationship between the team and the technology they operate should produce real results with very few hiccups along the way.
Processes
A vital part of the relationship between your company and the MSSP is understanding the processes they will take to support your organization. The first thing you should do is discover where they are based. If you are a U.S. based company and can find a provider based out of the U.S., then that is great! However, a lot of MSSPs operate out of India or somewhere else. In addition to this, you should find out how they will handle communicating with your team. You should consider if they will come onsite for face-to-face meetings or will everything take place remotely. If remote communication turns out to be the answer, you need to understand the method they will use to communicate and interact with your team. Always ask questions about their technical and operational processes. Discover if they have a way to exclude devices or hosts that are considered too sensitive to scan. Along with exclusions of devices, you should determine if the MSSP has a process to include specific devices or hosts based on security assessments or reviews necessary to certify them before they’re considered operational. Finally, you should learn more about how they pass on information to you. The importance of the vulnerability management program and remediation results means that monthly summary reports and status update meetings will be crucial to your program’s success. You should understand if they only communicate if there is something important to report. Find out how you can provide your feedback and insert comments or requests if necessary. Uncovering the answers to these questions before picking an MSSP can be the difference between a lasting relationship between the two parties and a relationship that leaves your organization unsatisfied and disappointed with their provider.
Check Their Reviews
As with just about any physical product or service you may buy in today’s world, reputation and reviews are something that should be checked before forking over the cash. An MSSP that hesitates to provide you with references (if you ask for them) is a provider to avoid. But just getting the references is only the first step in understanding their previous work. Take the time to reach out to their past and current business partners to find out how the relationship with that MSSP has been going. Try to discover if the provider is as reliable as they say they are and if they truly possess the skills and expertise needed to protect an organization’s systems. Get a better understanding of the MSSP team’s responsiveness and how long it takes to contact them if there is ever a problem. Most importantly, find out more about their remediation process and whether or not they have been able to resolve any threats that have been detected. What would that process look like for your organization, and did it seem like the MSSP team saw the threat’s remediation as a top priority are both questions that you should be asking all of the references you contact.
MSSP Customer Base
Along with talking with existing and past customers of the MSSP, make sure most of the MSSP’s customers are similar in company size and industry niche (to an extent) as your own company. The majority of MSSPs are often more effective and efficient in specific fields due to a similarity across the organization servers, common types of breaches, and stored data locations. If you are a smaller sized company, it may be beneficial to avoid MSSPs who primarily work with larger organizations. These larger organizations pay the provider more money, so naturally, the MSSP will prioritize them and any issues they incur ahead of you and your own. If you are a larger company, you don’t want to select an MSSP who only has smaller sized companies as their customers. You may think doing this is a good idea since your organization’s needs should be a priority, but there is a learning curve for MSSP teams that protect larger companies rather than smaller ones. Not that it can’t work out, but in most cases, you don’t want to be the guinea pig for the MSSP.
MSSP Customer Base
Always know what the cost of the services is when in talks with an MSSP. But don’t just see the cost. Instead, understand what you will get for that price and how you might terminate the contract. You should always weigh out the cost between competing MSSP teams, but keep in mind that the cheapest doesn’t always mean it’s the worst, and most expensive doesn’t always mean it’s the best. It is essential to find an outstanding balance between the provider’s cost and its value from the relationship you form with them and their services.
Value
Speaking of value, getting a better understanding of the areas of expertise that the MSSP can bring to the table is a great way to discover if that team is right for your organization. Finding out if they are knowledgeable in any particular technology that would result in better service/recommendations is not something that you should overlook. You should also dive in a little deeper and see what they can tell you about your organization’s industry and vulnerability management best practices. They should walk you through the process while explaining areas like API work, scan scheduling, and integrations with other technologies that may be required. If they can’t walk you through this or seem to struggle with doing so, it may be best to look elsewhere.
Conclusion
Always know what the cost of the services is when in talks with an MSSP. But don’t just see the cost. Instead, understand what you will get for that price and how you might terminate the contract. You should always weigh out the cost between competing MSSP teams, but keep in mind that the cheapest doesn’t always mean it’s the worst, and most expensive doesn’t always mean it’s the best. It is essential to find an outstanding balance between the provider’s cost and its value from the relationship you form with them and their services.
About Secutor
Secutor Cybersecurity is a trusted partner comprised of industry leading experts in the fields of Cybersecurity and Governance, Risk and Compliance. We partner with our clients to deliver on-demand solutions tailored to expertly navigate the regulatory demands of their specific industries.
Our proven track record of successfully exceeding client expectations is achieved through the combination of our methodical approach, advanced technologies, subject matter experts, and synergy with client team members.
Secutor is your team of world-class problem solvers with vast expertise and experience delivering complete solutions keeping your organization protected, audit-ready, and running smoothly.
