Managed Security Services

As digitalisation takes place on a broad scale, companies and organisations are shifting their activities to virtual spaces and digital networks. This tends to increase efficiency, but it also opens up a larger attack surface. Organisations are therefore forced to address the issue of IT security. Here it pays to be proactive. It is better to prevent attacks before they occur than to try to repair damage that has already been done.

Usually, information security services are provided by in-house staff. However, because only larger companies operated data centres with the appropriate specialists, the topic often fell completely under the radar for smaller companies. But even large companies were quickly overwhelmed due to the complexity of the topic and constantly changing threat scenarios.

The fact is: The cat-and-mouse game of protecting one’s own systems against global gangs of cyber criminals is costly and constantly devours resources. That’s why it makes sense to outsource security services to specialists. These tend to perform better with greater efficiency, i.e. lower costs. We take a detailed look at the managed security services provided in this context.

Managed security services (MSS) are services designed to manage and ensure the IT security of companies or other organisations. MSS are provided by specialised providers, so-called ‘Managed Security Service Providers’ (MSSP). The largest MSSPs include the IT industry giants IBM, AT&T, and Verizon, as well as consulting firms such as Accenture and Deloitte. The decisive factor for MSS is that the services are transferred to an external partner. This makes MSSP a special form of Managed Service Provider (MSP).

Before we take a closer look at the actual managed security services, a brief excursion into the world of IT security. If one is familiar with the three basic terms of information security, the tension between IT systems, cyber attackers and MSSPs can be better understood. These are ‘Confidentiality’, ‘Integrity’, and ‘Accessibility’, often abbreviated as CIA:

Generally speaking, managed security services providers (MSSP) provide any services that serve to maintain IT security. Let’s look at the relevant terms again through the lens of information security:

So what do MSSPs do? They proactively protect resources from attacks and damage, analyse incidents, respond to them, and deploy systems that generate alerts. Let’s take a look at what services MSSPs provide in detail below.

First of all, a managed security service provider (MSSP) is the point of contact for all issues related to the customer’s IT security. As part of strategic planning, MSSPs help define goals, uncover risks, and identify opportunities. The customer benefits from the provider’s experience and specialised knowledge.

Specifically, MSSPs clarify which systems to build and manage and how. This includes hardware, software, and configuration. In some cases, these are provided directly by the MSSP, which nowadays often happens in the cloud; otherwise, the provider manages the systems running at the customer’s site. In addition, MSSPs help the customer implement best practices for data centre security. This includes staff training.

In addition to proactive consulting, emergency assistance is also a critical managed security service. After all, damage requires a rapid response. At the same time, it is essential not to panic, otherwise there is a risk of making the situation worse. The experienced specialists of the managed security service provider have already experienced frequently occurring scenarios. They can assess the risks and provide recommendations on the best course of action.

Although having support from a managed security service provider is worth its weight in gold for an organisation in an emergency, by then it’s often too late. If sensitive data has been stolen, for example, the only option is to attempt damage control. It is therefore better to act proactively.

The basis for proactive action lies in forward-looking planning and continuous monitoring of critical structures. This includes IT systems such as end devices, cloud environments, data storage, and networks. Systems are monitored for the emergence of suspicious patterns. If an incident is detected, alerts are generated. Based on this, appropriate defensive or rescue measures are initiated.

Monitoring IT resources requires specialised systems that generate alerts in real time. This is the only way to react in time. Because: Computer networks are constantly under attack. At the lowest level, automated defence measures are used. Let’s take a look at some of these.

The omnipresent firewalls filter out unauthorised packets based on static rules. They thus form the basis for network security. Firewalls are implemented both as specialised hardware and at the software level. Attack detection systems are also used. These are ‘Intrusion Detection Systems’ (IDS) or ‘Intrusion Prevention Systems’ (IPS), the latter adapting firewall rules in response to detected incidents in real time. IDSs and IPSs are deployed both as part of network hardware and on users’ endpoints.

Less glamorous than fighting hackers, but no less important, is managing upgrades and patches. Since good patch management prevents many attacks, it is an essential part of the IT security strategy. Furthermore, upgrade management can be outsourced particularly well as a managed security service. In general, problems can occur with any update. If a service provider performs the same update for many customers, the problems and their solutions are known.

As part of the proactive approach, managed security service providers take on another function. They check their customers’ systems for weaknesses and vulnerabilities. The goal is to minimise the probability of security breaches, as well as the severity of the resulting damage. Various approaches are used in this process.

In a security audit, all areas of an organisation are checked for vulnerabilities. In addition to the obligatory technical aspects, the focus is particularly on organisational and human factors. First, the findings obtained during the audit are used to identify weaknesses on the basis of logical conclusions and to initiate improvements.

Second, well-intentioned ‘white hat hackers’ attempt to leverage or circumvent a system’s security precautions as part of so-called ‘penetration tests’ (pentesting). Pentesting uses the same approaches and tools that are used by malicious black hat hackers. If the target has been successfully hacked, the pentesters reveal which vulnerabilities they have exploited. Based on this information, the systems are subsequently hardened and improved. In this way, they are better protected against similar attacks by malicious actors.

Last but not least, managed security service providers support their customers in complying with applicable regulations and correctly implementing best practices. The topic is known as ‘Regulatory Compliance’ (or ‘compliance’ for short). The monitoring of a customer’s compliance by an MSSP is known as compliance monitoring.

Especially for critical industries such as healthcare, insurance, legal organisations, and banking and finance, compliance is of utmost importance. Because only by ensuring compliance is it possible to avert a loss of image and substantial compensation payments in the event of damage.

The promise of using managed security services is to achieve better security while reducing costs. managed security service providers (MSSP) take a systematic approach to auditing and managing security-related issues. Their specialised knowledge in the security field helps ensure compliance with higher security standards. If required, the MSSP provides the hardware needed for security compliance.

Permanent monitoring of security allows proactive countermeasures to be taken in the event of an attack. Security gaps are identified and eliminated in advance, networks and IT systems are monitored, and attacks are automatically prevented. The customer benefits from the security expertise of an experienced service provider, because the specialists with know-how in the security field are up to date with the latest knowledge. Depending on requirements, managed security services are provided flexibly either remotely or directly on site.

On the customer side, this results in a reduction in costs by saving the company’s own time and personnel expenses. Furthermore, the ability to focus on the core business allows for a more efficient use of the employed resources. Managed security services are often offered in different performance classes. This makes IT security costs transparent and plannable. Costs can be minimised while optimising security at the same time.

If special compliance rules must be observed, such as in the healthcare or financial sectors, specialised managed security service providers can be used. These offer complete plans that are perfectly tailored to the customer’s needs and include the required managed security services at an optimal price.