How To Get Managed Security Services?

The managed Security Services are used because, cybersecurity threats are growing all the time, and there’s never been more of a need for skilled IT-security professionals. Unfortunately, there’s a massive shortage of them. Hopefully, this will be remedied over the long term but the long term can be an uncomfortable wait, especially if you have regulators breathing down your neck. Even if you don’t, nobody wants to hit the (social) media for all the wrong reasons.

Because of this, and for a lot of other reasons, many companies are turning to managed security providers. This can be a very sensible solution. In fact, in some cases, it can be the only sensible solution. For it to work well, however, clients have to understand how to get the most from managed security.

Check your homework thoroughly before you sign

While this comment applies to just about any purchasing decision in any walk of life, it has particular significance for the managed security industry. The whole point of managed security is to give you peace of mind and eliminate hassle. It should never end up being a source of stress. Making this ideal a reality means choosing your managed security partner with great care and ensuring that you are clear about what is and is not included in the service package you choose.

Managed Security Services

Research prospective managed security partners very carefully

Given the size of the managed-security industry, it’s sadly inevitable that it’s going to attract some players who actively try to lure companies into contracts they don’t understand and then pile on charges for services the client believed were already covered. Having a good look around the internet could be enough to let you eliminate some companies (and also identify some strong candidates).

Just remember that in situations like this, internet research is a starting point rather than an endpoint. You’ll still need to talk to potential managed-security partners to get a feel for their commitment to customer service and general approach to doing business. Never be afraid to back off from a company that seems to be blinding you with science. At best it’s a sign that they have a communications issue (at worst it’s a sign of a hard sell).

The sort of managed-security companies you want to work with is the sort that is quite happy to take the time to answer questions in clear language and put the answers in writing if requested.

Understand what you’re signing up to

Here’s what you need to understand about managed-security companies. For the most part, their order of priorities (and service) is as follows:

  • 1. Prevention,
  • 2. Monitoring and detection,
  • 3. Reaction and resolution.

Standard service contracts are often weighted heavily (or exclusively) in favor of the first two points, with the second being up for negotiation.

What this means in practice is that baseline service contracts (from reputable companies) will tend to include services such as:
Provide list Tag

  • 1. access and identity management
  • 2. content filtering (email, messengers, and web)
  • 3. encryption
  • 4. endpoint protection
  • 5. malware detection
  • 6. monitoring and alerting
  • 7. patch management and updates
  • 8. regular security reports
  • 9. virtual private network connectivity

These may be made available on an “a la carte” basis, but these days it’s much more common for core services like the above to be bundled into subscriptions, which include the necessary software licenses, and provision of hardware as appropriate and access to management portals.

You may or may not get some level of consultancy, for example identifying vulnerabilities in your defenses and offering guidance on how to fix them. As you might expect, these consultancy exercises may be undertaken with a view to generating upselling opportunities, however, they can still be very useful.

What you are unlikely to receive as standard

What you are unlikely to receive as standard is in-depth, personalized consulting other than to the extent previously mentioned or assistance to deal with any security threats identified through the monitoring systems.

This last point may come as a bit of a shock to the system, but it is very often the case. This means that you either need to have in-house IT security staff to deal with the issue (which is often exactly what you want to avoid due to recruitment- and cost issues) or you need to budget for extra assistance if you need it. There are various ways you can go about this, which can be used individually or in combination.

One option is to sign up for a higher-value plan which does include at least some level of assistance with remedying security issues. Another is simply to budget emergency funds for that possibility. Another is to sign up for cybersecurity insurance.

If you’re interested in learning more about managed security services, click here to contact Aperio IT.

Get mangaed it

Request a Free Demo