Risk And Rewards

The risk and threats that companies face in protecting confidential
information is making them look for outside expertise in managing security.
Hacking incidents, losing data in transit, storing transaction data in violation
of company policy, money laundering - all of these form a witches brew of
vulnerabilities that can easily lead to losses in millions of dollars in the
form of lawsuits, regulatory actions, and reputation damage.

It's no wonder then that managed-security service providers are stepping
forward to relieve corporate information-security officers of the burden of
protecting sensitive data. Obtaining security services on an outsourced or
offshore basis, or both, demands an understanding of what such services are, as
well as the ability to subject a company's security policies, technology, and
standards to objective scrutiny by a third party. Since data are the crown
jewels of most enterprises, they have to look carefully before entrusting their
protection to an outside party.

Management and Monitoring

Security management encompasses fault management, including notification
when a security device ceases to function and periodic reports on the
operational status of security devices; configuration management, which covers
security device application and operating system modifications and upgrades; and
performance management, which includes statistics on speed and efficiency of
networks, identification of network bottlenecks, and logging data generated by
security devices.

Security monitoring includes data collection-for example, the process of
collecting and transforming security-device data, data mining, including
cross-correlation of data across different devices and domains; security-event
correlation, by which signs of malicious activity are grouped by logical
criteria, enabling analysts to navigate millions of lines of code for clues
about threat vectors; and expert response, ranging from simple notifications to
alerting law-enforcement agencies.

Security Engagement

“This type of protection doesn't come easy or cheap. Providers of
outsourced IT-infrastructure services must maintain tight controls over access
to sensitive data and programs, as well as ensure that each client's data is
kept separate from others. Getting security officers to accept the idea of a
shared infrastructure for security services can be a formidable hurdle.
Initially, customers may insist on having dedicated resources, but will
gravitate toward shared resources for economy and in order to take advantage of
the latest technologies,” says Nick Sharma, global head, Infrastructure
Management Services, Satyam Computer Services.

Sharma further adds that infrastructure services, including security, make up
a small percentage of Satyam's business, which is heavily based on software
development. However, they represent the “next wave” of outsourced services
for Satyam and other global service providers.

“An engagement begins with a detailed security audit, which provides the
foundation for creating a security architecture,” he says. This requires
different forms of experts: Those proficient in understanding and interpreting
the security aspects of laws and regulations such as Sarbanes-Oxley,
Gramm-Leach-Bliley and HIPAA, as well as technologists skilled at engineering a
secure network, making threat assessments and developing business-continuity
plans.

Financial-services companies- whose business is risk management-are in
the forefront of the move toward managed-security services. As the threat of
computer-initiated attacks increases, and as regulators put more pressure on
financial institutions to shore up their information assets, financial
institutions are turning toward outsourcing their information-security functions
to third-party processors.

“The outsourcing of information security makes sense to organizations that
have a highly developed concept of risk,” says Prosenjeet Banerjee, VP and
head of Information Security, HCL Technologies.

Banks are being driven to ink managed-security deals as they seek to restore
their reputation for integrity, which have been sullied by disclosures of theft
or loss of sensitive customer information, including credit card and
social-security numbers.

If that weren't enough, there's the burden of laws and regulations that
have banks struggling to avoid being choked by red tape. The U.S.A. Patriot Act,
under its “know your customer rules,” requires banks to authenticate the
identities of new customers and ensure that personal information is secure. The
Sarbanes-Oxley law requires banks to implement access controls to data and
computer programs that contain sensitive information. And Basel II, the new
regulatory capital regime that takes effect next year, requires that banks
monitor operational risks, including computer breaches.

The Business Case

The business case for outsourcing information security is a sound one -
experts say. Managed-security services is one of the fastest growing market
segments in the security marketplace, according to Gartner. Gartner reports that
as of 2005, 60% of enterprises were outsourcing the monitoring of at least one
network boundary security technology. According to IDC, as of 2004, security
services was a $16.5 bn industry with a CAGR of 35%.

In a managed-security deal, the organization shares information-security risk
and business risk with the managed-services provider. Such deals provide access
to a range of security services and to skilled staff whose full-time job is
security.

According to the CERT Coordination Center of Carnegie Mellon University, such
services may include network- boundary protection (including managed services
for firewalls, intrusion-detection systems and virtual-private networks);
security monitoring; incident management (including emergency response and
forensic analysis); vulnerability assessment and penetration testing; anti-virus
and content-filtering services; information-security risk assessments; data
archiving and restoration, and on-site consulting.

The cost of a managed-security service is typically less than hiring
in-house, full-time security experts. For example, a managed-security provider
can set up and monitor security on a 250-user network on a single T1 (1.5 Mbps)
Internet gateway for about $75,000 a year, excluding hardware. Replicating these
actions within the organization produces similar hardware costs, plus at least
$240,000 in annual compensation to hire three full-time specialists.

A shortage of qualified information-security personnel puts tremendous
pressure on IT departments to recruit, train, compensate, and retain critical
staff. The cost of in-house network-security specialists can be prohibitive. In
an outsourcing deal, the costs to hire, train, and retain highly skilled staff
becomes the service provider's responsibility.

A managed-security provider can offer an independent perspective on the
security posture of an organization and help maintain a system of checks and
balances with in-house personnel. It can, thus provide an integrated, more
coherent solution, thereby eliminating redundant effort, hardware, and software.

Risk Mitigation

In deciding to retain an MSSP, an organization needs to treat the potential
action as a risk mitigation sharing decision. When weighing the risks, banks
need to consider issues such as trust, dependence, and ownership.

Establishing a good working relationship and building trust between a client
and service provider is critical in deciding whether to outsource security
services. Any service provider has access to sensitive client information and
details about the client's security posture and vulnerabilities. The
intentional or inadvertent public release of such information can be extremely
damaging to the client. A signed confidentiality agreement enacted in the later
stages of contract negotiations can help mitigate this risk.

An organization can become operationally dependent on a single service
provider. One risk-mitigation approach is to outsource to multiple providers,
but this comes with additional cost and management oversight responsibilities.
An organization needs to carefully examine the provider's proposal to
understand whether it uses subcontractors and how they work.

A client retains ownership and responsibility for the secure operation of its
infrastructure and the protection of its critical assets regardless of the scope
of services provided by a service provider. Risk-mitigation approaches include
making information security the primary responsibility for one or more staff
members and managers, and conducting regular user-security awareness and
training sessions.

The shared operational environment used by many service providers to service
multiple clients poses more risks than an in-house environment. Sharing a
data-transmission capability (such as a common network) or a processing
environment (such as a general-purpose server) across multiple clients can
increase the likelihood of one organization having access to the sensitive
information of another.

Initiating a managed-security services relationship may require a complex
transition of people, processes, hardware, software, and other assets from the
client to the provider or from one provider to another, all of which may
introduce new risks. IT and business environments may require new interfaces,
approaches, and expectations for service delivery.

The CERT Coordination Center provides a list of best practices for engaging
managed-security service providers. They are intended primarily for those
responsible for the selection and day-to-day overview of outsourced
managed-security services. This may include the chief information officer, chief
financial officer, contracting/purchasing manager, information technology
manager, chief security officer, and technical staff (system and network
administrators).

To knowledgeably select, engage, manage, and terminate service provider
relationships and the services they provide, CERT recommends a three-step
approach: Engaging an MSSP; managing the relationship with an MSSP; and
terminating an MSSP. The first practice in engaging a service provider provides
guidance for a Request for Proposal (RFP). The RFP establishes the client's
requirements that need to be addressed in a provider's proposal. The second
practice describes guidelines for evaluating a provider's proposal beyond
those implied by the RFP guidelines. The third practice provides content
guidance for a Service-level Agreement (SLA). The SLA is one part of the
contract between the client and provider. It addresses some of the RFP
requirements.

Managing the relationship with a service provider includes guidelines for
establishing a new provider relationship or transitioning from in-house services
to provider-supplied services or transitioning from one provider to another. The
second practice in this area addresses the ongoing client/provider relationship.

Finally, there are guidelines to consider using when an organization
terminates a relationship with a service provider, whether at the end of a
contract or for some other reason.

By Steven Marlin in New York, USA


vadmail@dqindia.com

Republished with permission from Global Services

(www.globalservicesmedia.com)