Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideUnderstand the benefits of using third party expertsThere are many reasons why an organisation may wish to employ external cyber security monitoring and logging providers,such as to help carry out activities outlined in previous chapters.Most respondents to the Project Survey placed a high value on the many differing benefits of outsourcing cyber securitymonitoring and logging services, which included:• 24 x 7 x 365 coverage• Cost advantages over developing your own solution (eg. because of leveraging, personnel, tools and approaches)• Access to cyber security monitoring and logging specialists• Cyber security (protective) monitoring• Access to ‘surge support’ (swift deployment of experienced coordination)• Fast provision of an effective cyber security monitoring capability.Other factors that were also well supported included: lower risk delivery of services; independent view of risk; quick andeasy, low-risk compliance; and SLAs with service credits.You should procure cyber security monitoring and logging services from a trusted,certified external company who employ professional, ethical and highly technicallycompetent individuals. CREST member companies are independently assessed and canprovide you with a certified, trusted relationship, backed by an effective industry body.Outsourcing challengesWhilst there are many benefits associated with outsourcing cyber security monitoring and logging services, there are alsoa number of challenges to address. Project research identified a number of challenges associated with the provision ofappropriate cyber security monitoring and logging services which included:• Significant variations in the (type and quality of) provision of services• Lack of clarity about what is actually being offered• The proliferation of ‘specialist’ (often proprietary) tools and their lack of integration• Insufficient links (in a number of cases) to cyber security incident response services• No related standard or qualification for their provision• No standard generic for assessing knowledge, skill and competence of service providers, particularly SOC and Cloudbasedsolutions• No codes of conduct for M&L service providers• Vendor hype.Respondents to the Project Survey were asked about the extent to which they consider a range of topics prior tooutsourcing activities or services to external cyber security monitoring and logging providers. Most respondents fullyconsider a wide range of important topics which could cause problems when outsourcing, which were:1. Loss of control of your data (particularly sensitive data)2. Gaining access to your own data stored by outsourcers3. Level of support in responding to a cyber security incident4. Reduced access to business context information5. Location of analysts and how they can be contacted.!Concerns over these types of issue were typically more highly rated than the benefitsof outsourcing. However, if these types of issues are handled effectively then theoutsourcing of some or all cyber security monitoring and logging services shouldmake good business sense.48