Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideMost organisations need professional help in carrying out cyber security monitoring and logging activities in an effectivemanner. However, it is very difficult for them to identify trusted organisations that have access to competent, qualifiedexperts who can respond appropriately whilst protecting sensitive corporate and attack information.!There can sometimes be a dichotomy between what information an outsourcedservice provider should disclose (eg. to support a forensic investigation) and what abuyer should be able to have access to (RFP; SLA clauses; cloud services).Types of service availableThe main services offered by third parties in the cyber security monitoring and logging arena include:• Protective monitoring (often delivered in real-time from their SOC)• Advanced threat detection (using tools and techniques to provide threat intelligence and monitor all connectionsbetween devices on an organisation’s network and the Internet)• Security device management.Many other complementary services can be offered by a number of suppliers, suchas risk assessment, penetration testing, incident response, malware analysis andremediation services.For each of these services there are different ways you can pay for them – all of which should be evaluated and thennegotiated - which include being charged by one or a combination of:• Devices per hour• Events per second (EPS)• Logging capability.Many reputable suppliers will help you select the most appropriate method ofpayment, typically saving you money.Define supplier selection criteriaYou should now be in a position to define your supplier selection criteria, based on topics covered earlier in the chapter.When defining supplier selection criteria, you should consider findings from project research which identified that areputable supplier will:• Understand and meet your outsourcing requirements• Have a clear, shared understanding of the scope of the services being discovered, for example in terms of skills,approach and output• Develop a suitable approach to tackle your specific cyber security monitoring and logging requirements, backed upby a consistent and repeatable response process• Help you initiate an effective remediation and improvement programme.50