Volume 1 - Issue 8 - ICTACT.IN

Tech TalkSecurity Operation CentreIsrar Elahi, Head of Training, Consumer Services, Philippines, CSS CorpIn order to prevent the myriad of modernattacks, comply with government andindustry regulations, monitor deployedtechnology solutions, and verify the endlesshuman interactions with technology,organizations turn to industry-leading securitytechnology.They may go to IBM Internet SecuritySystems for their network intrusion preventionsystems (IPS), Cisco for their firewallsolutions, and Mcafee for host-basedprotection.This heterogeneous approach to selectingsecurity solutions provides organizationsthe best-of-breed technologiesand offers inherent security by not relyingon any single vendor or security platform.The combination of technologiesdoes, however, present a large challenge -there is no inherent way to normalize, aggregate,and correlate the security eventsacross technologies.Further, one team may support thefirewalls, another may support the networkIPS devices, and yet another maysupport the host-based security tools.This leads to security monitoring thatis performed using different tools and bydifferent teams.Piecing together the details of an attackin real-time becomes incredibly difficultand even forensic analysis after anattack is slowed by the need to combineevent streams.In reality, building and maintaininga strong security posture necessitates acentralized effort to monitor, analyze, andrespond to security events across technologiesas quickly as possible.To meet this need, many organizationsturn to Managed Security ServicesProviders (MSSPs) to outsource the bulkof security monitoring and testing.MSSPs offer a number of benefits becausethey can:• Monitor security events aroundthe-clockand provide in-depth informationsecurity expertise.• Spot patterns across a number ofcustomers to provide advanced warningon new threats.• Provide services to customers thatdo not have dedicated information securitystaff.However, MSSPs also present a numberof disadvantages. Namely, MSSPs do not:• Have an in-depth knowledge of thecustomer’s policies, procedures, or overallIT environment.• Offer dedicated staff for every customer.Only large organizations that spendthe most with the MSSP generally receivededicated support.• Offer customized services, processes,or procedures for the customerneeds.MSSPs strive to standardize servicesin order to gain economies of scale in providingsecurity services to many customers.June 2013 I 30