Introduction to Managed Security Services

Organizations nowadays use a plethora of solutions like IdM, Access Managers, SSO, Firewalls, Intrusion Detection Systems and Intrusion Prevention Systems. These solutions generate a flood of information in the form of alerts and log messages with disparate context and in no standardized format and it is this very information that needs to be analysed if one is to detect sophisticated modern day cyber threats. Ensuring conformance to compliance regulations brings an additional overhead into the picture.

This is exactly the pain point that the SIEM class of solutions emerged to address. An SIEM aggregates and correlates all the security information being generated across these systems and thus provides capabilities to gain complete visibility into a network.

But not all security incidents can be detected by rule based correlation. SIEM solutions are also limited in their ability to identify and initiate appropriate responses to remediate threats, and until the emergence of an Artificial Intelligence, no amount of automation can replace a seasoned Security Analyst.

What is a Security Operations Center?
A Security Operations Center (SOC) is a dedicated entity responsible for monitoring activities across devices in an organizational network in order to identify threats and incidents and to coordinate responses and remediations in a systematic manner. An SOC leverages SIEMs or SIEM-like data processing engines coupled with the expertise and availability of a team of dedicated Security Engineers and Data Analysts.

Need for Threat Intelligence Sharing
Just setting up an SOC is never enough. It is crucial to network with SOCs of other organizations and government information sharing centers to learn about new attack patterns and threat actors as they surface. Setting up and maintaining such communications adds another layer of complexity. Protocols need to be established to communicate threat information in a way that can be transmitted and collated conveniently and interpreted correctly.

What are Managed Security Services?
SOCs operate 24x7 and need to work in close sync with the IT Operations teams to effectively neutralize threats. Setting up an SOC internally requires high initial investment to procure and deploy various security solutions, and to establish the required processes and protocols. The long term operational cost is even higher and has no immediately visible returns. Talent required to staff such operations is also in short supply.

To put it plainly, Managed Security Services are Outsourced Security Services. They provide an economically feasible alternative to setting up an Internal SOC by reducing the cost of ownership of the required security solutions and expertise. It also facilitates threat intelligence sharing amongst customers of the same Managed Security Services Provider. There is a very little scope for collusion between the SOC staff and attackers. Major players in the Managed Security Services space include trusted names like IBM, Symantec, NTT, AT&T and Dell.

MSS Architectural Patterns

A MSS Architecture can be likened to a large-scale multi-tenant SIEM solution. One size does not fit all and MSS architecture is greatly influenced by the complexity of the customer networks being served, their budgets, risk factors, locations, availability and compliance requirements.

Implementation choices can broadly fall under either of two categories: All security solutions are remotely administered by the MSSP Security Operations teams or All security information is aggregated and evaluated in one central location.

In the first approach, security data does not leave the customer premises. Services may include managing or fully configured SIEM or limited to one area of security monitoring like firewall and VPN activity or tuning and evaluating IDS alerts. SIEM solutions may or may not come into play. Since the infrastructure is exclusive to a customer account, considerable costs may need to be borne.

Figure: Remotely Managed Firewall Service Architecture

In the second approach, all security data is copied to the MSSP location and is thus inherently vulnerable to potential leakage. Centralization of all this information dictates the use of a SIEM or SIEM-like solution and since most of the infrastructure is shared, the costs are much lower.

Some architectures like those outlined by Alienvault USM dictate a certain amount of remote administration.

Figure: Consolidated MSSP Architecture without Remote Administration
  
Figure: Consolidated MSSP Architecture with Remote Administration  (source:Alienvault)

In both approaches, the customer has no direct access to the security information. A dashboard and reporting portal is typically provided for customers to gain summary insights into the state of monitoring and incident resolution. But this will almost always be cryptic to the customer. So Irrespective of the implementation, one metric to easily evaluate an MSSP is the speed with which incidents are detected, evaluated and addressed.

Sources: https://www.linkedin.com/pulse/introduction-managed-security-services-nikhil-salgaonkar