WHITE PAPER Symantec Enterprise Security Demystifying the Managed Security Service Provider Market INSIDE INSIDE∆ Effective security management and monitoring ∆ A closer look at management vs. monitoring ∆ How the right MSSP can make a difference ∆ Symantec Managed Security Services Symantec DEMYSTIFYING THE MANAGED SECURITY SERVICE PROVIDER MARKET Contents Executive summary . .3 The need for effective security management and monitoring . 4 A closer look at management vs. monitoring . 5 What is security management . 5 What is security monitoring . 6 Distinguishing security monitoring claims around from the reality . 7 How the right MSSP can make a difference . 8 Symantec Managed Security Services . 10 Comprehensive management, monitoring, and response services . 12 Benefits of choosing an MSSP that provides both security management and monitoring . 13 Glossary . 14 References . 15 Symantec DEMYSTIFYING THE MANAGED SECURITY SERVICE PROVIDER MARKET √ Executive summary The value of data in today’s information age has forced organizations to increase efforts to mitigate security risk and maintain the company’s market standing. But providing an effective level of security requires a combination of state-of-the-art technology, experienced personnel, proven processes, and continuous threat intelligence that few organizations possess. Those organizations that choose to tackle these critical issues in-house invariably find themselves struggling to identify security events, provide security event alerts, respond to the threats, and manage the security risks that threaten their competitive advantage. Managed Security Services Providers (MSSPs) remove the burden of managing and monitoring security devices and events, providing a level of technology and expertise that ensures rapid response to real threats. However, the wide range of MSSPs and their offerings can prove daunting to compare and understand. This paper defines the key elements of a managed security service offering, with a focus on clarifying the differences between security management and monitoring. It also provides a set of criteria companies can reference when assessing an MSSP. It presents the features of the Symantec Managed Security Services offering, which is composed of a unique combination of technology, experience, processes, and human expertise. The paper concludes by summarizing the value of choosing an MSSP that provides both security management and monitoring. By clarifying terms and types of services, the paper will help demystify the process of choosing an MSSP, so organizations can select the MSSP most likely to strengthen the company’s security posture. 3 Symantec DEMYSTIFYING THE MANAGED SECURITY SERVICE PROVIDER MARKET √ The need for effective security management and monitoring It is essential that organizations weigh the risk of exposing their data to third parties against that of potentially losing intellectual property and productivity as a result of malicious activity. Only robust, round-the-clock security management and monitoring can mitigate the risk of these threats against an enterprise network. But effective security management and monitoring requires a combination of best-of-breed technology, security best practices and expertise not typically found in enterprise environments. According to Gartner, internal teams struggle to understand and combat the latest threats because they need to monitor systems constantly and remain up-to-date on all system vulnerabilities.1 Maintaining the necessary level of vigilance requires significant investments in staff, IT systems, and training. When companies choose to handle security management or monitoring in-house, they are often unsuccessful, for a variety of reasons. One reason for failure is that while the security staff commits to the tasks, they discover that they lack the time, expertise, and technical resources to provide effective, enterprise-wide monitoring and management on a 24x7 basis. Alternatively, enterprises may rely on security appliances alone. On their own, security appliances do not provide an adequate level of security protection, as evidenced by the 2002 CSI/FBI Computer Crime and Security Survey, which found that of the enterprises reporting security breaches, 90% had implemented firewalls and 60% had intrusion detection systems.2 True security monitoring can only be accomplished by combining advanced technology with expert human analysis. While enterprise security management vendors may provide correlation and data-mining products, the analysis of the data and corresponding response decisions produced by security experts are critical to preventing attacks. Some organizations use brute force methods, assigning security staff to manually review event logs. The reality is that it is impossible to manually examine millions of logs from disparate devices and locations, data-mine with specific queries to look for suspicious activity, and then cross-correlate the results to substantiate attack trends in real time. Managed Security Service Providers (MSSPs) can address these issues and help organizations gain an effective security posture. Yet many organizations are not certain what to look for when choosing an MSSP. The issue is clouded by the fact that most MSSPs provide ad-hoc management or monitoring of security devices and the definition of the services they offer varies from vendor to vendor. 4 Symantec DEMYSTIFYING THE MANAGED SECURITY SERVICE PROVIDER MARKET √ A closer look at management vs. monitoring Early managed security services focused on security device management – that is, the management and maintenance of security devices, such as firewalls, intrusion detection systems, servers, and routers. Due to the increased sophistication, number, and type of threats to the corporate network, these services are now being supplemented with monitoring that provides expert, real-time analysis of the data generated by security devices, to enable timely response to intrusions. √ What is security management? Security management requires skilled personnel who can manage security devices in the following three ways: • Fault management • Configuration management • Performance management FAULT MANAGEMENT entails the management of customers’ security devices to ensure that the devices function optimally at all times. This is usually, but not always, provided on a 24x7 basis. Fault management services typically include the following: - A regular “health check” of security devices to detect problems. - Notification to customers if a security device ceases to function for any reason, and guidance regarding appropriate measures to remediate the problem. - Periodic reports to customers summarizing the operational status of security devices over a specified period of time. CONFIGURATION MANAGEMENT assigns the configuration of a customer’s security devices to an MSSP. Configuration management typically includes the following features: - Security device application and operating system modifications and upgrades. - Policy and signature changes to the security device. - Daily, weekly, or monthly reports summarizing all new upgrades and modifications to customer security devices. PERFORMANCE MANAGEMENT involves the collection and presentation of performance statistics for a customer’s security devices. Content included in these reports often includes: - Statistics describing the speed and efficiency of a customer’s network. - Identification of network bottlenecks that hinder performance. - Consolidated performance reports that include all log data generated by a customer’s security devices. Most MSSPs provide one or more of these capabilities, but few address all three components. 5 Symantec DEMYSTIFYING THE MANAGED SECURITY SERVICE PROVIDER MARKET √ What is security monitoring? Security monitoring requires security expertise and a sophisticated architecture that helps analyze data across multiple devices across an entire global enterprise. Comprehensive monitoring services include the following capabilities: DATA COLLECTION AND NORMALIZATION – This is a process in which security device data (e.g., firewall logs, IDS alerts, etc.) is collected and transformed into a standardized format, regard- less of device type and brand. Data normalization is essential to effective security monitoring, as it enables MSSPs to use a standardized set of queries to mine security device data and isolate signs of malicious activity. DATA MINING – In this process, an automated system continuously queries security data to detect signs of malicious activity and separates suspicious network traffic from legitimate network traffic. This is probably the most critical technological element in the monitoring process. A customer must ensure that an MSSP has the ability to scale their data mining abilities as more devices are plugged into the backend architecture. In other words, the MSSP must be able to build sophisticated queries as new devices are added. More queries does not necessarily equate to better data mining. The quality of the existing queries and their continuous refinement, as well as the timely creation of new queries to root out ever-evolving malicious activity, is of paramount importance. Only with highly sophisticated data mining can an MSSP provide the most effective cross-correlation of attack data. AUTOMATED SECURITY EVENT CORRELATION – Another essential feature of an effective security monitoring service is correlation. This is the automated grouping of individual signs of malicious activity by logical criteria,