Managed Security Services

Managed Security Provider —continued

Service reach and flexibility
Look for an MSP who offers what you need today, but ask about migration for services you expect to need in the future. If you buy a managed firewall service today, will you need an additional or different platform to add secure remote access? Does the MSP offer integrated provisioning, monitoring, and billing that encompasses every service you've purchased? Make sure your MSP lets you leverage your investment in multiple services. You may not own the CPE, but you still want a cohesive solution that efficiently implements your security policy.

When managed security services are sold by network access providers, it is easy to overlook the obvious: are you purchasing a service that's ISP-dependent? If so, is that acceptable? Consider roaming users that require national or international access. Where are your MSP's points-of-presence? Has your MSP joined a roaming alliance like GRIC or IPass? Can your managed site-to-site VPN include international branch offices? What is the impact of doing so on cost and performance?

Drill down to uncover integration issues. What authentication methods are supported, and can they be integrated with your own user database or authentication server? What constraints are imposed on IP addressing, and will you be required to renumber? Ideally, you'd like a managed service that adapts to your business, not one that requires you to adapt to it.

Will your MSP also supply, install, and support client software? If you can avoid client software, great. If you can't, find an MSP who provides a user-level help desk and takes steps to simplify client software deployment and configuration (e.g., PC "prep" tools, automated policy download). How are new users added to your security policy? Make sure your MSP's policy management system provides sufficient granularity, augmented by grouping to reduce churn and improve scalability.

Some providers back up performance targets with service level agreements (SLAs). SLAs can identify aggregate throughput, latency, and availability characteristics, describe how these are measured, and define penalties for non-compliance. Many ISPs offer SLAs for core network performance; SLAs covering end-to-end managed security are less common. Money-back guarantees (usually in the form of service credit) may not offset lost revenue during a prolonged outage, but can signal whether your MSP actively works to meet performance expectations.

MSPs provide monthly reports that let you see how your security policy is being enforced. Ask for a sample report: does it include incident logs, port scan results, network performance and usage stats, change request history? Look for real-time monitoring and on-going security advisories that keep your staff informed so they can pro-actively refine policies and safeguard assets.

One can think of an MSP as a highly-specialized Application Service Provider (ASP). As such, you should expect an MSP to employ the same—or better—in-house security practices you'd expect from any ASP. Ian Poynter and Dianna Kelley offered excellent advice on this topic in their Insight column, "Ten Things To Ask Your ASP" (http://tisc.corecom.com/newsletters/29.html). Among the questions they recommend asking: Is your ASP's facility physically secure? Has the ASP's architecture and code been independently reviewed? What is the ASP's disaster recovery plan? How does the ASP safeguard your information from other customers and its own employees? Make sure that, while your MSP is guarding customer networks, it doesn't leave a NOC "back door" open to attack.

Conclusion
Fortune 500 companies who already outsource IT operations may look to these existing outsourcers for integrated network security services. Similarly, business-grade network service providers like Sprint and MCI/WorldCom may be the first place their subscribers will look to "add" outsourced security. But, as a Forrester Research brief suggests, companies should also consider MSPs like ISS eServices that specialize in security: "Look to suppliers that have a strong track record [and] live or die on the business." Finding the right MSP isn't simple, but knowing what questions to ask can help get you started.

Back to Page 1

—End

 

Related article:
	[Dec. 9, 1999]	Managed Security Services: A Primer