Mitigating Cyber Threats

Managed Security Services for Small to Medium Businesses

Xxx company White Paper Published November 2011-11-01

Address Phone, email, website

Managed Security Services For Small to Medium Businesses Authors Tharinda Lasika Company Name Date (Year and Month) Program if any Copyrights Warranty and Disclaimer .

With the rapid development of Internet Technologies and Emerging Architectures make this more and more difficult. No businesses can dwell without a coherent strategy and the existence and survival will be determined by new parameters like adequate technology and infrastructure which will assist companies for a smooth and flexible execution and growth. . The technological isolation (obsolete technologies) and delay of migration caused by the expenses or due to the financial status increase problems for economic growth. a number of companies have adopted many recent technologies including Virtualization. During the race for the bleeding edge technologies and rapid versioning. Today. The emergence of Managed Security Provider Services has successfully addressed the issue and recently many small and mid size business owners have agreed that this will heal the headaches they have experienced throughout these years. Small and Mid-Sized businesses play an important character of a nation s economic development. The better the infrastructure. the greater the impact of a company s technology investments on growth. especially developing countries and recent years it is the same for developed nations. the necessity of skilled people and the monitory value of high quality workers which will engage in deploying. With the development of these areas. The most interesting fact is that these businesses highly depend on Internet Technologies such as Internet Marketing and low cost Cyber Infrastructure. many organizations experience a variety of difficulties. The lack of quality workers due to their higher demand and salary requirements the Small and Mid-Sized businesses were opened to the cyber space with a severe problem related to The Information Security. The lack of skilled people. shortage of knowledge and capital. managing and maintaining the new/existing business infrastructure added more pressure to the existing strategy. managerial practises.Executive Summary Managing threats and maintaining the security and integrity of an infrastructure is becoming increasingly difficult for most organizations. Small and Medium sized businesses suffer from the issues more and more rather than enterprise level businesses. inadequate strategies for adapting technology vastly increased the security risks. The average growth rate is getting increasingly higher for the Small and Mid-Sized businesses. Cloud and Managed Service Providers (MSP) which will increase Revenues rapidly due to the cost.

Recent technologies such as Virtualization and Cloud Computing will improve many businesses and reduce a large quantity of resource requirements thus enabling the adaptation by small and mid-sized business units. Unfortunately. Managed Service Providers have become the dominant player to ensure the requirements. y y y y y Build a strong Niche More Control Flexible and Adapt changes faster Better communications Better collaboration Each of these areas has significantly improved with Information and Communication Technology. To maintain the integrity of the areas a more flexible and smooth infrastructure was required. many IT Professionals and even Systems Administrators do not have proper knowledge to secure the information and maintain the integrity while ensuring the confidentiality. Systems Engineers. Communication Engineers. knowledge and experience in all the fields. Today. The IT Professionals. Network Engineers and Security Engineers have to upgrade their knowledge time to time and this will increase the value of the individual which makes a serious Shortage of Skilled people for the small and mid-sized organizations.Small and Mid-sized Businesses Strengths Small and Mid-sized businesses are quite efficient and effective when compared to Large Organizations when considering several areas. they have to select a professional which has partial education. most of the small and mid-sized businesses rely on the MSPs. Rather than hiring individuals with necessary knowledge. Information Security Securing information is becoming more and more difficult with the emergence of numerous bleeding edge technologies and versioning. The knowledge does not come for free. .

Unauthorized Mail Flow. VDIs and many more application based services (CRM platforms. The Cloud (Amazon. They rely on Services Providers and External Hosts. Phishing. Mail Servers (Exchange Services) Confidentiality and Availability is critically important. Microsoft TMG has to be in place to ensure unauthorized access. SSL/TLS issues. Microsoft Small Business Server (SBS) and Application. Hosted Software Platforms (Office 365 etc) Security service is provided with the platform but needs to be optimized / customized in order to take the best out of it. Viruses. Integrity Violations. Amazon infrastructure provides the capability of hosting Open Source as well as Microsoft servers. If the Active Directory gets compromised. Amazon Cloud and VPC (Virtual Private Cloud). Citrix have introduced versatile platforms like v-Sphere. Office 365). a work force not only has extensive skills and capacity but also that have exposed to the latest technologies must be available. Database Injections. In addition to the security controls. Microsoft. DoS. Citrix Xen series. Azure etc) Microsoft Azure has a similar architecture to regular Microsoft architecture. Apache. DDOS. Azure. Solutions such as Microsoft SBS are becoming increasingly popular but these platforms come as a bundle which can be a Single Point of Failure. Pay-per-click scams and various other threats. Impersonations. Corruption. Application Virtualization. a specialized work force is required to deploy and maintain these technologies. This will reduce the cost but it does not address the security requirements. Cross site scripting security vulnerabilities become major killing force. Each platform has its pros and cons. DDOS. Cloud Services) Web servers are the systems which experience the highest number of security threats. Databases (SQL Server. Stage Corruptions and many others. To fulfil the requirement. Thin-Clients. Small businesses highly depend on these platforms and they must be able to protect these infrastructures from intruders thus maintaining the CIA (Confidentiality. Session Hijacking. Among those. MYSQL etc) Vulnerable to Database Injections. Mail servers have to be protected from Open Relays. Code Injections. RDS. Many Open Source systems have been developed in parallel. Scams. impersonation. Information Disclosure. Platforms and Services from a Security Perspective Microsoft Windows Active directory infrastructure Availability and Integrity is vitally important. Security systems such as Cisco firewalls. Domain Hijacking. Integrity and Availability). Farming malware. And most importantly. Web Servers (IIS. remote access to these systems must be . SSL/LTS issues. Spams. VPN services. Companies like VMWare (a host only). Management Platforms. the whole infrastructure operation will fail.Recent Technologies and the Role of Information Security Most of the Mid-sized businesses do not deploy a sophisticated infrastructure for ICT. and Server Virtualization such as Hyper-V. Microsoft VDI. Amazon.

Especially when considering the hardware requirements which can be expensive. Skills. A number of Virtualization services and platforms emerged during recent years. not only the hosted systems but also the Host (which is the cloud) has to be protected using the provided mechanisms. Technology specialists who have expertise in these areas are less in numbers and have higher expectation of salaries which will not be a good option for small scale and medium sized businesses. When considering these Technologies. Virtualization Virtualization era has made the life easier for many organizations. Special knowledge and experience required to manage and maintain such systems. .secured. CIA triad. Cost and Compliance Managed Security Services becomes an elegant option. When considering the cloud. Risk factor. Human factor.

Security Monitoring Monitoring 24x7 and ensuring the network and system Availability (protection from DoS and DDoS. Management. Teams and Forensics Incident Response. Content Filtering Services (data) and Archival Services including Remote corporate Backup and Archival Solutions. Network and System Audits. Standardised and Support for Compliance Demands due to Regulations of governments such as: o ITIL Best Practises o ISO Standards ISO 2700X standards for Information Security. Intrusion Prevention and Detection. monitoring Bandwidth issues. Filters and Corporate Protection suites). ISO 31000 o HIPAA / HITECH act o FFIEC o PCI DSS y y y y y y y y y y . Risk Assessment and Recovery Planning support. Anomalies and many more. There are still some risks involved when contracting with an outsourced service but it slows to share the responsibilities and risk management (divide and conquer approach). Emergency Response Procedures. Consultations On-site. Support for entire and geographically seperate networks. Reporting and Recovering. Capacity Planning and Upgrading. Botnets and other attacks). especially the services they offer. IDS/IPS. These specialities include: y Network Security and Protection. More and more organizations turning to MSSPs for many reasons. Network Boundary Protection (TMGs. Analyzing.Why Managed Security Services? MSS are Network and Server Security Services that have been outsourced to a service provider. Managed Service Providers under the category of Managed Security Service Providers (MSSP) offer these services and is often a good solution for transferring information security responsibility and operations. Corporate Antivirus Management. VPN. Network Penetration Testing and Vulnerability Assessment plans and strategic solutions. Firewalls.

security controls can be overwhelming for new businesses and who recently adapted new infrastructures. y y y y y . MSSPs are often well connected to law enforcement agencies around the world. Skills MSSPs hire qualified professionals and have a better insight into emerging threats and mitigation procedure due to the fact that the spreading of services and customer base. Shared Infrastructure Shared Networks. A Proper Initiation. Facilities Managed SOCs (Security Operations Control Centres). Relationship A proper relationship with the MSSP should be maintained. Risks involve with the process including: y Trust Sensitive information and Security infrastructure which will be accessed by and to made visible to the MSSPs can be a greater risk if the services provider is not ensuring protection from information leakage. ownership and its responsibilities with proper MSS utilization must exist. By using services from an MSSP. MSSPs offer Hardware. Consolidation Managing and Monitoring various devices and technologies. Work Force (Security Awareness) Recruiting. If the client and employees do not have security awareness to support the MSSPs processes. the potential risks due to obsolete and unmanaged systems. With infrastructures and customers spread around the globe. The services. MSSPs must ensure Service and Data Isolation for clients.Benefits y Cost Cost for MSSPs are lower than employing on-site work force. With MSSPs. migrations and upgrades must be analyzed prior to the contract.Information Security has to be a collaborative effort. Responsibility. This requires a Proper Evaluation Procedure. Hardware and other assets. Accountability and Auditability y y y y y y y Risks with MSS Relationships There can be risks involved with contracting MSSPs if it has not properly and strategically managed. un-patched and vulnerable systems can be mitigated due to the fact that service providers continuously Monitor and Assess their infrastructure. Maintain and Termination procedures must exist with the contract to mitigate any conflicts including security risks. A proper Service Level Agreements (SLAs) must be in place before disclosing the information and/or assets. Even though the MSSs manage the security. Compliance Addressing and absorbing regulations will be handled by MSSPs as required. servicing multiple clients will be a potential risk. Training and Re-training the security staff will cost more for organizations. This will ensure the security budget a constant value and avoid spikes. MSSPs are able to reduce costs by spreading the cost among numerous clients. clients never face Skill Shortage Issues due to the fact that they have professionals with knowledge in latest technologies. especially when MSSs has Multiple Tires and Subcontractors and a workforce around the globe. Hidden Costs There may be hidden costs exist behind the agreed services. there will be issues. Availability and Performance 24x7x365 services and regular optimizations. System and Software update services. Ownership and Collaboration .

Capabilities The MSSP has to address each technological requirement and has to agree to provide them timely and with confidence. QoS Architecture of the MSSP. The SLA describes the IT Service. Reporting and Privacy have to be evaluated. what services the network service provider will furnish. documents Service Level Targets. negotiated document that defines (or attempts to define) in quantitative (and perhaps qualitative) terms the service being offered to a Customer. Assets. Scalability and Clear view of Layers (services). A single SLA may cover multiple IT Services or multiple Customers. Software. usually in measurable terms.Evaluating a MSSP A properly detailed proposal is required prior to evaluate the service provider. Upgrades and Migrations MSSPs have to have packages which will suite customers according to their requirements as well as according to laws and regulations. Confusion must be avoided over whether the quantitative definitions constitute thresholds for an   . Assets. Workforce. [ITIL v2. and specifies the responsibilities of the IT Service Provider and the Customer. Disaster Recovery Strategy Clear Disaster Recovery Procedures. v3] Service Level Agreement (SLA) (ITILv2): A formal. Quality of Professionals. Many Internet service providers (ISP)s provide their customers with an SLA. IS departments in major enterprises have adopted the idea. Quality of Auditing. More recently. Trusted Third-party (tired) Contractors If MSSPs maintain several tires and third party contactor. nowledge and Experience Proven quality and proficiency of the professionals have to be included. Financial Status A MSSP has to be financially strong in order to survive on a disaster situation. [TECHTARGET 01] Service Level Agreement (SLA) (ITILv3): An Agreement between an IT Service Provider and a Customer. there has to be a procedure to perform checks on their background as well. This proposal from MSSPs must address all the requirements and provide these details including: y y y y y y y y Reputation A MSSP must have proper reputation and it has to be visible to public. Tools. Hardware. Strategy A clear operation and support strategy and incident management. Clients and Referrals A list of contact of current clients have to be available to new clients. Availability. y y SLA (Service Level Agreement) A service-level agreement (SLA) is a contract between a network service provider and a customer that specifies.

. SLAs should be renegotiated whenever a business service is subject to a change of requirement or there is an inability to deliver to requirement. restrictions. v3] SLA must be carefully examined before the contract. [ITIL v2. Typically it will cover: service hours. It must cover each and every aspect of the service which will be provided by MSSPs. throughputs and responsiveness. functionality and the service levels to be provided in a contingency. targets to which the supplier should aspire or expectations that the supplier would strive to exceed.acceptable service. Apart from regular periodic reviews. charges and terminology. Any metrics included in a Service Level Agreement (SLA) should be capable of being measured on a regular basis and the SLA should record by whom. Customer support levels. service availability. It may also include information on security.

It has many challenges. maintain and optimize Information Security. For many large organizations this can be an option but for small and medium sized businesses MSS have become a main component. Giants like IBM. With proper initiation and relationship management (lifecycle of the services) MSSs can become a lifesaver. It is a highly profitable area and a life time opportunity to reach the world and to become an owner of a world class firm. with recent innovations in ICT. Today many small and midsized businesses benefit from such services. Public Sector and many others. nothing is way beyond the available resources. Health Services. Not just the profit but the sensitive information leakages can be mitigates successfully. There are many cost effective solutions and reliable service providers available to choose from. has to deal with many areas such as Financial Services. Starting an MSS firm is a perfect idea according to the market researches.Why MSS is a Perfect Solution for Small and Mid-sized Businesses y y y y y y y y y y y y y Extensive usage of Cyber Resources and Integration of IT Capability of reaching Higher Performance and QoS expectations Sustainability Regular Unmanaged Security Threats Extensive Financial Benefits Flexibility to Address and Adapt Marketing Changes Address Scalability requirements with readily available assets and technologies Readily Available Solutions and Packages No additional Time Consumption and Effort Tend to use Outsourcing regularly No additional crew or training cost 24x7 Operations Collaborative effort Managed Security Services are becoming a one of the best options to manage. but. AT&T are already providing a quality services in terms of security as Manages Security Service Providers. Manufacturing Services. .

Many Small to Medium organizations nowadays integrate MSSs without a doubt and thanks to many service providers they survive in the wild cyberspace. This is why MSSs become a lifesaver. Information leakage and financial disruption due to information security reasons can be mitigates from a collaborative effort with a MSSP. searching and exploiting weaknesses of large competitors and most importantly closing the information security gaps will reduce the pressure and make the business more improved. It is a main part of the business strategy which will tie the unequal business components (departments as an example) together to perform an efficient and effective function. The Information Security is some mouse clicks away. With less human work force. less operation time. But with a proper ICT strategy absorbed into the business process and a high tech infrastructure. Confidentiality and Availability. But these technologies and automations will be effective and efficient if and only if they keep the Integrity. Many highest rated and well reputed Medium to Large scale MSSPs with quality services available around the globe. Many Small and Medium scaled businesses face a huge pressure from large competitors. With a properly maintained relationship with a MSSP will ensure the business profits as well as uptime and proper functionality. It s the time for a new change! . That has become the most difficult issue to be addresses with recent cyber threats and system vulnerabilities and cost involved with securing business infrastructures. With MSSs this is not a dream any more. MSSs will guarantee the Integrity and Availability so the organizations can integrate more and more IT components to the business and to keep conquering the world further via the cyber space. While ICT fuels the ongoing business. ICT is one of the main forces that are strengthening each department thus reducing many costs involved in the entire process which will enable organizations to reach the expected profits without much hassle. the work load and the needed net effort is reduced extensively for business owners.Conclusion ICT has become a main component of the business process of Small to Medium Businesses and plays a vitally important role. integrated technologies and components functioning 24x7.

net/dictionary/ITIL/en/Service_Level_Agreement.techtarget.com/definition/service-level-agreement ITIL SLA (v2.References: TechTarget: http://searchitchannel. v3) http://www.htm Company Details go here .knowledgetransfer.

Sign up to vote on this title
UsefulNot useful