Can Managing Enterprise Security Be Made Easier?

Transcription

1 Symantec Global Services Can Managing Enterprise Security Be Made Easier? Who should read this guide: CSOs, CISOs, managers, compliance officers, heads of security, CIOs, and project managers faced with the challenge of managing enterprise security Advice offered about: Common hurdles when managing enterprise security in-house Benefits of partnering with a Managed Security Service Provider (MSSP) for security protection Sample expenses and cost comparison scenarios Evaluating potential MSSPs Confidence in a connected world.

2 We tried to provide this level of security on our own. We had two full-time employees looking at our own IDS sensors at one point. But trying to maintain signatures and updates while continually inspecting and correlating events from the logs was becoming quite a feat. Network engineer

3 Can Managing Enterprise Security Be Made Easier? Considerations for Partnering with a Managed Security Services Provider for Security Protection Contents Introduction...5 Considering the security management options...5 Who should read this guide?....6 What you will get from reading this guide second insight one minute to see how Symantec Managed Security Services can improve your security posture....7 The threat landscape continues to evolve...8 Cyber-criminals continue to exploit trusted environments...8 Rise in site-specific vulnerabilities....9 Common hurdles when managing enterprise security in-house Measuring the cost of managing security in-house Equipment...13 Hardware and software costs...13 Maintenance...13 Certifications and attestations...14 Personnel...14 Recruiting...14 Training and education...15 Security operations center...15 Benefits of managed security services Improve information protection...16 Leverage knowledge and experience of security experts Stay abreast of the most recent security threats and attacks Share responsibility with a trusted security partner...17 Consistent SLAs across the organization

4 Contents, cont'd Gain reliable 24x7x365 security management...17 Concentrate on what you do best Maximize investment on existing security products Make project and running costs more predictable Continuous improvement...18 Selecting a managed security services provider Breadth of supported technologies...19 Security management processes...19 Auditing Effectiveness of technology...20 Reporting Security operations center capabilities...20 Recommended MSSP checklist Symantec Global Services Conclusion Symantec Global Services...22 Symantec Managed Security Services...22 Symantec Residency Services Symantec Advisory Services...23 Symantec DeepSight Early Warning Services...24 Free 30-day trial service...24 Symantec Managed Solutions To find out more...24

5 Introduction Effective information security helps maintain the integrity of valuable corporate assets, enables compliance with industry regulations, and helps ensure the integrity of a trusted brand image and sustain business continuity. But providing an effective level of security requires a combination of state-of-the-art technology, experienced personnel, proven processes, and continuous threat intelligence that few organizations possess. Those organizations that choose to tackle these critical issues in-house invariably find themselves struggling to identify security events, provide security event alerts, and respond to the threats. Specifically, the challenge is how to quickly identify which assets are at risk, determine the impact of security breaches, and prioritize incident response within the company. In order to make good decisions and protect information assets, companies must have the resources to understand what is happening both inside and outside the corporate network. Without a sound security strategy, our organization would likely be out of business. Director of technology Security technologies including firewalls, network and host intrusion detection, and prevention systems have created a tremendous volume of information, and handling that information only makes a company s security problems more challenging. As a result, many organizations that currently manage security in-house are looking for alternatives. These organizations often find themselves choosing between two options: managing security in-house, or outsourcing either all or some security management to a managed security services provider (MSSP). To ensure rapid response to real threats, MSSPs use high-availability security operations centers (SOCs) to provide outsourced management and monitoring of security devices and events. These centers support 24x7 services designed to reduce the number of operational security personnel an enterprise must hire, train, and retain in order to maintain an acceptable security posture. Considering the security management options It is essential that organizations weigh the risk of sharing their data with third parties against that of losing intellectual property and productivity as a result of malicious activity. Only robust, round-the-clock security management and monitoring can help mitigate the risk of threats against an enterprise network. However, the wide range of MSSPs and their offerings can prove daunting to compare and understand. We commissioned this guide to help organizations weigh their security management options. Grant Geyer Vice President, Symantec Managed Security Services 5

6 Who should read this guide? CSOs, CISOs, managers, compliance officers, heads of security, CIOs, and project managers faced with the challenge of managing enterprise security. This can include mail security; compliance; IT risk; and the monitoring, identification, and remediation of security incidents and events. What you will get from reading this guide An understanding of the changing threat landscape and common hurdles you face when managing enterprise security in-house The benefits of partnering with a MSSP for security protection Sample expenses and cost comparison scenarios to help you produce a financial analysis when considering a MSSP Useful guidance for evaluating potential MSSPs 6

7 60-second insight one minute to see how Symantec Managed Security Services can improve your security posture Benefit from extensive global threat intelligence Symantec Managed Security Services has access to some of the most comprehensive sources of Internet threat data in the world. Leveraging the Symantec Global Intelligence Network, managed services teams are thoroughly informed on world events, which accelerates the decision-making process to protect your critical assets. Avoid the impact of a missed security event. Leverage security expertise for 24x7 monitoring, alerting on suspicious incidents, and delivery of timely, prioritized remediation recommendations. Symantec Managed Security Services security analysts and security operations center (SOC) technology help keep your business assets safe from compromise. Find the needle in the haystack Symantec Managed Security Services technology and security analysts look for small pieces of separate information in gigabytes of log files across multiple devices, and then recognize which pieces, when put together, indicate a threat. Symantec has built in-house technology to filter all customer information and present events to analysts for further investigation. Support for your audit requirements Symantec Managed Security Services globally maintain the stringent audit requirements of the ISO certification and SAS70 Type II Audit Report, and include certifications for both business continuity planning and disaster recovery. Our mature approach to governance will ensure that an incident or disaster in one region will not affect the support you receive or compromise the integrity of your business. 7

8 The threat landscape continues to evolve It would be costprohibitive to try to cover this ground on our own. Director of technology On April 8, 2008, Symantec released Volume XIII of the industry-leading Global Internet Security Threat Report (ISTR). In the report, Symantec concludes that cyber-criminals are becoming increasingly professional even commercial in the development, distribution, and use of malicious code and services. While cyber-crime continues to be driven by financial gain, cyber-criminals are now using more professional attack methods, tools, and strategies to conduct malicious activity. Based on the data collected during this timeframe of July 1 December 31, 2007, Symantec has observed that the current security threat landscape is predominantly characterized by the following: Malicious activity has become Web-based. Attackers are targeting end users instead of computers. The underground economy is becoming consolidated and mature. Attackers and attack activity are adapting rapidly. Cyber-criminals continue to exploit trusted environments During the reporting period, Symantec has observed that the majority of effective malicious activity has become Web-based: the Web is now the primary conduit for attack activity. This may be driven, in part, by the fact that compromises affecting computers on enterprise networks are likely to be discovered and shut down. On the other hand, activity that takes place on end users computers and/or Web sites is less likely to be detected. Symantec observed that 58% of all vulnerabilities disclosed were in Web applications. Once a trusted Web site has been compromised, cyber-criminals use it as a source for distribution of malicious programs in order to compromise individual computers. This attack method allows cyber-criminals to wait for their victims to come to them instead of needing to actively seek out targets. Social networking Web sites are increasingly valuable to attackers because they provide access to a large number of people, many of whom trust the site and its security. These Web sites can also expose a great deal of confidential user information that can then be used in attempts to conduct identity theft or online fraud. An added benefit to attackers who target trusted sites is the ability to steal credentials or launch other attacks en masse because these tactics can allow attacks to propagate quickly through a victim s social network. 8

9 Table 1. Personal information that can be used for financial gain is traded on underground economy servers. This table ranks goods most frequently offered for sale. Rank Item Percentage Range of prices 1 Bank accounts 22% $0.40 $20 2 Credit cards 13% $10 $ Full identities 9% $1 $15 4 Online auction accounts 7% $1 $8 5 Scams 7% $2.50/week $50/week for hosting. $25 for design 6 Mailers 6% $1 $10 7 addresses 5% $0.83/MB $10/MB 8 passwords 5% $4 $30 9 Drop (requests or offers) 5% 10% 50% of total drop amount 10 Proxies 5% $1.50 $30 In the second half of 2007, 499,811 new malicious code threats were reported to Symantec a 136% increase over the first half of Rise in site-specific vulnerabilities Site-specific vulnerabilities are perhaps the most telling indication of this trend. These are vulnerabilities that affect custom or proprietary Web-application code for a specific Web site. During the last six months of 2007, 11,253 site-specific cross-site scripting vulnerabilities were documented. This is considerably higher than the 2,134 traditional vulnerabilities documented by Symantec during this same period. These vulnerabilities are a concern because they allow attackers to compromise specific Web sites that they can then use as a means of launching subsequent attacks against users which has shown to be an effective strategy for launching multi-stage attacks and exploiting client-side vulnerabilities. Site-specific vulnerabilities are often used in association with browser plug-in vulnerabilities, which are useful for conducting sophisticated Web-based attacks. Another indication of the Web s emergence as an attack vector is the continued growth in browser plug-in vulnerabilities. Browser plug-ins are technologies that run inside the Web browser and extend the browser s features, such as those that allow additional multimedia content from Web pages to be rendered in the browser ActiveX, for example. These vulnerabilities have remained popular because they are a very effective means of conducting Web-based attacks. 9

10 Table 2. Symantec Internet Security Threat Report data sources Symantec uses multiple data sources to compile the Internet Security Threat Report, including: More than 40,000 sensors that monitor network activity in more than 180 countries Reports on malicious code, spyware, and adware from more than 120 million systems that have deployed Symantec virus protection products A security vulnerability database spanning more than a decade that covers more than 25,000 vulnerabilities from more than 8,000 vendors BugTraq; a forum for the disclosure and discussion of vulnerabilities, with approximately 50,000 direct subscribers The Symantec Probe Network: a system of more than two million decoy accounts that attracts messages from 30 different countries around the world, allowing Symantec to gauge global spam and phishing activity Figure 1. This chart shows malicious code trends. In the second half of 2007, 499,811 new malicious code threats were reported to Symantec. This is a 136% increase over the first half of , , ,811 Number of new threats 450, , , , , , , , ,000 50, ,260 Jul Dec ,138 Jan Jun ,475 Jul Dec ,451 Jan Jun ,523 Jul Dec ,226 Jan Jun ,410 Jul Dec ,761 Jan Jun ,482 Jul Dec 2006 Jan Jun 2007 Jul Dec 2007 Period 10

11 Common hurdles when managing enterprise security in-house With customers and business partners dependent on accessing critical product and service data via open networks such as the Internet, organizations must ensure the integrity of this information or risk jeopardizing their reputation and their brand equity. In short, they need to protect the bottom line, the corporate image, and the brand. Organizations face a number of barriers to achieving and maintaining effective security programs, including those listed in table 3. Hiring more staff for a 24x7 immediate response team would have greatly increased our staffing costs. Group leader Table 3. Barriers to achieving and maintaining effective security programs Security a core requirement, but not a core competence Need to find, hire, and retain security staff Security staff overloaded with routine daily operations Need to develop a repeatable process for identifying and escalating security incidents Security products generating vast amounts of difficult-tomanage data Companies focusing on ecommerce and ebusiness must ensure that their information assets are properly protected. Managing information security requires constant vigilance and strict accountability for every change in the state of the network and systems connected to it. Organizations often find they lack the necessary in-house skills to manage this challenging task. Because of the strong market demand for skilled information security talent, organizations are finding it expensive to recruit and extremely difficult to retain these professionals. A large amount of time can be absorbed by the constant juggling of resources, resume sifting, interviews, contracts, and attrition. The high attrition rate among security personnel reduces a company s ability to effectively safeguard its valuable information assets. While the security staff commits to the tasks, they often discover that they lack time, expertise, and technical resources to provide effective, enterprise-wide monitoring and management on a 24x7x365 basis. Trying to determine what constitutes a security incident can be difficult. Traffic that looks benign to the untrained eye can be highly malicious when correlated with other security information. Understanding how to develop a repeatable process that can be quickly and consistently executed can be daunting for many organizations, especially when there is a low margin for error. In order to adequately protect corporate information assets on a 24x7x365 basis, and to identify and counteract security attacks in real time, information security staff must constantly analyze disparate data from various security devices, such as firewalls and intrusion detection systems (IDSs). Security staff can attempt to consolidate this data for viewing purposes, but most consolidation software tools lack the ability to generate meaningful information. Symantec finds that 99.7% of data produced by security devices is of little to no value in finding security incidents; moreover, such data is often laden with false positives. Finding the real security threats in this overwhelming volume of data can be like finding the proverbial needle in a haystack. 11

12 Finding the real security threats in this overwhelming volume of data can be like finding a needle in a haystack. Table 3, cont'd Growing volatility and sophistication of threats Proactive intelligence Cost-effective security protection on a 24x7 basis The threat landscape has evolved away from large-scale pandemic threats to quieter, more targeted attacks engineered to include multiple exploitation methods. These lower-profile, targeted attacks are engineered by cyber-criminals searching for new ways to steal information for financial gain. The attacks propagate more slowly to avoid detection and to increase the likelihood of successful compromise before security measures can be put in place. The new Internet threat reality is clear: Fraudsters and hackers are working in concert for financial gain and they are relying increasingly on the Internet. Setting up a security operations center in-house can be an expensive and cumbersome task, and many organizations that do so still aren t aware of emerging Internet threats and vulnerabilities. Organizations that don t stay abreast of new threats are on their own on the Internet. They are left to react to new challenges as opposed to being proactively protected. Increased regulatory demands for business continuity coupled with a thrust for availability of systems to clients and partners is driving a requirement for cost-effective security protection on a 24x7x365 basis. The cost of building and staffing an SOC is daunting; it involves hiring 24x7x365 staff, implementing and tuning security information and event management (SIEM) technology, establishing processes, and managing the function. Furthermore, there is a high cost of entry just to have an in-house security management capability, regardless of the size of the security architecture being managed. 12

13 Measuring the cost of managing security in-house To build, upgrade, maintain, operate, and control its security systems, any in-house security management program needs personnel and supporting hardware, software, and equipment. These in-house programs also require outlay for the following variables: All relevant capital and operating costs Costs of supervising the MSSP Likely increases in costs for salaries, benefits and service contracts The cost of money and interest costs Residual value of equipment and facilities Cost of transition, including personnel Cost of changes in direction and level of resources Cost of contract modifications If our network is down because of a security incident, or for any other reason, we calculate that our organization would lose a million dollars of revenue a day. Director of technology To effectively compute the total cost of ownership of in-house security management, companies need to identify and evaluate both overt and hidden costs over a number of years. The following sections list many of the costs of a security management program. Equipment Hardware and software costs For in-house security management, companies must determine the cost of all hardware and software in addition to associated maintenance and support costs. This includes servers, PCs, and peripheral equipment, as well as all associated operating systems, databases, applications, and security software. Additional hardware and software required to support security operations may include system and network management tools, fault management systems, help desk systems, and correlation technology. While the software alone is expensive, to work effectively, the organization will also need to integrate and customize the software for their environment. These costs may be several times the cost of the software to be effective. Maintenance Maintenance fees for software and equipment must be factored into the total cost of ownership. Software maintenance is typically assessed on an annual basis at a rate of 15 to 25 percent of the cost of the software. 13

14 In each country where we have deployed managed security services, our company is saving on employing full time equivalent (FTE) staff. Altogether, we have been able to re- allocate roles for 10 staff in EMEA, which is equivalent to a savings of almost $1.2 million every year. European IT security head Certifications and attestations In order to show the effectiveness of the security program as well as to stay compliant with industry regulations, the environment will need to be audited. While many SOCs are becoming compliant with the ISO17799 or ISO27001 standard, they will also need to be included in Sarbanes Oxley, MiFID, or Basel II audits. While these certifications themselves are quite difficult to obtain and ongoing maintenance is required, the real challenge is to develop all of the processes needed to run the operation on a day-to-day basis and to ensure that it is effective and integrated within the overall information security and information technology program. Personnel Staffing for information security professionals is perhaps the most crucial, difficult, and costly component of an effective security management program. While the salary of individual contributors may vary from $60,000 to $140,000 (averaging $85,000 to $90,000) based upon experience and skill, this is only a small part of their compensation. After bonuses and stock incentives, space and equipment costs, and the cost of ongoing education and training benefits are added in, these numbers may be over 50 percent higher. The following scenario can aid in calculating the costs to expand security operations from standard 8am-to-5pm to full 24x7 coverage. To provide coverage 365 days per year, a company must consider staffing multiple shifts of workers: Three sets of staff to cover three eight-hour shifts One backup for time-off coverage for shifts 1, 2, and 3 One manager Based on these assumptions, a company would need a minimum of five people to cover one seat in a 24x7 security operation and these five would need to possess expertise or specialization in a range of security issues. Recruiting Given the high turnover rate in the IT field, organizations may also need to consider the cost of recruiting. Whether internal HR staff or external recruiters are used, the cost of recruiting may average 20 to 30 percent of total annual compensation costs for the position being recruited. 14

15 Training and education Security professionals require continuous training and education to hone their skills and, more importantly, to stay aware of the latest updates in an ever-changing, fast-paced technology environment. Ongoing education should encompass the latest security tools and technologies, threat techniques, and best-practice protection strategies. Costs in this area may include: Product or technology training Training in general security awareness Certification preparation classes Certification costs Attendance at major security conferences or shows Books, magazine subscriptions, journals, or elearning courses to help security professionals stay abreast of the latest technologies, tips, techniques, threats, and safeguards in the industry Many organizations provide their personnel with two weeks of employee training each year, though more is often necessary. Most security courses are one week in duration; therefore, each security employee would be eligible to attend two security courses per year. Because course expenditures may range from $1000 to $3000, an average cost per headcount for annual training would be $5000. Security operations center An SOC provides a secure work environment. Typically this area needs to be physically separated from the rest of the facility, requiring strong authentication to enter. Most companies find it cost-prohibitive to build or lease an SOC because the cost can exceed $10 million (USD) in capital expenditures. Organizations also need to consider the need for power, HVAC, and fire suppression systems for their SOC. In addition, a disaster recovery plan that would likely involve the build-out of a failover facility should be taken into account. However, to build a full end-to-end SOC as a business, MSSPs invest between $25 million and $40 million (USD) for the required robust infrastructure, tools, and redundancy. Companies that choose to work with a MSSP benefit from these significant investments as well as the expertise of trusting their business to security experts. 15

16 Benefits of managed security services The bottom line is that we can react in real-time to any security threats that take place, while keeping our security management costs in check. Head of IT security Beyond pure cost, there are a number of advantages an organization receives from a professionally managed service contract with a team of dedicated, experienced security professionals. Partnering with an experienced, well-established, and professional MSSP offers enhanced levels of protection, 24x7x365 vigilance, a strengthened security posture, and a potential decrease in the risk of cyber-threats. Improve information protection Providing security for today s networks and information systems is an increasingly complex and critical endeavor, especially as hackers are using increasingly sophisticated methods and technologies. Organizations whose core focus is not security are at a disadvantage in providing a comprehensive, 24x7 security management program. The training, expertise, and diligence required to stay abreast of the latest protection strategies is time-consuming for in-house staff and distracts from other mission-critical activities. Additionally, the vast amounts of data produced by firewalls and intrusion detection system devices can quickly overwhelm an organization that lacks the sophisticated technology to help its security staff with the daunting task of filtering through the data to find the real threats and eliminate the false positives. Leverage knowledge and experience of security experts According to Gartner s April 2007 report MarketScope for Managed Security Services in Europe, client discussions consistently say that the skilled resources of providers are one of the major benefits of using MSSPs. Organizations can take advantage of the expertise of MSSP security analysts and engineers who manage and monitor security devices on a full-time basis. These analysts identify and respond to thousands of security incidents and attacks every day. This means that, compared to an organization s in-house security staff, they are more aware of potential threats and are more knowledgeable about best practices for protecting critical data. 16

17 Stay abreast of the most recent security threats and attacks An experienced MSSP maintains a research capability dedicated to staying abreast of the latest cyber-threats, vulnerabilities, hacker techniques, and security developments. Constant monitoring of security alerts and advisories is essential to providing maximum protection against security threats. Share responsibility with a trusted security partner A MSSP acts as the company s security partner and shares the burden and the responsibility of security management and incident response. Partnering with a MSSP removes the burden of constant device monitoring and management, enabling organizations to direct in-house resources toward only the most pressing security issues and vulnerabilities. Consistent SLAs across the organization MSSPs offer service-level agreements (SLAs) that define a contractual obligation to deliver services in a particular manner and within a specific response-time window. The SLAs determine the services the MSSP will provide and the performance targets they must achieve, and they define exactly what will be delivered and when specific organizational requirements will be met. Gain reliable 24x7x365 security management A thorough MSSP will provide around-the-clock coverage for a client s most critical systems, monitoring networks and infrastructures to ensure protection during the hours most hackers attack. This vigilance, especially important in an always-on, always-connected business environment, ensures that information assets are protected. Concentrate on what you do best Resource-constrained IT departments must support the company s core business and security requirements. In an ideal world, talented in-house IT resources would be leveraged to plan network redesigns and migrations in order to support strategic business initiatives, or to implement new applications that focus on areas of greater return-on-investment (ROI) potential. Many elements of security, such as compliance and antivirus, can be very labor-intensive and subject to human error. Partnering with a MSSP removes the burden of constant device monitoring and management. This enables organizations to direct in-house resources toward only the most pressing security issues and vulnerabilities. 17

18 Maximize investment on existing security products Many organizations purchase security products that, for a variety of reasons, are never fully implemented. A high-quality MSSP ensures that purchased solutions are installed, implemented, and integrated to provide the ongoing value an organization needs and expects. Make project and running costs more predictable By partnering with a MSSP to protect critical information assets, organizations can avoid the extensive personnel costs associated with hiring, training, and retaining security professionals. Managed security services reduce total cost of ownership by delivering predictable monthly costs for security coverage. Because managed services are billed on a monthly basis, organizations are also better able to predict and manage their security-related budgets. Continuous improvement By tapping into the expertise of a company comprised of literally thousands of security experts working in the field every day, you will always be at the forefront of security knowledge and expertise. 18

19 Selecting a managed security services provider Determining the cost of partnering with a managed security services provider is only one, limited criterion in the overall evaluation of MSSPs. Organizations should also consider the following key factors: Longevity Consider partnering with a stable vendor that has a proven track record of delivering quality services to a large number of clients over a long period of time. These are the MSSPs most likely to weather economic downturns or industry shakeouts. Annual revenues For publicly traded companies, according to Gartner, annual run rates of more than $10 million per year in managed security services contracts indicate a sufficient base of revenue to support growth and enhancement of services. Management experience A successful MSSP selects its security experts from a range of backgrounds, including the military, government, and industrial sectors. Appropriate management experience is usually represented as well, from a variety of related services such as online, financial, and service bureaus. Range and flexibility of the services The range of services offered indicates the MSSP s ability to meet evolving security management needs of a wide variety of organizations. Leading MSSPs will offer a complete set of managed and consulting security services, either organically or through partnerships. Services should include managed mail security; managed firewall; managed intrusion detection system; threat and vulnerability management; security intelligence services; and monitoring, remediation, and reporting tools. Ideally, the MSSP will offer multiple levels and types of services, as well as customized services to meet the unique organizational requirements of each client. The managed security service (MSS) market in North America generated revenue of approximately $500 million in 2006, and Gartner estimates that revenue will grow about 19% in Gartner, Magic Quadrant for MSSPs, North America, 1H07 1 Breadth of supported technologies Evaluating a MSSP on its ability to provide broad support for multiple technologies is essential to ensuring a smooth and effective managed security program. Some MSSPs will only manage certain security technologies; others will provide comprehensive multivendor support. Security management processes A MSSP should be able to provide documented standards and policies for handling both typical and atypical operations and threats. It should also offer a variety of attack alert notification methods to give the client s security staff the ability to mitigate risk in real time. A MSSP should facilitate the incident response phase, integrating the capabilities of the client incident response team (IRT) with the MSSP alerting process. This requires a pre-defined and shared incident response roadmap. 1 Gartner RAS Core Research Note G , Kelly M. Kavanagh, John Pescatore, 1 August 2007 RA4 8/4/2008. The Magic Quadrant is copyrighted 2006 by Gartner, Inc. and is reused with permission. The Magic Quadrant is a graphical representation of a marketplace at and for a specific time period. It depicts Gartner's analysis of how certain vendors measure against criteria for that marketplace, as defined by Gartner. Gartner does not endorse any vendor, product, or service depicted in the Magic Quadrant, and does not advise technology users to select only those vendors placed in the "Leaders" quadrant. The Magic Quadrant is intended solely as a research tool, and is not meant to be a specific guide to action. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. 19

20 Determining the cost of partnering with a MSSP is only one, limited criterion in the overall evaluation. Auditing Companies are being held to a higher standard of accountability with respect to audit requirements. As an extension of the organization, a MSSP must have facilities, processes, and procedures that are validated and certified by a third-party auditor in the form of an ISO27001 and/or SAS70 Type II audit. Effectiveness of technology The technology used to analyze and correlate data collected from multiple devices should support rapid response while ensuring the scalability to support an ever-increasing number of managed devices. So that clients can focus their security staff on the most critical issues, the technology should be supported by security analysts who can separate real threats from false ones. Reporting Reporting can provide an enterprise-wide, real-time view into the client s security posture and the effectiveness of the managed services. Thorough reports will include detailed information gathered from the managed devices, from the related or recommended responses, from any changes the MSSP has made to the devices, and from information about the latest threats. Ideally, the MSSP will provide options for viewing and managing reports, including access via , standard desktop programs, and a secure Web portal. Security operations center capabilities A MSSP will need to operate multiple security operations centers from which it can globally monitor and manage security issues across its client base. In today s business environment, these centers must be run 24x7x365. This is not only to remain abreast of the latest threats, but also to ensure business continuity. The centers must follow predictable and proven processes and be staffed with a range of security experts that extend the client s in-house capabilities. Strict hiring guidelines must ensure that hackers are not entrusted with the sensitive security data of an enterprise. 20

21 Recommended MSSP checklist Real-time monitoring, analysis, and incident response Security is core business Demonstrated long-term financial stability Global online community providing insight and intelligence Uses proven managed security services policies, standards, and procedures Recruited and trained professional security staff Real-time view through flexible client interface Defined staff development and career path Background checks to verify staff trustworthiness 24x7x365 manned global operations Multiple, redundant SOCs with disaster recovery and global coverage In-depth technical and security support skills Dedicated threat and vulnerability research support Dedicated team per client Services support multiple vendors products Can implement security products Security and financial risks accepted under contract Defined metrics and accountability Incident-handling and response capability 21

22 Symantec Global Services Thanks to the way that Symantec Managed Security Services filters threats, we only have to respond personally to one or two attacks a month, compared to up to 60 with our previous security vendor. Manager of information technology and security Conclusion Effective security management requires a comprehensive combination of skilled personnel, best practice processes, and state-of-the-art technology. Each organization will come to a different conclusion about whether to manage their security requirements in-house, partner with a MSSP, or decide on a combination of both. A thorough cost analysis is important when evaluating a MSSP, but it comprises only part of the total analysis. Levels of staffing, security expertise, specialized skills that may only exist in-house, and existing security investments are other important considerations. Deciding between leveraging in-house security resources and partnering with a MSSP requires research and budgetary scrutiny. It also requires consideration of both the short- and long-term expenses and benefits. Ultimately, you should choose the option that will allow you to maintain a strong security posture that enables you to pursue your primary mission, whether that is a revenue-generating or service opportunity. Symantec Global Services With nearly 4,000 professionals and an extensive partner network, Symantec Global Services offers deep technical knowledge and proven expertise to help you manage IT risk, performance, and cost. Symantec offers several services that help manage and reduce security risks, giving your organization the foundation to protect its systems, data, and applications all while providing the reliability, flexibility, and performance needed to rapidly respond to changing business needs. Symantec Managed Security Services Symantec Managed Security Services provides 24x7 remote monitoring and management of laborintensive security operations under strict SLAs. As a result, you can confidently focus existing resources on strategic projects that drive a competitive advantage for your business. 22

23 Based on groundbreaking SOC technology from Symantec, Symantec Managed Security Services are delivered through a unique and highly effective combination of skilled personnel, best-practice processes, and state-of-the-art technology. Key offerings include: Security Monitoring Services Global Intelligence Services Security Device (IDP) Management Services Log Management Services Vulnerability Assessment Services Managed Threat Analysis Symantec Intrusion Detection/Protection Solution with Sourcefire Symantec gathers data from more than two million decoy addresses, 120 million desktop antivirus sensors, and 40,000 intrusion-detection and firewall sensors worldwide. Our unique combination of insight, research, and expertise allows us to relieve your organization of the burden of analyzing and correlating critical security intelligence as it provides greater insight into key business information. Symantec Residency Services Symantec Residency Services offers highly trained experts who can augment your existing staff at any level. Residents work onsite as members of your team for an extended period of time, helping with strategy, projects, ongoing operations, and knowledge transfer. Symantec residents can perform services under a statement of work, or they can operate under an arrangement where Symantec takes on responsibility for key IT operations under a strict SLA. Symantec Advisory Services Symantec Advisory Services focuses on helping your organization understand and minimize the security risks associated with your specific information environments. Advisory Services consultants start by assessing your existing security posture, including policies, architecture, infrastructure, and operations. Advisors then work to understand your tolerance for risk based on business goals and strategies. Armed with this information, our team then works with you to develop a plan to reduce and manage security risk taking into account what vulnerabilities need to be addressed immediately, what can wait until the next upgrade or patch cycle, and what can be considered an acceptable risk. The end result is a holistic approach to reducing security risk that is based on your business priorities. 23

24 Symantec DeepSight Early Warning Services Symantec DeepSight Early Warning Services delivers notification of vulnerabilities and Internet security attacks along with threat analyses and actionable information. Early warning statistics provide insight into real-time incidents collected from more than 40,000 sensors in 180 countries. With these statistics, you can analyze and compare local event data with global threat activity, threats in organizations similar to yours in size, and threats in companies in your geographic proximity. By comparing internal data to the global landscape, your organization can demonstrate security benchmarking for regulatory compliance. Through integrated management and early warning, you can accelerate the decision-making process for protecting critical assets. Free 30-day trial service You can experience the first line of defense for proactive enterprise security by taking advantage of our 30-day free trial of Symantec DeepSight Early Warning Services. Contact your sales representative for more information. Symantec Managed Solutions Symantec Managed Solutions combine onsite Symantec Consulting expertise with standardized managed services delivered from remote locations. Symantec experts take over repetitive, laborintensive IT operations under strict SLAs so that you can optimize your resource investments and focus on strategic initiatives with confidence. To find out more To find out more about the range of Symantec services available, visit our Web site at 24

25

26 About Symantec Symantec is a global leader in providing security, storage, and systems management solutions to help businesses and consumers secure and manage their information. Headquartered in Cupertino, Calif., Symantec has operations in more than 40 countries. More information is available at For specific country offices and contact numbers, please visit our Web site. For product information in the U.S., call toll-free 1 (800) Symantec Corporation World Headquarters Stevens Creek Boulevard Cupertino, CA USA +1 (408) (800) Copyright 2008 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, DeepSight, and Managed Security Services are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. 04/