Outsourcing Security

We hit on this a little in the IDS / IPS thread I started a while back (http://www.antionline.com/showthread...hlight=ids+ips ), but I wanted to have further discussion on the pros and cons of managed or outsourced security.

In the aforementioned thread Tiger Shark talked in depth about why he is opposed. I have gotten similar remarks from Marcus Ranum to the effect that if you don't have the knowledge and skill set to provide your own security you also don't have the knowledge and skill set to evaluate and select a provider so you're damned if you do and damned if you don't.

Still, for some services and some companies I don't know if its fair to lump everything and every service together and say they're all bad. CERT has an extensive document detailing the benefits and risks of outsourcing security and including in depth practices to help guide the whole process. You can find that here: Outsourcing Managed Security Services

So- lets have some more discussion. Is outsourcing good? bad? what are the pros and cons, risks and benefits, caveats and pitfalls???

Outsourcing my security makes me want to run to a corner curl up in a ball, pull my ears and wait for the explosion. I am opposed to the idea of outsourcing security.

Here is my opposition:

The more people that dabble in your network (as admins or superusers) the more trouble you are asking for. I am weary of any company wanting to provide security solutions for my company. Our company has highly critical information and it would be a devastation if it fell into the wrong hands not just for the company but for the clients.

Although I am opposed to the idea I also see the good in it. Not all people know how to handle all security, some companies are to small to handle the security aspect and so on and so forth.

How I deal with it:

Sure I am not going to go around saying I know it all because I know I am far far from that. But this is how I handle my security. Every 6 - 8 mo. I have a company come in to audit our security. This is done in many banks and other high(er?) profile places. However it is important to know who you are dealing with. We have had a long relationship with the company we are currently working with and we feel very comforable with them (but not to comfortable).

Well although I can see a use for outsourcing security it ain't for me!


- MilitantEidolon

Quote:

---

So I guess we're talking about outsourcing to India, or countries as such. Not to be racist or anything, but I don't think that security outsourced to India will have the same results as it has in the home country.

---

I think you have been watching too many political campaign commercials. While many IT jobs- mainly customer supprt / helpdesk and a good chunk of development- do in fact get outsourced overseas, that is not the point of my inquiry.

I am talking about hiring firms that specialize in security to handle your computer and network security for you rather than building it in house. I am referring to contracting with companies like BAI Security or Guarded Networks or Internet Security Systems (ISS) to implement and maintain your network security rather than purchasing the equipment and hiring the staff with the knowledge and skill level to properly secure and maintain your environment.

Depends. The first initial reaction of a security person is that it is a bad idea.

Different perspective, business related:

We outsource HR, Payroll, web hosting, payment systems, etc and all have some level of risk involved. In fact a breach in HR may not be a major financial loss but definitely embarrassing if all employee records get out. On the other hand an outsourced payment system could be infinitely more devastating and cause extreme financial loss.

I bet if you asked an HR person about outsourcing, he or she would have the same disgusted reaction to their own area of expertise. Unless one has a full time staff of dedicated experts setting in a NOC 24-7 and has systems so critical that NONE of it is outsourced, then outsourcing becomes a reality and it especially becomes a reality when a business has NO IT dept on staff. In that case it is even more of a benefit because now there is some oversight into what an IT consultant does outside of "trusting his word".

In fact that may be the real reaction, including my own, of having someone else outside of IT looking into a sacred domain and telling us IT folks, what sites we can and cannot go to. In addition to that example, increased government scrutiny in some business arenas make it very difficult to keep an administrator and a security officer the same person. In these circumstances it is a very common situation where those two salaries are not compatible with budget concerns. And even when they are, there is a growing desire by investors and government regulators to have EXTERNAL controls in place. It's becoming a lot like accounting, for example. NO company operates on its own internal accounting procedures and not establish external oversight by trusted organizations. You wouldn't hire them or a lawyer without some severe scrutiny, and you wouldn’t outsource your security devices without it either. In some cases you may even find the opposite is true, they (the outsourced security folks) may know much more than you do.

Besides it's not like your have to hand over the keys, just a gateway monitoring box or patch management. It could even be having someone come in and develop a template or a checklist for administrators to follow and submit results. Layers and oversight.

At least around here a lot of security is outsourced already. The company that monitors our alarm system for fires and burglary is not even in this city. The security guard at the door doesn't work for me and neither does the company that fixes the cameras and door locks. It’s sometimes a better move to let people who know security and can carry a gun, work the physical doorway and those people could be in a positions to pose a much larger risk at times.

\\EDIT I think you hit it Tony, outsourcing has become to mean jobs going overseas or something nagative to American workers. In this context it simply means the person doing the job is NOT an employee of the Business or group.

The absolute basis for security is trust.... Or to be more precise the lack of trust in everything and everyone. Ultimately however, someone must be trusted and in many cases must then trust others. The size of the organization really dictates the number of people in the "ring of trust". My organization is small enought that I can limit the ring of trust to myself. None of my employees know everything I do, that's not a slight on them, it's me doing my job. My bosses trust me to have the very best interests of the company in mind and that, should we part ways that I am not the kind of person to do something stupid... Why? Because I have made it quite clear to them that it is beyond my ability to be able to do something to the company that isn't tracable to me, (those of you that think you are that good.... remember.... there's always someone "bigger" or "faster" then you.... ;).

Now when you get to larger organizations the ring of trust expands, naturally. The question really comes down to is how far can you extend the ring before it's potential for breaking becomes part of the risk itself? It's my opinion that if your risk assessment indicates that you have significant assets to protect then it is your responsibility to provide the security assets commensurate to the threat. But that does not mean extending the ring to entities you have less control over since extending the ring also means granting certain rights to the very assets you have to protect.

The "Ring of Trust" is the key to security in _every_ field that requires any form of security. The key to the ring is maintaining the smallest ring possible. With due respect to those who are decent, responsible and trustable that sell themselves as "outsourced security" you need to understand that the act of selling your product is contrary to the basic rule of security.

It's my 2c on the subject.....

In a previous life, I worked for a company that did this (outsourced it's security). Now I was picked up by the outsource company (who I will not name - legal stuff ;) ) and was charged with managing the companies security. As time passed, I was also used on other projects (pimping my talent) thus restricting the amount of time I could work with the original contact. The original contact (company) was getting pissed off because of the lack of dedication to their systems and the outsource company was getting pissed off at me but refused to hire any more security people. In the long run I got the hell out of there just in time to watch both companies go down the drain (they both don't exist anymore) This has somewhat soured my view on outsourcing security. :rolleyes:

Cheers:

Since i use to work as a Outsourcer ("Consultant") I have another idea of outsourcing.

Outsourcing of anything isnt good. However, you must see the facts:

- if the company doesnt have good technical staff, its REALLY better outsource the service
- I use to see a lot of "dumbass" secadmins, just screwing all security just because they are "secadm" guy - but knows NOTHING or worst
- For some companies (i.e. Banks- i receive good $$$ from that market) the effort of taking care of all aspects of security is simply impossible. So, they use to have a small team (Core security team) that coordinates all outsourced guys.
- But for most, its simply better transfer to other internet monitoring, patch maintenance, vulnerability survey, etc


I would prefer that all service is done by inside people BUT

Its better doing well with an outsourcing company that doing crap with "my guys"

Believe me. Some big companies (i can name one or two on USA that ive worked to) have a HUGE security team and just do..... nothing..

Cacasopo:

Quote:

---

if the company doesnt have good technical staff, its REALLY better outsource the service

---

If the risk assessment dictates that you have assests to protect then those assets have a value. If the assets have a value then they have a cost associated in securing them that is commensurate with the value.....

People..... Security, while being a bottom line issue, it _isn't_ one of those areas where you can "snip" away at the cost and be able _honestly_ say that you have done the right thing in that arena. You either take it seriously or you are paying "lip service" to it..... Paying "lip service" will, unless you are incredibly lucky, cost you more in the end. It's a fact of life.... Really.... ;)

I agree with Tiger :

We outsourced our helpdesk functions not so long ago, went through a lengthy tender process and the company who won the tender, not necessarily lowest cost here folks, could not render the service effectively on any level. we recruited 310 IT Technician staff, brought in a helpdesk solution.

Point being made here, is that Security cannot be taken lightly. Placing ones trust in a company does make the circle ever bigger, like tiger says, the cost of recovery, due diligence etc could add up to a lot more than skilling ones own people for the job. i believe that the job of outsourcing a critical function should not be done. having a reputable thrid party pen testing and auditing etc, is always a good thing. making sure that one has the necessary internal processes inplace that accomodate and promote business continuity and the securing of the intellectual property thereof should be done by the bastions of the corporations.

The counter claim could be, one skills them up and they leave, then one is lost again, tis why internal controls are so important..... external factors, the ones i cannot control, such as my security company leaving with perhaps info pertaining to my business is a risk i would rather not take .....

I am against outsourcing.

Here is my reasoning:

I am going rock climbing and I have the choice to pay extra so my lifelong friend who is also a very experienced rock climber(who has come on multiple rock climbing trips with me before) can come with me, or I save some money and hire a guide who says he knows the route and has had a lot of experience climbing before.

When my rope breaks and I start falling down, knowing that the only thing between me and death is the responce time and accessment ability of my teammate, I would choose for it to be my best friend because I already know he has the capability and experience to save me.

Well,

My experiences of outsourcing have been very mixed. Let's face it., most Boards Of Directors, CEOs, CFOs, and the like know little or nothing about IT in general and security in particular (I won't mention "networking"..........they would think you were proposing a fishing expedition in a trawler :D)

You can successfully outsource hardware support, and even applications support. I have seen numerous instances of this. I do NOT believe that you can outsource core activities such as security, business analysis and so forth. That needs to be done by your "men on the ground" or "field agents".............they understand the "business" and the personalities and the BUDGETS :(

The main (generic) problem with outsourcing is that IT spend becomes a direct cost, rather than an indirect overhead. Someone has to manage the budget for that spend............so you end up getting less, either through dilution (as already mentioned) or just plain diminution.

My main objection is that if you want to be sure that you are getting a proper job and the best "bang per buck" you are going to have to employ competent people to oversee or undertake the governance of the service provision..............these guys are the major part of your costs.

Someone mentioned HR (Human Remains?)............. :eek: .........but from that standpoint, if you outsource security, you lose control of the personnel involved, and that cannot be a good idea.

just my thoughts

In my experiance the biggest problem with outsourcing is getting the service you are paying for. As most of you know any contractor will give you the minimum service for the largest amount of money they can get away with. While outsourcing your helpdesk or even your first level local support team is fairly easy to manage as it is much easier to judge the quality of service by things like system down time, incident response time, cost of support per post ect, Where as, except for a very small minority, it is much harder for most people to judge the quality of a security solution.
It is also very hard to avoid the famous " That is not covered by the contract" statement especially in security where new threats are brought to light all the time.
These are a few quick oversimplified (because i dont have a lot of time right now) points that I consider important when it comes to any outsourcing deal.

1: When it comes down to comparing the different propositions for the contract I would drop straight away the lowest and highest bids.
2: In most contracts nowdays there are nearly always bounus and penalty clauses. They are there to be used.
3: You should never loose control of your IT infrastructure. Everything should be documented. I have seen cases where because something was outsourced the company though they didnt have to worry about it anymore.
4: There should be independant random audits. Especially for security. I have never seen a security firm who audited itself fail the audit.
5: I would aim for about a 2 year contract. If at the end of the two years you are happy then the signing is a formality but if you are not happy then it goes back on the market.
6: All decisions should be traceable. If something is decided on the telephone then a confirmation e-mail should follow.

Sorry if this isnt too clear, rushing it a bit, but in any case at the end of the day I would be against outsourceing something as central to a company as IT security. I would go for an internal team where possiable but as Nihil pointed out the decision is rarely made by people with a technical background for security reasons.

Quote:

---

I am going rock climbing and I have the choice to pay extra so my lifelong friend who is also a very experienced rock climber(who has come on multiple rock climbing trips with me before) can come with me, or I save some money and hire a guide who says he knows the route and has had a lot of experience climbing before.

---

But if you know NOTHING about rock climbing, how can you know that your friend is better than the other one?

BTW, if you are getting your friend together, you are "outsourcing" your climbing, since you are trust that "a external person" will help you better than yourself.


I didnt say "i like outsourcing". But sometimes a company just haven't resources enough to take care of business, so what else to do except outsourcing?

Its so better having resource, but sometimes you must deal only with "windows 95"..

Quote:

---

But if you know NOTHING about rock climbing, how can you know that your friend is better than the other one

---

That's irrelevant in the decision making process. You are expanding your "Ring of Trust" from yourself outwards. You know your friend and you know his abilities. Furthermore, since he is your friend there is already a level of trust and there should be a good "feeling" for whether or not the friend will be straightforward with you when something exceeds their ability to cope. If the feeling about that is positive then you have no choice but to go with your friend rather than with a complete stranger. You can then rely upon your friend to assist you using his knowledge to find an appropriate person to effectively manage your security, (rock climbing).

In the event where your feeling about your friend indicates that he may place himself "out of his depth" thus risking your assets, (neck), you can find an independent business consultant to assist you in finding an appropriate employee, (guide).

Cacosapo,

Quote:

---

I didnt say "i like outsourcing". But sometimes a company just haven't resources enough to take care of business, so what else to do except outsourcing?

---

You have an excellent point there. When I read the thread, and making some assumptions from Tony's background, other site etc. I assumed a fairly large scale operation.

However, you brought it back to earth...........small companies frequently have no choice but to outsource, and at the individual level, I am sure that we all help friends and family; so we are outsourcees in a way? Even if all we do is download and set up a free AV and firewall, they have outsourced their security to us.

My point would be that corporate security is more complex, in that you are dealing with the enemy within, as well as the enemy without. In the larger corporate scenarios I feel that it is important to know the business intimately, if you are to perform core IT activities.

I don't like outsourcing to that depth:eek:

Cheers

Quote:

---

That's irrelevant in the decision making process. You are expanding your "Ring of Trust" from yourself outwards. You know your friend and you know his abilities. Furthermore, since he is your friend there is already a level of trust and there should be a good "feeling" for whether or not the friend will be straightforward with you when something exceeds their ability to cope. If the feeling about that is positive then you have no choice but to go with your friend rather than with a complete stranger. You can then rely upon your friend to assist you using his knowledge to find an appropriate person to effectively manage your security, (rock climbing).

---

I agree with much of what Tiger has said in this thread. I also think that asking this question in a security forum builds in an inherent bias. Of course we all think nobody can do it as good as we can- that is what we get paid to do. But, to someone outside of IT or network security it may make perfect business sense.

It is more of a core function though. It is one thing to outsource payroll- it is what it is and there is no real "thought" that has to go into it. Companies "outsource" their housekeeping to janitorial services. They outsource their food service and vending to service providers. The trend for awhile was to outsource anything that wasn't part of the core values of the company. If you are Chrysler your job is to design and manufacture cars, not prepare food, empty the trash, fix the elevator or, arguably, secure the network.

Many companies outsource the actual helpdesk / field technician portion of IT- it is often more cut and dry. However, the design and implementation of network architecture- the IT itself and the security, is something that requires a deeper understanding of the company and requires a deeper commitment (and trust as Tiger keeps pointing out) than you might get from a 3rd-party vendor.

All of that said, the point I agree on here with Tiger is that if you ARE going to outsource, you are going to hire the company you know and trust. All things being equal you are more likely to hire your friend's company than Joe Smith's company because even if you know nothing about what they actually do, you have some level of trust in the character and integrity of your friend. If you are buying a car you are more likely to buy from someone you know- not only to help them make money, but because you trust them not to ***** you.

I think that for many small to medium businesses outsourcing is not only viable, but often unavoidable. If you only have so many people and so many dollars it may simply not be feasible to buy the equipment and hire the personnel to manage all aspects of network administration and security. In those cases I think that the company at least needs to hire one brilliant person to be CISO (chief information security officer) or something to that effect. They need one person who knows enough to evaluate and select the tools and services the company needs. They need one person who understands the business and how IT and network security mesh with and impact it so that intelligent decisions can be made about what to outsource and who to outsource it to.

Quote:

---

You have an excellent point there. When I read the thread, and making some assumptions from Tony's background, other site etc. I assumed a fairly large scale operation.

---

My inquiry is purely theoretical. I am really looking for viewpoints and opinions from which to build articles and such for my site and for freelance magazine writing that I do. Neither I, nor any company I work with, is actually in the market for this type of service right now. So, don't base any answers on how much you think my company (companies) might need or want outsourced security. I just want to know what everyone thinks of the concept and if anyone has any success or horror stories around managed security or even managed IT.

Quote:

---

They need one person who knows enough to evaluate and select the tools and services the company needs. They need one person who understands the business and how IT and network security mesh with and impact it so that intelligent decisions can be made about what to outsource and who to outsource it to.

---

You just said all Tony. This is the current path for most (smart) companies. Keep few guys that understand it AND business to be the "interconnection" between outsourcers and company.

And Tiger, although your argumentation is good, my answer is... no...
I wont hire (contract) a friend just because i trust him but im not sure that he can take care of business.
I would prefer go to market and find someone that i trust AND can take care of stuff.
It is not a balance between trustworthy and knowledge. I think i need BOTH. If some has one but not another one, he/she wont fit. Just that.

Outsourcing is not a panacea. In fact, some of that actions (Ive joined some) conduced clients to disaster.

But we (IT guys) arent conducing business. we are a SUPPORT area.

So when VP balances IT Security ----------------------------x-----------------------More Revenue

what would he/she choose?

I ran an Infra structure area on a large company with a very small staff. Result? a mess. Lack of resources ----> lazy security administration. After I ve contracted a girl (thru outsourcing) to help and sec stuff. Nowadays, that company has a totally outsourced security team. Good? yes. I would prefer to have a "in" security team? yes, but i didnt have that choice.

Personaly, i think it all boils down to the personality of the company in the end. Some companies want to own every asset outright and some want to hire or lease everything. Some companies will always invest in the latest and greatest, some will make what ever they are using last.

Infosec is no different than any other part of a companies costs, whether it is outsoursed or kept in house, will probably be determind by the ethos of the company. Or perhaps the beancouters, of which i no of none that can see further than the quaterly profit and loss report.

Tony,

Quote:

---

Neither I, nor any company I work with, is actually in the market for this type of service right now. So, don't base any answers on how much you think my company (companies) might need or want outsourced security

---

I didn't think that you were............are you still at allexperts.com, or have you moved on?

Quote:

---

I just want to know what everyone thinks of the concept and if anyone has any success or horror stories around managed security or even managed IT.

---

Well I know of plenty of horror stories regarding outsourcing the IT function as a whole, but I expect that concept to be dead in 10 years except for small outfits who cannot afford full-time resources. Effectively they have always "outsourced", but I prefer to think of that as "sharing"

I can remember the days of computer bureaux :D they are as rare as rocking horse sh1t nowadays, so I look on outsourcing with some cynicism.

As for "trust"...........well, in God I trust, the rest of you pay cash up front :D

Cheers

Quote:

---

I didn't think that you were............are you still at allexperts.com, or have you moved on?

---

Funny you should ask. I signed up as an "expert" at allexperts.com YEARS ago. Never heard much of anything from them. Then - I signed on to be the Guide of the About.com site for Internet and Network Security. Only after the fact did I learn that at some point About.com or their parent bought AllExperts.com so the companies are under the same roof now.

I have a day job, plus the About.com netsecurity site, plus doing freelance writing for Processor Magazine (and one gig I did back in the spring for JiWire.com) and I have two book deals- one in editing now and one yet to be started.

Talking business:

This thread some what parallels the argument for open source versus Microsoft. :) It's interesting that on one hand outsourcing is a bad idea, but open source is great followed by all the reasons mixing more into the pot is good. The idea being that the more people who look at you and your systems the better off you will be?

I went down this path because I was going to introduce another concept in outsourcing, that is fielding code to various entities outside an organization and how that risk could be infinitely more devastating than getting a half decent company to implement and monitor your network security. Yes I am down playing information security, because in the real world that may be number 2 or 3 on a company wide risk analysis. When one “says outsourcing IT security” that would be the level it's looked at, outside of IT perhaps. At least that has been my point of view. Like Tiger says, it depends on your assets you are protecting and your level of trust among industry peers versus some kid off the street. Weather it’s Bob the computer geek hired on Tuesday or an international firm; you both start at ground zero with trust.

It may also be something of interest to your customers and that could be a deciding factor. For instance, a local company had terrible customer service with their outsourced cable TV repairman. They were much more efficient but the customer base began asking for actual employee technicians because they had a desire to preserve the company reputation and they were better guys in general. The outsourced guys worked on getting the most jobs in a day because that is how they were paid so that was there motivation. In this scenario customer desire drove the decision and not internal controls. You will find the same scenario in every large utility organization and that is the core of their business.

Even those companies with talented programming staff often find themselves outsourcing modules, not because of money, but because of TIME. Even the evil empire - secretive in their covenant code does this, i.e. Microsoft. Time is another critical factor in some scenarios. Tony it's interesting you use Chrysler as an example. I know a few Asian based firms that oversee their robotic plant operations and other design firms that come up with new designs along with a half dozen core items critical to the corporation. Many also Asian in ownership.

Hmm, payroll could be a very small risk or a huge risk, imagine dumping 75,000.00 bi-weekly into a payroll account outside an organization. Such as a local or international bank and then having that whisked away by an attack that occurred at the outsourcing entity. Items completely beyond your control - but to track and disperse your own paychecks would be mind boggling because the risks of errors outweigh the risk that some hacker cracks a local bank and drains the money? Or internal accountants bleeding small dollar amounts off various accounts until $400,000.00 gone and the company CANNOT recover. In addition there are no small or even large companies that own their own payment systems. How many companies out there imprint their own visa cards or the ever popular gift cards? A rare few. It’s all done ala 3rd party and is about as core as you can get in a retail system. In those situations the opposite is true because their volume gets so large that spending 15 million dollars and moving it inside actually saves a few cents per transaction.

Every company has risks they can control and risks they can’t. “Inherent” versus “Control” risk in my copyrighted risk analysis procedure. In this method of thinking I sometimes actually reduce “Inherent” risk based on the level of automation and complexity a task or system has. The more automation the LESS “Inherent” risk. Meaning people have less of an ability to f#C it up and there are more controls and reports to mitigate it.

Quote:

---

Reason: Estimating airspeed velocity of unladen swallows.

---

African or European? And, since they are alleged to have transported coconuts transcontinentally is it fair to only assess their "unladen" airspeed??