Use a Multifaceted Approach to Modernize Security

Automate: Because of the current state of the market, and the large gap between perfected security and existing security, the very first thing to mention is automation. Though security lags behind the rest of the industry, some great automation tools are coming along to help cover the increasingly complex environments that MSSPs are working in. As one example, check out VMware Secure State, which can help lock down both security and compliance for the cloudy parts of your service infrastructure. (Disclosure: Before VMware acquired this product, the author did some work for them)

Share: Cross-train. Different than the internal training noted above, this is spreading the security workload where it makes sense. One large insurer I worked at had security and architecture under the same VP, who would regularly make the two groups work together, or even ask people to move between teams. This meant that our architecture decisions were far more informed by security than the average enterprise architecture team, because we knew the issues or had worked closely with those who would. The architecture team (at least this member of it) weren’t security experts, but we were more aware and kept our eyes open for ways to ease security’s burden.

Build: Architectures matter. When faced with security, more always appears to be better. Always. The problem is that resources are limited, and response times can be negatively impacted. So target solutions where they will be the most useful. Layered is good if you can afford it, but I’ve never seen the shop where it was a reasonable idea at every juncture. So when detecting Bob from marketing logging in on his iPad from Uzbekistan while he’s simultaneously logged in from his office down the hall, put it on the edge. But when looking for SQL injection, put it with the code. There are a ton of options for where to implement either of these solutions, but the more you put into place, the more you have to maintain, and the greater the burden on security. That means picking the logical location and locking it down as tight as you can. Many shops will put these types of protection in multiple locations, yet one correct implementation is enough.

Profit: The tools and architectures that MSSPs can bring to bear for the benefit of customers are more diverse and powerful now than they have been in my entire time in IT. The ability to host what/where/when the customer wants, using the tools the customer needs, and providing value that the customer cannot easily walk away from, is great. We just have to make sure our Achilles’ heel is covered, and security does not cause that one breach that drives all of our customers to seek a different MSSP.