{"id":4481,"date":"2017-01-26T16:19:00","date_gmt":"2017-01-26T16:19:00","guid":{"rendered":"http:\/\/localhost\/projects\/horsesforsources\/manage-security-posture_01262017\/"},"modified":"2017-01-26T16:19:00","modified_gmt":"2017-01-26T16:19:00","slug":"manage-security-posture_01262017","status":"publish","type":"post","link":"https:\/\/www.horsesforsources.com\/manage-security-posture_01262017\/","title":{"rendered":"Make Sure Your Managed Security Services Provider Keeps Current With Your Changing Security Posture"},"content":{"rendered":"

A company’s security posture changes often. The change can be company-created, for example, by opening an office in a new geography or entering a business with different regulatory requirements for data protection. Security posture also changes as new threats like previously unknown malware emerge, and more sophisticated techniques for hacking evolve.<\/p>\n

When engaging a managed security services provider, it’s tempting to believe that keeping up with changing security posture is “being handled” by the provider. But is it?<\/p>\n

Providers Often Forgo Innovation For Operating Efficiency<\/strong><\/p>\n

A very common complaint among outsourcing and managed services clients is that the providers rarely suggest changes unless the client brings it up – unless, of course, that change benefits the provider’s ability to run the process. In security environments, this heads-down approach goes beyond ineffective – it can cause significant damage to clients as threats and mitigation options change quickly.<\/p>\n

<\/p>\n

Yes, providers generally do a security posture assessment before beginning the engagement. However, in our current blueprint research we found little evidence that providers re-assess security posture formally during the ongoing engagements. <\/p>\n

Recently, in fact, we even heard of one provider that regularly discovered threats in a client environment but didn’t report them to the client because the particular threat types were out of scope of the engagement. The client found out only months later, and by accident, about the omissions.<\/p>\n

Even with such egregious scenarios of intentionally not alerting the client, many providers miss threats. They miss them because they’re not looking for them and their analytics engines aren’t detecting new patterns.<\/p>\n

Be Proactive With Incident Monitoring And Reporting<\/strong><\/p>\n

There are many ways you can work with your managed security services provider to ensure that changes to your security posture are being addressed. From most quickly implemented to longest, here are some actions you can take:<\/p>\n