Latest / The HIDDEN Podcast by Babble / Episode 12: Is your IT provider your cyber security team?
Transcript
- Nikoo: your IT provider can be doing a genuinely good job and still not be the team actively watching for threats. The key is the is the agreed scope. Okay, so every IT support may include patching, backups, account management and security tools, but receiving an alert Investigating it and taking action are separate responsibilities. Okay, the risk is not necessarily poor performance, it's an untested assumption about who owns monitoring and response. So, business should ask three simple questions, in my opinion. What do you see? What do you do, and what do you need to do before you can act and take action if an incident is in progress and after the fact. Lynn: Welcome to the HIDDEN Podcast, where we simplify cyber security and all things tech for those of you who, like me, need it to be explained without all the jargon. So if you've ever wondered why you still feel vulnerable, even though you've bought all the fancy tools, you've come to the right place. I'm your host, Lynn Murape, and my job is to take one of our resident experts and help them translate their cyber expertise into plain English. This means having practical conversations usually built around Babble's HIDDEN cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Joining me for the first time in the virtual studio today is Nikoo Fullerton, Cybersecurity Solutions Specialist here at Babel. Nikoo, thank you for being here. Nikoo: Thank you, it's pleasure. Thank you. Lynn: Nice. It's a pleasure to have you. So as this is your first time on the show and you're also relatively new to Babel, do you mind telling our friends listening or watching out there a little bit about yourself in terms of what you do, where you live, and what you love most about what you do so far? Nikoo: Yeah, sure, absolutely. So I'm Nikoo Flurton. I'm a cybersecurity solution specialist here at Babbel. My focus is mainly on people, as always, because they are what makes a business. And I live near Cambridge. I help organizations strengthen their cybersecurity resilience, then help them navigate transformation in a way that makes technology feel practical and manageable. I enjoy most is helping people cut through the noise because sub-security is very very complicated and can get confusing and understand their risk and make confident decisions. Lynn: Love that. And you also forgot to mention that you get to be an honored guest here on the Hidden Podcast. No, I'm joking. Nikoo: that too. Lynn: Alright, so in our last episode, we looked at what needs to happen when a security alert appears and your own team is unavailable. So today we're taking the next step, which is who should actually be responsible for providing that monitoring and response, right? Your existing IT provider may be doing an excellent job, but does its remit include actively looking for threats, investigating them? And taking action. And if you do need additional support, how do you choose between an internal team, a security operations center, a managed service, or a combination of providers without creating more cost and complexity? So there is obviously a whole lot that we are going to unpack in plain English as we usually do. So to kick us off, Nikoo, if a business already has an IT provider. Looking after their tech, what cybersecurity stuff can they reasonably expect that provider to be covering? Nikoo: Yeah, sure. So an IT program may cover patching backups, account administration, multi-factor authentication support, endpoint protection, and secure configuration. The exact scope varies by provider and contracts that you have in place with them. But what I would be asking the provider who is helping you, ask who monitors the alerts, who investigates them and who is authorised to act because they may not know and that gap is very very important to make sure that you're addressing it. Lynn: Yeah, a hundred percent. And we'll dig further into why that gap is so important to address. But something that already jumped out at me as you were speaking, Nikoo, is the fact that, you know, SLAs effectively need to be established way beforehand so that everybody is effectively on the same page, you know, in terms of what that coverage looks like. So now where does everyday IT management typically end and specialist security monitoring and response begin? Nikoo: Routine IT focused on availability. Okay. The users, devices and systems. Now your specialist sub, sub security or security operations, focuses on detection, investigation and containment and escalation. Okay. so when you are working with any type of specialist or a sub security, vendor it is an added layer, not a replacement for really good IT support. It's meant be in concert with everything else that your IT provider is doing for you. Lynn: Okay, great. You had mentioned, you know, this element of excavation. Would that necessarily, you know, just to make sure I'm on the same page as you, would that typically look like, alert comes in, it's been flagged internally to the business and then now, the business doesn't have the resources, capability, etc., to deal with that threat, and then it's excavated to the specialist to look into? Nikoo: Correct. So what would happen is that the business will receive an alert whether that's the attack is being tried or it is happening. Most of time it's already happening depending on the type of service that you have in place. And then the company that will help you or your partner, they will take over when it comes to mainly the containment and the really important part is the investigation to really understand what happened. what's transpired and how to make sure it doesn't happen again. Lynn: Alright, Nikoo, great insights shared there as usual. So now can an MSP be doing a genuinely great job and still not be providing the specialist cyber cover the customer assumes that they've got? Nikoo: Absolutely, your IT provider can be doing a genuinely good job, right, and still not be the team actively watching for threats. The key is the agreed scope. Everyday IT support may include patching, backups, account management, security tools, but receiving an alert, investigating it and taking action are separate responsibilities. The risk is not necessarily poor performance, it's an untested assumption about who owns monitoring and response. So the business should ask three simple questions. What do you see? What do you do? And what do you need from us? before you can act. Lynn: Okay, nicely. moving on from that one on to now making sense of these available models, right? Because you know better than anybody that there are so many acronyms when it comes to cybersecurity in general, but especially when it comes to managed cybersecurity, So we're gonna strip all of that jargon away, right? and now my question to you, Nikoo, is what is a security operations center, also known as a Soc and does it necessarily mean a room full of anathists? Nikoo: Great question. So a security operation centre or a SOC is the people, process and technology used to monitor security events and coordinate a response. Now it can be virtual, can be distributed or delivered by a partner. It does not need to be a physical room full of analysts like many think. a SOC is a common receive security signals, alerts, investigate suspicious activity and follows a great escalation and a response process. So a lot of it is policy and process driven but also driven by the analyst and it doesn't have to be a physical location. Lynn: okay, great, because I was just assuming, you know, it was all of these tech nerds just huddled in a basement somewhere, just actively monitoring and responding to all responding rather to all of these threats. So thank you for that clarification. So if different providers use different acronyms for what sounds like the same service, what should a buyer actually be focusing on instead? Nikoo: a buyer should be focusing on, you know, for me, it's going to be about outcomes. What is. the service going to be doing for you? Do you have a, for example, a compliance framework or regulation that you need to meet? Is this service going to help you meet that? Do you have a business development opportunity that requires you to have a certain type of certification like, you know, Cyber Essentials Plus, for example? How can this service help you get to that outcome that you're looking for? So your surface about is being outcome based. Lynn: Love that. I mean it's just the perfect way to just cut through all of the noise. As you said, is you know, cornerstone of what you do for our customers every day. So thank you for untangling that. It's a lot more clear, at least for me and I know for our viewers and listeners out there. So now we're gonna switch gears and talk about, whether a company should look at building this capability primarily internally, outsourcing it or adopting more of a hybrid. So Nikoo, how should a business decide between managing cybersecurity internally, outsourcing it, or doing a bit of both by using a hybrid model? Nikoo: it really comes down to as a business, how you operate. So the hybrid model works really well. If you are an organization that has already has an IT team in place, and a hybrid model will enhance and help that team where needed. And a fully outsourced way would be better for companies, I'd say, who don't have, maybe have the IT capability internally. And simply want to have the guidance from experts who are going to give them that roadmap and also confidence for them to operate as a business, know that what they do is being backed up by good service that's going to keep them secure. Lynn: And you know, playing devil's advocate a little bit while those SMBs in particular that don't have that in-house capability or resource to, even try to build this internally and they're looking to outsource it completely. Would I be correct in just, saying that they while they can outsource most of it, things like cybersecurity strategy and just being aware of one cybersecurity posture, that kind of stuff can't fully be delegated, right? I I would hazard to guess that there technically is no such thing as completely just outsourcing everything cybersecurity related and just focusing on, you know, the operational side of things. Nikoo: Yeah, that's a really good point. You know, lot of business when they decide they're going to outsource some form in some form their technology with that as a managed service provider or MSSP, you know. the obligation to the business still sits with you. That responsibility sits with you. The strategy as to why you engage with a partner to help you become more secure sits with you. So what the partner's there for is enhance your plans or if you're struggling to make a plan, they will help you make that plan and then execute it in the right way to then fit your goals. Lynn: Perfect. All right, and that's why working with the right MSP is fundamentally important, and doing due diligence before signing on the dotted line. so we've already established that bringing in a specialist does not mean, ditching your existing MSP, right? So how should the two work together? Nikoo: The two should work together in a way that you have... your clear delineations of service. So, you you can have your internal IT team or your managed service provider for your IT. They are doing your patching, they're making sure multifactual authentication is rolled out and all these type of things to keep the lights on and keep the business operational. But you then need to have a clear line to say when does your your cybersecurity specialists come into play? And that could be for when as an overlay. they are monitoring everything, they're looking for when you are being attacked or when an attack is ongoing and then stopping and then containing it. then how the two then kind of really fit together is having playbooks. This is very key because the playbook is the process, documented process of how the two of them speak together, especially during a crisis. That playbook needs to work and if needs be, it. Lynn: Yeah. I couldn't help but think about a previous episode, I believe it's episode six with Steve Hennessy when we were talking about disaster recovery, because this element of having a playbook or a policy or whatever you want to call it, just ironing out that process before an incident happens is absolutely key because you really don't want to be trying to figure this stuff out in the midst of a breach, right? We touch wood on that one. so what you were, you know, just speaking about nicely segues into the next question that. I have for you which is what are the clear signs a business is either underprotected or overpaying for cover that it's already got somewhere else. Nikoo: The simplest way that you can find that is usually down to the contract. It's down to how you have contracted the partners that you work with. There needs to be very clear guidance on what it is one entity does for you and then the other. where businesses start to get into lot of trouble is that they say well we have for example we have extended detection response technology installed on all our assets on all our laptops and PCs and even mobile devices however we get alerts but they don't know what they're doing with those alerts. So you need to have a very clear contract between them and your partner that says, if we get alert, again, back to the playbook, if we get an alert, we would take action at that point and we will take over. And then we'll keep you updated and things like this whilst the incident is being investigated. It could be nothing, it could just be a false positive, but our investigation piece is really important. Lynn: Yeah, I couldn't agree more. the next question that I have for you is talking about, interrogating, you know, various partners or other providers that a business may be looking into working with. So before a business even talks to another provider, Nikoo, in your opinion, what should they nail down first about what they've already got? You've already spoken about contracts and playbooks. So what should they be specifically looking at in those before they now bring somebody else? Nikoo: Yeah, that's a good way of pressing it with bringing them into that kitchen when you may have too many cooks. Yeah, absolutely. So the first thing to understand is what you've got. Do you know how many laptops and PCs you need to cover? Do you know how many mobile devices you have? If you have mobile devices, what type of policy do you have in place to manage those mobile devices as they connect up to your network? So do you have a bring your own device policy? So do you allow your staff to connect up to your network? Or do you have a separate network, for example, that manages stuff, something like a guest network, so they do not have access to your corporate data? All these things play a part. Knowing what you have. is the first thing that you should be doing because we cannot protect what we cannot see. Lynn: Absolutely. so now the next question that I have for you is pretty similar, but this is now on the capability side of things, right? This is after a business has already taken stock of what they've done. They've followed your advice to a T. So now what should these buyers actually be asking a potential provider about monitoring investigation and who's author authorized to act? Nikoo: Yeah, no problem. I'll kind of go through them kind of one by one because providers vary. for example, you got an MSP. Okay, so this is the provider model that runs the support. Everyday technology security may be included as we've spoken out before and may fall into scope where they need to just make sure things are patched and they're providing an extended detection response solution. However, the critical question for them is what security tasks are actually contracted. So are they contracted to make sure patching is done? Are they contracted to make sure your Microsoft security score is at a certain level? Microsoft secure score, excuse me. Things like this, you need to make sure that is being done. A SOC, so this is the operational capability now. So this is the layer that sits just above the MSP and people processes and technology is used to monitor events and coordinate security response. So that being said, you need to make sure that you have 24 seven coverage and is it included in the cost or is an additional cost? Attackers work around the clock. So my advice is to make sure that you have 24 seven coverage on a MSSP front. know, being that again, another provider model company delivering one or more managed security services within that. you know, what services and outcomes are actually included in that service because that service might do things like incident response as well. Is that included? So if there's an incident and it's actually happened, does that investigation, is that happen? Is it included within your contract? And also as well, what other services do they provide and that are also included because that might be penetration testing. where they are actively, where they have trained professionals, what hackers, ethical hackers who may try and hack your company and does those type of services, are they included in your service? And on an MDR front as well, you just need to make sure that you know what data and actions and hours are covered, same type of thing as the SOC service as well. Now, just on the last one with the MXDR, the Managed Extended Detection Response Front, which is the goal in my opinion, and many other professionals, is the gold standard of what you should be looking for, which is similar to the companies like CrowdStrike, CyberOne, our partners who we work with, extended detection response across signals such as endpoint, identity, email, cloud, and network, really important that you get this type of data coming through. So which signals are genuinely, genuinely connected to these services and they actually monitor them. It's very critical that these things are ironed out at the very start. Lynn: Yeah, I Definitely agree with everything that you've just said, and you know, a lot jumped out at me. But what I do want to call out is in particular is around MXDR. So, for those of you who may not know, we have an upcoming webinar in just a few weeks from now, which is all about navigating MXDR, and that is also in partnership with Cyber One. So, if you have not registered for that, please do so. But bringing it back to this conversation, you know, you'll Mentioned 24-7 coverage, which is something that pretty much everybody promises, right? So, how can our buyers listening or watching out there tell what that actually means in practice? Nikoo: That's a really great question and it's interesting because 24-7 can be broken up into different things and mean different things to a service provider. So it may mean 24-7 monitoring, it might mean... 24-7 investigation, 24-7 response, these are not automatically the same thing. Ask when the response clock starts, who decides on severity, how the customer is contacted, so how do they contact the key person in the business. what can they and can't do without your approval and whether the target is a nudgement, investigation or containment. There's a lot of things going on there, but the main things to understand is what it is they are going to be doing within that 24-7 period. Compare the SLA escalation path and action authority, not just the 24-7 piece. It's about those key things. Lynn: Yeah. You know, something that has been coming up pretty frequently in these kinds of conversations is just making that super duper clear distinction between monitoring and response, right? or detection and response rather, because they are definitely not the same thing and they obviously come with different service level agreements as you've just touched on. So that nicely leads us into the next question that I have for you around costs, right? Because you know, from the outside looking in or listening in, one could think that, oof, okay, this can actually get a little bit costly, right? So what exclusions or extra costs tend to catch people out? Nikoo: Great question again. So common areas to check include onboarding, integration, retention of your data, additional data sources, incident response hours, forensics work. So again, the forensic work to understand how an attack happened and a compromise, how did it transpire? Remediation, really important. How are they going to get you up and running? Reporting out of hours actions and exit support. So these are kind of the common things that can get missed out and trying to understand those costs is really, really important because all of those are important when you're being attacked. And these are examples. not universal exclusions, up for chargeable and exclusions in writing, in my opinion, plus worked examples of costs and process for serious incidents. So if an incident happened, do you have some kind of call off or retainer in place, for example, to make sure that you have that forensic work ready to go if anything does happen. Lynn: it really does put into perspective just how much goes into just keeping your business secure so that you can sleep well at night as well. So yeah, thank you for ironing those out. And yes, there are those universal exclusions or costs that people tend to miss in the fray of just actively trying to get the solution in place. But yes, you know better than anyone that when it does come to cybersecurity, and this goes back to your earlier point around outcomes, right? It's about what does your business have and also the capabilities. It's once you take stock of that, then you're able to realistically see how much this is going to either cost you extra or just cost you period, depending on what you may have or may not have already in place. So thank you for that, Nikoo. the last question that I have for you is if a business is reviewing all of this tomorrow, they have just listened to this podcast episode and they want to hit the ground running, right? What's the one responsibility They need to make sure has an actual named owner. Nikoo: The one I see the most... when I engage with clients is ownership of the organization's cybersecurity strategy and risk decisions. That person does not need to perform every technical task. That's not what we're asking for them of them. They do need to coordinate with providers, for example, prioritize risks, acceptance and executive decisions. Outsourcing delivery does not outsource organizations accountability. So the named ownership matters especially during change, such as acquisitions when technology and cyber risks are inherited together. So if you are a business and you're growing really quickly or you have plans to become acquisitive, as you go out to market and you acquire new businesses, as you take on their IT systems and taking on the balance sheet and the customers, which is great, but you're also taking on their risks as well from that IT infrastructure and their people as well. and how they interact with your system that has you've spent a lot of money on hardening and making sure that you've done doing all the right things to keep your your self-assisted entities secure. So all of these things are very important but the most important thing absolutely is ownership of the overall strategy and the risk decision. Lynn: Perfect. So I couldn't have thought of a better way to end this. So that officially brings us to the end of your first podcast episode. Thank you again so, so much, Nikoo, for joining us. It has been an absolute pleasure talking to you and learning from you as well. Nikoo: Thank you, it's been a pleasure. Thank you. Look forward to next one. Lynn: Likewise. That's a wrap on today's episode of the Hidden Podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if today's conversation left you with more questions than answers, bring them over to our upcoming webinar on managed cyber security. We will cover them live. Register using the link in the description below, and until next time, don't let your risks stay hidden.