How can you mitigate risks in outsourcing security functions?

Answering those questions helps set precise expectations for any outsourced entity. From my experience, mapping your company's data flow is also pivotal. Understanding how data moves, who accesses it, and where potential vulnerabilities lie will help you pinpoint what you want to protect. Also, it is important to consider industry-specific regulations and standards. For instance, if you operate in the financial services sector, there are stringent guidelines that your outsourced partner must adhere to.

Assess Your Needs: - Conduct a thorough assessment of your organization's security needs and identify which specific functions you want to outsource. - Clearly define your expectations, required expertise, and performance metrics for the outsourced security services.

When you’re evaluating your own needs, something to keep in mind is your organization’s rate of change and how the service provider can scale, shift, and customize services to change along with you. Areas I always look for are onboarding of new assets/scope under management, segmentation, technology compatibility, as well as a solid roadmap to incrementally grow outcomes over time. The clearer your expectations, needs, and drivers for outsourcing vs insourcing a cybersecurity service, the greater outcomes you can expect. A partner doesn’t know what you don’t tell them, and will run with their standard catalog offerings unless you take the time to plan up-front during the evaluation process.

Consider the use of a hybrid model when looking to outsource services. You may be in a situation where hiring of full-time staff may not be in the budget. Consider leveraging a Managed Security Service Provider (MSSP) to provide expanded coverage during times when staff are not scheduled.

Mitigating risks in outsourcing security functions involves thorough vetting of vendors, assessing their security protocols, and ensuring alignment with your organization's standards. Implement robust contractual agreements with clear roles, responsibilities, and performance metrics. Conduct regular audits and assessments of the vendor's security practices. Maintain open communication channels for prompt issue resolution. Continuously monitor vendor performance and adapt strategies as needed to address emerging threats.

In addition to these tips, I recommend checking in with legal provisions that guide on what can be outsourced or describe an approval process for sectors that are heavily regulated such as banking and finance.

One major oversight companies make is not considering cultural alignment with their security vendors. A vendor that doesn’t share your company’s values, especially concerning data privacy and ethical considerations, can pose a risk. Furthermore, look into the vendor's incident history. How they've responded to past security breaches can give you invaluable insights into their resilience and adaptability.

Choose the Right Partner: - Perform due diligence on potential outsourcing partners to ensure they have a strong reputation and relevant experience in providing security services. - Evaluate their expertise, certifications, track record, and references. - Consider their compliance with industry standards and regulations.

One major oversight I’ve seen with partner selection is values misalignment. Working with the partner to clarify operational outcomes, OKRs, and other performance metrics can give a clear alignment on expectations and ensure that the partner will base their incentives around what’s important to you as their client. A partner proposal can check all the boxes from a technical and operational perspective, but if they don’t share your long-term vision of how that service provides value, it can drift rapidly into an under-performing set of cyber controls and programs that are measured in SLAs.

Performing supplier due diligence is important, depending on how the services are offered, requests for third-party compliance reports can go a long way in providing insight into how they operate their security program. Part of the due diligence process can include the use of a standardized questionnaire which contains your security requirements. Using the questionnaire will allow you to do a proper comparison when you are looking at several different suppliers.

When negotiating, consider the "what-ifs." What if there's a significant data breach? What if the vendor goes bankrupt? Scenario planning can help ensure that all potential situations are covered in the contract. Also, you should always have an exit strategy. This includes understanding data retrieval methods, transition support, and ensuring no hidden costs are associated with ending the partnership.

Negotiate the Contract: - Develop a comprehensive contract that clearly outlines the scope of work, service-level agreements (SLAs), and security requirements. - Define roles and responsibilities, including incident response procedures, reporting mechanisms, and escalation processes. - Address confidentiality, data protection, and intellectual property concerns in the contract.

Additional terms that need to be considered as part of the contract include the right to audit language. The language should encompass what acceptable independent third-party reports can be accepted by the company to perform due diligence. Leaving this clause out of a contract hampers the ability to see any whether or not any material changes have occurred that could jeopardize the ability of the supplier to provide services.

Beyond just monitoring vendor compliance, consider employing third-party audits. A fresh, external perspective can highlight vulnerabilities that might be overlooked internally. Also, ensure that the communication channels between you and the vendor are always open. Regular check-ins, not just during crises, can foster a collaborative relationship, ensuring both parties are aligned in their security efforts.

Monitor and Evaluate: - Establish a robust monitoring and oversight mechanism to ensure the outsourced security functions perform effectively. - Regularly review SLAs and performance metrics to track the partner's performance. - Conduct periodic audits and assessments to verify compliance with contractual obligations and security standards.

A critical part of success with an outsourced service is someone within the organization who holds ownership for the directional alignment, operational outcomes, and performance of the relationship. In the event that a control fails, is configured incorrectly, or simply doesn’t perform, someone internal needs to make the call to re-work the offering or shift to another vendor. You get back what you put into the relationship. A service should never be a “set it and forget it”, and point fingers when things go wrong type of arrangement

When performing supplier risk management and monitoring, it will be important to categorize what level of criticality the vendor is as it pertains to your business. Doing so allows your team to prioritize which suppliers should be reviewed on an ongoing basis or periodically. As an example, your Cloud Service Provider (CSP) may be considered a high-risk supplier, and it would be appropriate to review them annually, versus the company who shreds your documents which may be considered a moderate-risk supplier and can be reviewed every other year.

Management needs to be prepared to invest part of the budget to ensure continuing education for security professionals in their employ. Being able to strengthen the bench by encouraging pursuit of professional certifications or higher education goals goes a long way in ensuring that qualified staff are prepared to take on the challenges of an ever-changing information security landscape.

We must face the harsh reality that every employee is a potential vulnerability. Regularly scheduled training sessions, simulating phishing attacks, or even creating a reward system for reporting potential threats can actively engage employees in the company's security efforts. It's equally important to train upper management. Their buy-in can lead to increased security budgets, ensuring the necessary resources are always available.

Train and Educate: - Provide your outsourced security team with appropriate training and education to ensure they have the necessary skills and knowledge. - Share relevant organizational policies, procedures, and guidelines to align with your internal security practices. - Foster open communication channels and promote collaboration between your internal team and the outsourced partner.

Unfortunately it’s all too easy in a tight labor market to have no staff that understands the technologies or program governance of a cybersecurity capability. When you don’t know what you need, or what it’s supposed to do for you, it’s incredibly challenging for a vendor to provide value. Even though the costs may be high, maintaining employees who have deep understanding of how the security program fits together as a whole are even more essential when you have distributed administration and ownership of the parts.

Is your cybersecurity program distributed or centralized? How do you empower business stakeholders to play a role in securing the company? Outsourcing provides a layer of abstraction that can separate the business from day-to-day cybersecurity activities and can devalue or commoditize the cybersecurity function itself. I recommend that all leaders making this decision evaluate the cultural trade-offs and what would be necessary to make this service and their capabilities look and feel as if they were part of your own organization.

Balance the Trade-Offs: - Consider the trade-offs between outsourcing and maintaining in-house capabilities. - Evaluate the cost-effectiveness, expertise, and scalability of outsourcing against the potential loss of direct control. - Balance the need for convenience and expertise with the requirement for maintaining internal security expertise and oversight.

Other Considerations: - Define a clear exit strategy in the contract that outlines the process for transitioning to another provider or bringing the functions back in-house. - Implement a strong incident response and communication plan to address security incidents promptly and effectively. - Regularly review and update your security and risk management strategies to account for changes in the outsourcing landscape.