“Managed security service”的意思、由来-开放百科全书

In computing, managed security services (MSS) are network security services that have been outsourced to a service provider. A company providing such a service is a managed security service provider (MSSP)^[1] The roots of MSSPs are in the Internet Service Providers (ISPs) in the mid to late 1990’s. Initially ISP(s) would sell customers a firewall appliance, as customer premises equipment (CPE), and for an additional fee would manage the customer-owned firewall over a dial-up connection.^[2]

According to recent industry research, most organizations (74%) manage IT security in-house, but 82% of IT professionals said they have either already partnered with, or plan to partner with, a managed security service provider.^[3]

Managed security services (MSS) are also considered the systematic approach to managing an organization's security needs. The services may be conducted in-house or outsourced to a service provider that oversees other companies' network and information system security. Functions of a managed security service include round-the-clock monitoring and management of intrusion detection systems and firewalls, overseeing patch management and upgrades, performing security assessments and security audits, and responding to emergencies. There are products available from a number of vendors to help organize and guide the procedures involved. This diverts the burden of performing the chores manually, which can be considerable, away from administrators.

Industry research firm, Forrester Research, identified the 14 most significant vendors in the global market in 2018 with its 23-criteria evaluation of managed security service providers (MSSPs)--identifying Accenture, IBM, Dell SecureWorks, Trustwave, AT&T, Verizon, Deloitte, Wipro and others as the leaders in the MSSP market.^[6] Newcomers to the market include a number of smaller providers used to protect homes, small business, and high networth clients.

Early History of Managed Security Services

An early example of a outsourced and off-site MSSP service is US West !NTERACT Internet Security. The security service didn’t require the customer to purchase any equipment and no security equipment was installed at the customers premises.^[7] The service is considered a MSSP offering in that US West retained ownership of the firewall equipment and the firewalls were operated from their own Internet Point of Presence (PoP)^[8] The service was based on Check Point Firewall-1 equipment.^[9] Following over a year long beta introduction period, the service was generally available by early 1997.^[7]^[8] The service also offered managed Virtual Private Networking (VPN) encryption security at launch.^[8]

Industry terms

Six categories of managed security services

On-site consulting

This is customized assistance in the assessment of business risks, key business requirements for security and the development of security policies and processes. It may include comprehensive security architecture assessments and design (include technology, business risks, technical risks and procedures). Consulting may also include security product integration and On-site mitigation support after an intrusion has occurred, including emergency incident response and forensic analysis^[1]^[10]

Perimeter management of the client's network

This service involves installing, upgrading, and managing the firewall, Virtual Private Network (VPN) and/or intrusion detection hardware and software, electronic mail, and commonly performing configuration changes on behalf of the customer. Management includes monitoring, maintaining the firewall's traffic routing rules, and generating regular traffic and management reports to the customer.^[1] Intrusion detection management, either at the network level or at the individual host level, involves providing intrusion alerts to a customer, keeping up to date with new defenses against intrusion, and regularly reporting on intrusion attempts and activity. Content filtering services may be provided by; such as, email filtering) and other data traffic filtering.^[10]

Product resale

Clearly not a managed service by itself, product resale is a major revenue generator for many MSS providers. This category provides value-added hardware and software for a variety of security-related tasks. One such service that may be provided is archival of customer data.^[10]

Managed security monitoring

This is the day-to-day monitoring and interpretation of important system events throughout the network—including unauthorized behavior, malicious hacks, denial of service (DoS), anomalies, and trend analysis. It is the first step in an incident response process.

Penetration testing and vulnerability assessments

This includes one-time or periodic software scans or hacking attempts in order to find vulnerabilities in a technical and logical perimeter. It generally does not assess security throughout the network, nor does it accurately reflect personnel-related exposures due to disgruntled employees, social engineering, etc. Regularly, reports are given to the client.^[1]^[10]

Compliance monitoring

This includes monitoring event logs not for intrusions, but change management. This service will identify changes to a system that violate a formal security policy for example, if a rogue administrator grants himself or herself too much access to a system. In short, it measures compliance to a technical risk model.{{cn|date=July 2016}}

Engaging an MSSP

The decision criteria for engaging the services of a MSSP are much the same as those for any other form of outsourcing: cost-effectiveness compared to in-house solutions, focus upon core competencies, need for round-the-clock service, and ease of remaining up-to-date. An important factor, specific to MSS, is that outsourcing network security hands over critical control of the company's infrastructure to an outside party, the MSSP, whilst not relieving the ultimate responsibility for errors. The client of an MSSP still has the ultimate responsibility for its own security, and as such must be prepared to manage and monitor the MSSP, and hold it accountable for the services for which it is contracted. The relationship between MSSP and client is not a turnkey one.^[1]

Although the organization remains responsible for defending its network against information security and related business risks, working with a MSSP allows the organization to focus on its core activities while remaining protected against network vulnerabilities.

Business risks can result when information assets upon which the business depends are not securely configured and managed (resulting in asset compromise due to violations of confidentiality, availability, and integrity). Compliance with specific government-defined security requirements can be achieved by using managed security services.^[11]

Managed security services for mid-sized and smaller businesses

The business model behind managed security services is commonplace among large enterprise companies with their IT security experts. The model was later adapted to fit medium-sized and smaller companies (SMBs - organizations up to 500 employees, or with no more than 100 employee at any one site) by the value-added reseller (VAR) community, either specializing in managed security or offering it as an extension to their managed IT service solutions. SMBs are increasingly turning to managed security services for a number of reasons. Chief among these are the specialized, complex and highly dynamic nature of IT security and the growing number of regulatory requirements obliging businesses to secure the digital safety and integrity of personal information and financial data held or transferred via their computer networks.

Whereas larger organizations typically employ an IT specialist or department, organizations at a smaller scale such as distributed location businesses, medical or dental offices, attorneys, professional services providers or retailers do not typically employ full-time security specialists, although they frequently employ IT staff or external IT consultants. Of these organizations, many are constrained by budget limitations. To address the combined issues of lack of expertise, lack of time and limited financial resources, an emerging category of managed security service provider for the SMB has arisen.

The organizations across sectors are now shifting to Managed Security services from the traditional in-house IT security practices. A trend of outsourcing the IT security jobs to the Managed Security Services vendors is picking up at an appreciable pace. This also helps the enterprises to focus more on their core business activities as a strategic approach. Effective management, cost-effectiveness and seamless monitoring are the major drivers fueling the demand of these services. Further, with the increase in the participation of leading IT companies worldwide, the end user enterprises are gaining confidence in outsourcing the IT security.^[12]

Services providers in this category tend to offer comprehensive IT security services delivered on remotely managed appliances or devices that are simple to install and run for the most part in the background. Fees are normally highly affordable to reflect financial constraints, and are charged on a monthly basis at a flat rate to ensure predictability of costs. Service providers deliver daily, weekly, monthly or exception-based reporting depending on the client’s requirements.^[13] Security Tuning(Firewall tuning/ IDS tuning/ SIEM tuning) ^[14]

Today IT security has become a power weapon as cyberattacks have become highly sophisticated. As enterprises toil to keep at par with the new malware deviant or e-mail spoofing fraud gambit. Among different prominent players, Managed Security Service provider observe the growing need to combat increasingly complicated and intended attacks. In response, these vendors are busy enhancing the sophistication of their solution, in many cases winning over other security expert to expand their portfolio. Besides this increasing regulatory compliance associated with the protection of citizen’s data worldwide, is likely to stimulate enterprises to ensure a high data-security level.

Some of the frontrunners in engaging managed security services are Financial Services, telecom, information technology etc. To maintain a competitive edge, MSS vendors are focusing more and more on refining their product offering of technologies deployed at clients. Another crucial factor of profitability remains the capability to lower the cost yet generate more revenue by avoiding the deployment of additional tools. Simplifying both service creation and integration the products ensures unprecedented visibility as well as integration. Besides this, the MSS market would witness a tremendous growth in regions such as North America, Europe, Asia –Pacific and Latin America, Middle East and Africa.^[15]