Managed Threat Services or Managed Security Services?

Yesterday’s approach to cybersecurity cannot adequately address today’s attacks. How do you scale cybersecurity efforts to overcome your adversary’s capabilities and resolve to infiltrate your enterprise?

With today’s advanced, persistent threats, CISOs have to balance more technology and tools with a comprehensive approach that includes the procurement of stronger talent.

The problem goes beyond simple economics. Sure, you could always save money, but there’s a tradeoff between cost and value. Traditional approaches to Managed Security Services (MSS) do provide value. It’s obviously helpful to have help filtering out the deluge of alerts coming out of your various security tools. However, the current threat landscape demands a stronger approach.

Understanding how Managed Threat Services (MTS) provide better security over traditional Managed Security Services (MSS) models is critical to securing your enterprise. And it’s not an apples-to-apples comparison.

It’s helpful to think of MTS and MSS as two approaches to cybersecurity that share some similarities but lead to divergent outcomes.

MTS is a tailored, dynamic and outcome-based service model that actively prevents malicious attacks. It’s adaptive, it’s transparent, and most importantly, it leverages highly skilled talent to address threats. It includes the alert functions of a typical MSS offering but goes much deeper to create and fuse focused intel back into your defenses based on what was detected in your environment—all while providing the resources and manpower to defend against attacks.

Advanced attackers keep coming back with changing tactics. To effectively defend against these threats, it is not enough to simply process the alerts coming out of your security tools. To defend, you need to learn from every attack and adjust your defenses, becoming as dynamic in your defense as the attackers are in their attacks.  This shift from simply processing alerts to detecting, responding, learning, and adjusting is the primary difference between MSS and MTS. 

MTS does not focus on alerts; MTS focuses on keeping your business safe, which is the outcome businesses want, according to the metrics providers give. For example, MSS providers will talk about their SLA for alert processing. In contrast, Booz Allen MTS tracks mean time to detect.  Do you care more about how quickly an alert is processed or about how long it takes to detect an attack?  Alert SLAs will still be green even if an attack was missed, and an attacker is allowed to persist in your environment for months.

Among other capabilities, MTS delivers:

1. Increased operational effectiveness by streamlining detection and response.
   
   
2. A reduction in mean-time to detect and contain security breaches through validated threat notifications that fully scope the attack, providing actionable information that results in more nimble security operations.
   
   
3. Going beyond simple staff augmentation, an MTS like Booz Allen is a true force-multiplier of talent. Chief Information Security Officers (CISOs) and security operations center (SOC) teams get access to deeply experienced analysts and responders that are in the fight every day. These experts see more attackers with greater frequency and can integrate both remotely and on-site into your SOC and primary security functions, based on your organization’s needs.

In some ways MSS can provide valuable cybersecurity resources. However, they’re not designed to mitigate the risks large-scale businesses face as they operate in an always-on, always-connected world.

Typically, MSS providers offer some level of staff augmentation. They operate your technology and have the ability to supplement your existing stack with more tools. While the right tech can certainly help, simply adding more can be counterproductive to your real goal of detecting attacks, responding to them, and keeping your business safe.

MSS will deliver alerts. However, the volume of alerts and false-positives do not improve mean-time to detect and respond. These alerts land on top of the SOC’s existing alerts, contributing to alert overload and crippling paralysis. They don’t take into account the process of actually working through the alerts and delivering a response that thwarts the attacker.

Scale and expertise can also pose problems for the MSS approach. MSS can work across various enterprises of various sizes, but given that most MSS services grew up delivering alerts for small and mid-market organizations, they lack the deep, defense-sector experience required to be effective on advanced programs.

Another goal of MSS is to provide a managed security function that is often compliance-oriented. This is a big miss and can be severely detrimental to the security of an organization. Why? Because Attackers are People ^SM. While compliance is a key legal concern, simply doing enough to get by is a recipe for disaster when faced with a persistent adversary who’s determined to breach your system. These kinds of threat actors are talented, well-resourced and capable of doing massive damage to an enterprise.

“Compliant” defenses and security measures look good on paper, but their value diminishes when advanced threats are at the gate.

While traditional MSS has its merits, today’s enterprises require a more comprehensive, hands-on approach to cybersecurity. That’s what MTS delivers.

When you look at MTS and MSS side-by-side, the differences are clear.

The question remains, however, about which cybersecurity approach you’ll choose for your enterprise.

If critical information and assets are on the line; if your current SOC staff is overwhelmed with noise; if you need access to expert talent; if you want to scale your efforts while being able to justify expenditures and prepare for the future—then the decision about which approach to take should be clear.