MSS is about partnership and balance

The IT security landscape’s getting more complex. There are more technologies and more regulations, plus it’s no secret there’s a huge skills shortage.

It’s no wonder, then, that Managed Security Services (MSS) are gaining traction. Just a few years ago, organizations didn’t have a particularly mature approach when buying MSS. They bought the service because the outcome looked nice, without realizing the actual business problem they needed to solve.

Today, they are specifying what they need and how they would like to integrate the service into their organization. Crucially, they are looking at what kind of business outcomes they want to achieve. The procurement process, or the buying process, has also matured so MSS providers are developing their services to match the changing, and higher, customer demands.

What’s more, organizations can now benefit from a variety of services. There are very commoditized services, like managing a firewall, but also advanced services like threat detection. While some services have been around for some time (like managing firewalls), they’re getting more advanced.

Changing the language around MSS

Just as the services have evolved, so too has the language. Organizations are not simply selecting an MSS supplier, for example, but rather selecting a partner to help them on their journey to becoming a secure-by-design business. It's also not about buying a single product or a single service. Rather, it's about finding a service provider who’s able to take that business to the next level. In other words, can the provider help them accomplish their roadmap and achieve their business goals?

It's also not a one-time buy. Organizations aren’t going to do this every year so, again, they’re selecting a partner. Sure, procurement teams might say they’re selecting a supplier, but it's better to say ‘partner’ because, ultimately, they’re working together to achieve a set of business goals.

A strong MSS provider partners with the business to ensure success

Another important point is that a good MSS provider will avoid talking about fear in order to make a sale. Instead, that provider will make the organization aware of the risks they are facing in the wider context of the business. This risk management approach is common. MSS providers will make sure that business leaders understand their risk so they can make an informed decision. And they won’t promise 100% security – that’s unrealistic. It’s about working together to find the right balance between the organization, its investment and its security level.

The role of machines in MSS

The right balance also needs to be found in people and machinery. MSS can’t be achieved with only people, nor can it rely on machinery alone. Organizations need to have the right combination. For instance, a human can quickly recognize a random domain name because they have the knowledge and experience in detecting randomness quite easily – whereas a machine will likely keep an infinite list of random domain names. The two work best together when the machine learns to process the data, with the human tuning the machine. In addition, what's important with machine learning is that organizations use the right dataset (with the help of humans to label the data). If not, they won’t achieve the desired output. The dataset and data labelling are key. Only then can machines do the magic.

There’s also the question of integration. A good MSS provider will be able to integrate more and more services. After all, it's a complex landscape.

A lot of MSS players are coming from the traditional infrastructure security providers but some providers are already moving up into the outer layer. At NTT Ltd., we understand the need for organizations to protect their data and their identities right from the start and - even as new technologies and regulations emerge, that's what we’ll continue to do.

We’ll also help our clients make all their people – from the bottom up – aware of IT security. After all, it's not just the CISO's role to fix security. It's everyone's responsibility.

To find out more about the evolution of MSS, listen to my recent podcast with Enterprise Times here.