Security Orchestration A Catalyst for MSSP Speed to Market

Introduction The market for managed security services grew 9.5% in 2017, the result of continued adoption of services from large global providers and a steady influx of new competitors. The emergence and continued growth of the managed detection and response (MDR) category further fans the flames of growth and competition. Managed security services are notoriously hard to scale. Disparate client technologies typically mean either hiring experts on every platform or turning down/missing out on new business.

Security Orchestration & MSSP This places immense pressure on internal development resources to keep pace with market demand and accommodate the needs of new clients. But to maintain competitive pricing, maximize margins and bring services to market faster, MSSPs are looking for ways to provide a portfolio of services at scale. In this post we take a look at how security orchestration, automation and response (SOAR) can shorten the time it takes for an MSSP to provide new service offerings in order to stay competitive and gain market share.

Learning Curve for MSSPs With thousands of security technologies in the market, it’s impossible for any security engineer or SOC analyst to be an expert in every single one. Yet, MSSPs must be ready to effectively manage and monitor whatever tools their clients bring to the table from day one. Hiring additional personnel isn’t always possible, quickly drives up overhead costs and ultimately, doesn’t scale. Training existing talent can take time and spreads analysts thin.

Security Orchestration Solutions Security orchestration solutionsSecurity orchestration solutions eliminate this need for deep expertise on individual tools by providing a unifying fabric for management of multiple technologies. This means analysts only need be fluent in the use of a single platform to manage and orchestrate activities across myriad tools. Additional learning on certain technologies may still be required for more complex tasks, but security orchestration enables MSSP SOC analysts to effectively start managing new security tools immediately.

MSSPs Can Redirect R&D Resources In contrast, dedicated security orchestration solutions are designed to accommodate a broad spectrum of technologies and generally come with more than 150 integrations already built in. Users have the ability to build custom connectors as needed, but, unlike with homegrown solutions, MSSPs aren’t starting from scratch. This greatly drives down the R&D resources needed just to maintain the basic functions of the business so they can be redirected to focus on quickly creating and releasing new services that can positively contribute to the bottom line.

MDR Services One of the newest frontiers in the MSSP world is the growth of managed detection and response (MDR) services. Providers in this segment go beyond the traditional MSSP model of monitoring and notification to actually triage, respond to and remediate security incidents on behalf of their clients. As the demand for these services continues to grow – Gartner estimates 15% of organizations will be using MDR by 2020 – traditional MSSPs are being asked to get into the MDR business.

MSSPs to MDR Services Security orchestration can enable managed detection and response services out of the box. With robust playbook capabilities, MSSPs can use security orchestration platforms to codify and manage the processes associated with incident response. Many platforms even include built-in playbooks to help security teams get started. And with automation capabilities, MSSPs can use security orchestration solutions to provide industry-leading SLAs related to response and remediation times. security orchestration platformsincident response

MSSPs & MDR Services As MSSPs explore security orchestration as an enabler for MDR services, they should look for solutions that are purpose-built for multi- tenancy to ensure the ability to customize playbooks and reporting across individual clients. Additionally, MSSPs should look for solutions that have robust dashboards and customized reporting to deliver the visibility clients expect as part of MDR services.security orchestration

Conclusion Speed to market will continue to be essential for MSSPs as they work to get their share of the predicted growth over the next few years. For many, security orchestration may hold the key to capitalizing on this momentum by streamlining technology management, adding processes and delivering the scalability needed to truly focus on bringing new, differentiated services to market quickly and effectively.