Managed security: somebody watching
Most organisations have the technology and not the attention. An alert arrives at three in the morning at an address that gets read on Monday. Managed security is buying that attention: somebody who looks, assesses and calls, including outside office hours.
What you agree
Four things that belong in the contract
Without these four you buy a dashboard and not a service.
- What is monitoredWorkstations, servers, the firewall, the cloud services, or part of them. What is not listed is not watched, and that is exactly where it goes wrong when nobody wrote it down.
- Within what time there is a responseA response time per severity, and separately for inside and outside office hours. "As soon as possible" is not an agreement; four hours is, even if it is longer than you hoped.
- What may be done unilaterallyMay an account be blocked immediately on a clear incident, or is there a call first? Either works, but it has to be settled beforehand, because that conversation cannot be held mid-incident.
- Who calls and who answersA list of names and numbers, with a second and a third when the first does not answer. Kept current, because the most common failure in this process is a number belonging to somebody who left last year.
Honest about it
Three things a SOC does not solve
A service that promises this is selling you a feeling.
- It does not prevent an incidentMonitoring sees that something is happening; it does not make sure it does not. Prevention sits in updates, two-step verification and permissions that are right, and that is work coming beforehand.
- It does not replace your own operationsSomebody is still needed who knows the systems and can act on what is reported. A service calling an organisation that can do nothing moves the problem into the night.
- It does not work without good sourcesMonitoring an environment without logs, or with half of it not connected, is monitoring part of the picture. That part has to be right first.
What belongs with this
Monitoring sits on top of the basics and not in front of them.
Buy attention that does not stop at five
Tell us what is monitored now and who gets called. You get a proposal with a response time per severity and an honest list of what falls outside it.
Practical IT knowledge in your inbox
New guides on management, security and the workplace, written by the people doing the work. No sales talk, and you can unsubscribe in one click.