Making the move to secure managed information services

For years successful business strategies have been built around the concept of focus.  Smart companies keep their operations one hundred percent focused on what is core to their business; they invest in building up expertise, experience and skills in these areas and partner with others for services that fall outside of that core.
When it comes to information security, outsourcing is a trend that is rapidly emerging in the Irish market.  As information security becomes more complex and needs deeper and broader expertise many companies are selecting to partner with experts in this field so that they can stay focused on what’s vital to their business while staying secure.
Here’s what it looks like:
 
All you can eat:  Information Security Officer (ISOaaS) as a  Service
As the whole arena of information security, both internal and external, has become more complex, so too has the depth and breadth of skills needed to tackle it.  Today, the range of expertise and skills required to keep a business and its information secure simply no longer exists in any single person.
So what do you do? Build up a large team of in-house experts with the diversity and range of skills you need?   For most organisations this is simply not financially viable or commercially feasible.  In fact it simply doesn’t make sense as demand for such expertise is most likely to peak and trough rather than be a constant flow.  What forward looking operations are moving towards is an on-demand service.  The ability to access the skills they need when demand is at its peak – for example when the business is:

• designing, developing and launching a new application or service
• reassessing its information security strategy
• updating its policy libraries
• dealing with an actual information security incident.
• performing an urgent compliance work programme pre or post audit.
• assessing some particular security technology and its application.

with the flexibility to put resources “on-hold” when demand is low.
At Ward we have seen clients struggle with trying to balance the skills, resource supply and demand.  So we created our “Information Security Officer as a service” offering – it’s a first for the market.
What this means is that clients get access to the talent they need – specialised resources at the cutting edge of information security – as and when they need it.  People who not only understand information security but who also understand our clients’ business environment and can who work as trusted professionals, part of their in-house team for as long or as short as needed.
In our world of on-demand services it makes sense that companies should be able to access first-class information security services that can ebb and flow to match the needs of their business.
 
The house menu:  End-to End Secure Managed Service 
It’s a simple fact – sometimes something is just so very important that it makes strategic sense to make it the sole focus and priority of one group of focused people.
As managing information security gets more complex, taking a piecemeal approach to the security of critical information applications – from design and build to the ongoing management and operation –  can leave companies open to potential security cracks and gaps.
So what’s happening?  In short, what we see are many businesses starting to outsource the full end-to-end secure management of critical information assets within their business.  One partner, one team and one set of experts fully responsible for every aspect of securely managing the service – from

• building the application
• deploying the application
• operating the application
• managing the integrity of the business logic and process workflows surrounding the application

Where a business is reliant on an application or service whose daily operation needs to be close to flawless in terms of the security of the sensitive information it handles, the integrity of the processes it runs and the availability of the service it provides – focusing one set of dedicated people to the task who live and breathe little else – makes smart business sense.
It’s what we here at Ward refer to as our end-to-end secure managed services offering and it’s one of the services our clients thank us most for!
 
À la carte: Select and Secure
As no two companies are the same it makes sense that there is no one size fits all approach when it comes to what organisations need in relation to information security services.   For some it is the intermittent access to resources to manage the peaks and troughs of demand.  For others it is the full outsourcing of the secure management of a critical information asset or the outsourcing of one aspect or niche service of their information security requirements.  
So here at Ward we try to be as flexible as people need us to be.  That’s why we have what we call an “À la carte” secure managed services offering for companies who need it.  In short this works for organisations who want a partner that will look after one aspect of the operation’s information security requirements – be that a compliance aspect or a particular security service that requires niche expertise.
For example – one trend emerging is the outsourcing of log management and security information event management (SIEM) driven compliance obligations such as PCI.   In this case the sheer volume of work involved in monitoring and reviewing all event logs along with proactively acting upon any identified anomalies makes handling SIEM internally a resourcing nightmare for many IT departments.
The increasing complexity of the information security landscape – internally and externally – along with rising regulatory obligations means that for many it make sense to outsource some or all of the organisation’s information security requirements to those who make it the sole focus of their business.
At Ward we have watched this trend organically emerge in the market and what we have done is create a comprehensive and flexible range of services to best support what businesses need.
For more information secure managed services or any information security issue call us on (01) 642 0100
This document is for general guidance only and should not be regarded as a substitute for professional advice.