How Should an Organization and MSSP Coordinate Incident Response?

What is the Ownership for Threat Response?

In terms of ownership and process, the scope of managed security service provider (MSSP) responsibilities is commonly misunderstood. How a company and the MSSP coordinate event and incident response activities is one of the key components of a successful security partnership.

It is crucial to remember that while the MSSP should be able to offer advice and information on threat analysis and threat response, the organization typically bears responsibility for making the final determination of any potential impact and the necessary threat response actions. It is advised for organizations to have a clear understanding of the who, what, when, where, and how of client-side activities for threat analysis and impact analysis.

To detect potentially dangerous security events, a typical MSSP uses monitoring and intelligence capabilities tools. The MSSP reports such an event, along with suggestions for countermeasures, to the organization’s security contacts if it is found. The initial evaluation of an escalated event to determine whether it poses a threat is typically the responsibility of the security analysts. The security analyst activates the proper threat response procedure in accordance with internal policies if necessary.

An MSSP and the organization’s security analysts typically actively collaborate during a threat response to analyse the impact and conduct investigations. If remediation is required, a plan must be developed, and owners must be informed of the necessary steps. If changes to the device policy are required, analysts must be willing to collaborate with the MSSP to define, approve, and implement the changes. Your computer security incident response plan (CSIRP) would be activated if necessary.

A tailored security information analysis

Optional security intelligence analyst (SIA) resources are offered by some MSSPs. This kind of resource is frequently regarded as a “add-on”

component of the contract’s scope. Additionally, SIA resources can handle threat intelligence, event analysis, and custom threat analysis. The majority of organizations would like to assess their local needs based on internal staff/skills and bandwidth for security analysis. The business impact of security incidents may increase if there is a lack of a centralized incident management procedure and inexperienced staff.

If you have strong security analysis skills and know how to use MSSP tools, you may not need the involvement of an MSSP. However, you will benefit from their specialized knowledge.

Recovery activities and incident response plan

The basis for all incident response and recovery activities is an organization’s incident response plan. The MSSP does not own the plan; you do. The soundness of your organization’s incident response program must therefore be ensured through frequent gap analyses and benchmarking exercises.

Exercises based on scenarios are especially helpful for conducting cyberstress testing. Organizations may benefit from understanding the effects of various actions and events as well as how to better prepare for such situations. Additionally, stress testing verifies incident response procedures and overall plan execution, and it evaluates how prepared an organization is to handle a significant security incident.

The CSIRP for your company ought to outline how incidents ought to be handled. The National Institute of Standards and Technology (NIST) outlines which activities should be covered in the incident-handling checklist.

The four steps of the NIST-recommended forensic process model are collection, examination, analysis, and reporting. This model outlines a general method for gathering data from various media and conducting analysis to extract the key details that can be used as evidence. It is significant to remember that various models have been developed to describe the forensic process. Although most models share the same fundamental concepts, organizations should choose the model that best suits their operational and commercial requirements.

Consider using outside services to review, create, and/or test your CSIRP. Find out what consulting services your MSSP can provide in these areas.

Effective threat response planning and execution are essential to the success of your security operations programs. Despite the MSSP’s contribution to your threat response capabilities, organizations should be aware that many threat response plan components fall outside the MSSP’s purview and are often driven by clients.

A CSIRP is the road map that directs your reaction to a successful attack and serves as the cornerstone of your defense against malicious hackers, malware, human error, and a variety of other threats. All respondents’ roles and responsibilities should be specified, as well as the channels of communication to be used and the notification processes to be followed. Your incident response team may waste time and resources if there is no CSIRP in place.