Cybersecurity operations: insource, don’t outsource

Cybersecurity trends

• CISOs are overwhelmed, so they are increasingly looking for solution platforms that cover multiple areas in cybersecurity
• security integration is a key criterion for security solutions to work well with the existing systems at the enterprise
• AI is not ready yet, although promising to enlighten the CISO’s job
• the emphasis shifts from prevention to operation and detection, and Security Operation Centers (SOC) become a key element in security defense
• new areas like ICS security and automotive security are gaining ground, but adoption is slow due to the nature of these industries
• GDPR will push many companies to increase their security posture and will be a key argument in increasing security budgets

The role of AI in security

AI is often thought of as the holy grail in cybersecurity as more and more tasks can be automated. It was interesting to see the conclusion that AI-based solutions are not yet ready for cybersecurity operations and monitoring and that there is an increasing need to develop security operation centers (SOCs). Many CISOs and CTOs claim that key projects are not started or stopped because they are unable to find skilled workforce to execute the projects.

Need for talent

This trend faces a serious uphill battle due to the lack of qualified cybersecurity professionals being on the market, especially in security monitoring and incident response. According to Steve Morgan, CEO of Cybersecurity Ventures, there will be 1.5 million cybersecurity jobs open by 2019.
The cybersecurity talent gap became a frequently debated topic in popular media and also within the cybersecurity community
link1, link2.
Recruiting the right cybersecurity professionals is becoming extremely difficult, and a study by ISACA and RSA revealed that most cybersecurity job applicants require extensive training to start their job.

Insourcing cybersecurity operations

There is a strong trend to outsource cybersecurity operations to managed security service providers (MSSP) including the SOC operation. This is reasonable in the light of the talent shortage. Personnel at MSSPs are qualified and their daily job is to do the monitoring. However, I argue that their visibility on corporate networks is always limited to the interface and communication between the enterprise and the service provider. Hence, the solution to only rely on the MSSP or outsourced SOC cannot work.

Security has to be part of the whole organization’s culture and it is increasingly important that the employees of the company are security-aware, no matter what they do. As discussed above, it becomes more and more relevant in the job training. The employees of the company are best suited to prevent, discover and monitor security issues in an enterprise network. More importantly, they are in the best position to build software and systems that include security elements.

Outsourcing cybersecurity to external providers cannot solve the problem. Employees are the key to defend an organization, so the CISO must make it a priority to embed security into development and operation.