Insource instead of outsourcing your cybersecurity operations

Written by Márk Félegyházi

As the enterprise architecture becomes more and more complex, the task of the Chief Security Information Officer (CISO) becomes overwhelming. CISOs have a tough time to find talented cybersecurity professionals to support their job. In an interesting article in VentureBeat, Nir Donitza and Gal Ringel wrote about the cybersecurity landscape of Israel in 2018, and what it might predict from the global cybersecurity. A few of their findings point to some interesting trends. 

Cybersecurity trends

  • CISOs are overwhelmed, so they are increasingly looking for solution platforms that cover multiple areas in cybersecurity
  • security integration is a key criterion for security solutions to work well with the existing systems at the enterprise
  • AI is not ready yet, although promising to enlighten the CISO’s job
  • the emphasis shifts from prevention to operation and detection, and Security Operation Centers (SOC) become a key element in security defense
  • new areas like ICS security and automotive security are gaining ground, but adoption is slow due to the nature of these industries
  • GDPR will push many companies to increase their security posture, and will be a key argument in increasing security budgets

The role of AI in security

AI is often thought as the holy grail in cybersecurity as more and more tasks can be automated. It was interesting to see the conclusion that AI-based solutions are not yet ready for security operation and monitoring and that there is an increasing need to develop security operation centers (SOCs). Many CISOs and CTOs claim that key projects are not started or stopped because they are unable to find skilled workforce to execute the projects.

Need for talent

This trend faces a serious uphill battle due to the lack of qualified cybersecurity professionals being on the market, especially in security monitoring and incident response. According to Steve Morgan, CEO of Cybersecurity Ventures, there will be 1.5 million cybersecurity jobs open by 2019.
The cybersecurity talent gap became a frequently debated topic in popular media and also within the cybersecurity community
link1, link2.
Recruiting the right cybersecurity professionals is becoming extremely difficult, and a study by ISACA and RSA revealed that most cybersecurity job applicants require extensive training to start their job.

Insourcing security operations

There is a strong trend to outsource cybersecurity operations to managed security service providers (MSSP) including the SOC operation. This is reasonable in the light of the talent shortage. Personnel at MSSPs are qualified and their daily job is to do the monitoring. However, I argue that their visibility on corporate networks is always limited to the interface and communication between the enterprise and the service provider. Hence, the solution to only rely on the MSSP or outsourced SOC cannot work.

Security has to be part of the whole organization’s culture and it is increasingly important that the employees of the company are security-aware, no matter what they do. As discussed above, it becomes more and more relevant in the job training. The employees of the company are best suited to prevent, to discover and to monitor security issues in an enterprise network. More importantly, they are in the best position to build software and systems that include security elements.

Outsourcing security to external providers cannot solve the problem. Employees are the key to defend an organization, so the CISO must make it a priority to embed security into development and operation.

Related Articles

The Tutorial Framework: Containerizing IT Security Knowledge

The Tutorial Framework: Containerizing IT Security Knowledge

How can we make security education a whole lot more accessible and fun? The tutorial framework is the answer. In this article we dive into how to create interactive learning environments running inside containers. The Phantom Menace Something is not quite right with...

How cybersecurity contributes value to business

How cybersecurity contributes value to business

Cybersecurity: a tough reality Cybersecurity is an inherently negative asset. As with any protective measure, the major challenge is to measure the value (or Return on Investment, ROI) of cybersecurity. It is significantly more difficult to make this value apparent to...