How can you evaluate the security of an outsourced network provider?

Define Needs: Outline security requirements. Due Diligence: Research reputation, compliance. Data Security: Examine encryption, backups. Policy Review: Study security policies. Physical Security: Assess facility safeguards. Access Control: Understand user authentication. Monitoring: Inquire about intrusion detection. Compliance: Verify regulations and certs. Vendor Oversight: Ensure subcontractor standards. Incident Response: Confirm reporting protocols. Disaster Recovery: Validate recovery plans. Contract Clarity: Detail security contracts, SLAs. Regular Audits: Conduct security assessments. Exit Strategy: Plan secure contract termination. Stay Informed: Monitor evolving security trends.

With so many new startups every year, being an early adopter for the 'new kid on the block' may seem appealing. But when it comes to your business, the business use-case should override the 'new' factor. A new provider can be a great choice.... if they survive. As many factors as possible should be considered when evaluating their credentials.

Outsourcing network management to a vendor is a strategic move for many companies, but a very vigorous and comprehensive selection process needs to be followed. I can highlight some of them -Expertise & Experience: Assess the vendor experience and technical expertise and leadership in managing networks -Compliance:Ensure the vendor complies with relevant industry specific regulations, security practices and standards -Financial stability: Evaluate the finacial stability of the vendor to ensure they sustain till the end of the contract. -Technology partnership:Verify vendor existing partnerships/alliances with tech providers -ESG practices: Assessment of vendor's commitment to environmental sustainability and responsible practices

It's also important to understand how they test security. Undertaking penetration testing and being transparent on the outcomes. Including this to the contract including clear resolution plans and possible penalties will also help focus the support they give. Additionally it's important to understand the credentials of the resources assigned including locations of the managed providers and any local security issues that may throw up.

Absolutely agree there should be an agreed schedule of testing. But it's also important that any changes to the wider infrastructure, especially if introducing new elements and potential ingress points ,are subjected to security risk checks.

Security audits should be done by yourself and 3rd party auditor for unbiased evaluation. Review any identified gaps. Make surprise visits to check the physical security of the vendor's facility/data centers including measures such as surveillance, access control, and environmental controls. Verify sensitive data protection/retention/encrypt/decrypt policies and data handling procedures. Find out their practices on security testing, vulnerability and deep penetration testing on their systems. Verify copies of security certifications and recent security audit reports which should also include security assessment of the vendor third party suppliers.

A core principle that I adopted for any large scale outsourcing was to only outsource arms and legs but not the brains. In this way you retain the ability to test and evaluate and retain accountability, which is especially vital in the realm of security.

I personally think this is absolutely critical! If you look at all the recent activities in Las vegas, you know they had some type of a Security Services provider. Having a good service level agreement in place is vital to an organization.

SLAs are a must but moreso immediate escalation and action. SLAs aren't much good if a breach isn't dealt with. However what they do bring is a view on performance overall and identification of repeat issues. Where there are repeats then in addition to SLAs there should be SLGs (service level guarantees) to bring that greater focus through financial penalties.

Very true It's much necessary to have a comprehensive SLA agreement, but there is fact that "A rule applied on people never followed 100% but a rule applied on machine is always followed systematically" a proper monitoring of SLA is always needed.

Let's look at this in more general terms. In any outsourcing situation you are effectively inviting someone to be part of your organisation. Communicate, manage and apply leadership as you would within the organisation.

One exercise I have found to be priceless is conducting a "tabletop" (many other names have been used). This is where the CEO, CISO, CIO, CFO, CHRO, CMO, CRO and a few others possibly get in a room and go around the table and share exactly what their responsibility is during a breach. This exercise should ensure there are no mis-steps in the process, if a security event occurs.