Working With Security Service Providers: What Every Small Business Manager Should Know

So you work in a small to midsize business, and you've decided to outsource security to a third-party service provider. Congratulations!

Now what?

If your answer is, "I don't know," don't feel too badly -- you're not alone. In fact, experts say, most SMBs don't know much more about managing or negotiating with security service providers than they knew about security technology in the first place.

"Most SMBs don't know the difference between MSSPs [managed security service providers], SaaS [software as a service] providers, or cloud security providers," says Joel Smith, CTO at AppRiver, which provides a variety of security services for small businesses. "That's not their job. That's why they call us."

Khalid Kark, senior analyst for security at Forrester Research, agrees. "We're seeing increased activity among SMBs in the services space," he says. "The external threats are becoming more complex. They have limited resources, and their security skill level is not very high. They're looking for help."

So if they don't have the time or skills to do security themselves, how can SMBs build a relationship with a security service provider -- without getting rooked?

The first step is not to expect too much, experts say. "One of the first mistakes we see with people who are looking to outsource is that they want to dump the entire burden on someone else," says Kevin Prince, CTO at Perimeter eSecurity, a managed services rovider that offers a wide range of services for SMBs. "They think they're going to give the job to the provider, and they won't have to worry about it anymore. But that's not the right way to approach it."

Kark concurs. "A lot of SMBs have an expectation that they are not only outsourcing the responsibility for security, but also the accountability for security," he says. "That's wrong. Even if they've brought in a third party to manage security, they're still accountable if something goes wrong. You can't just hire somebody and forget about it."

The best relationships between SMBs and third parties develop when both parties view the relationship as a partnership, experts say. "If you know your environment well, and you know your business, then you can get the skills and services you need," Kark says. "If you aren't sure what you need, if you don't know what your priorities are, you're going to have problems with any provider."

Most SMBs start their security outsourcing relationships with just one or two services, observers say. "That's an effective strategy," Kark says. "You don't want to hand off everything right away. The [service provider] doesn't know your business. You don't know them. You want to hand off capabilities slowly, and see how they do."

Prince says that's how most SMBs get into security outsourcing in the first place. "Our average customer has five different services from us," he says. "But in most cases, they started out with one. They work with us, we learn about their business, and we tell them about the threats and the risks. They begin to see the value of some of the other services."

The key to building a strong relationship with a service provider, AppRiver's Smith says, is to continually test and give feedback to the provider as the relationship develops. "The first thing you want to do is befriend a sales rep and somebody on the support side," he says. "You want to be able to ask how you can do this or that, and get an educated response from someone who understands your business."

But while SMBs need a flexible relationship with their providers, they should also be careful to build some minimum expectations into the service contract, Kark warns. "If you don't set any expectations, then the outsourcer will probably do the bare minimum," he says. "Establish some service level agreements. Monitor them to be sure they're meeting their promises." It's also a mistake to enter into a security services relationship where cost is the primary driver, Kark says. "We see a lot of SMBs looking into outsourcing because they think it will save them money, but that's a myth," he says. "About 70 percent of the companies that outsource security end up spending as much or more on their outsourced services as they would have spent doing it themselves. It's true that they usually get more for their money -- in terms of skills and support -- but if you go into outsourcing with cost as your primary filter, you're not going to get the protection you need."

Support, not cost, is what separates one service provider from another, AppRiver's Smith says. "You need to understand their support philosophy even before you get into the contract," he advises. "Are they going to give you a trusted adviser who will work with your business to understand what you need and what your priorities are? If they give you a trusted adviser, will that person be responsive, or be overwhelmed with too many clients?"

Many SMBs end up purchasing their security services from a value-added reseller (VAR) that chooses its own provider and then delivers advice and support on top of the service, Smith observes. "The good VARs have looked at all the services out there and found the ones that really work," he says. "The shakeout in the services market is always faster in the SMB space because the VARs try them out and choose their favorites. VARs don't stick with bad providers the way big companies sometimes do."

But SMBs should be careful to vet potential VARs, just as they would vet potential service providers, experts say. "A lot of traditional VARs and hardware resellers have been moving into the managed security space because they like the recurring revenue," Prince notes. "Not all of them know security, and not all of them offer 24x7 support. All too often, they don't take the time to really get to know the client's business."

Prince says Perimeter doesn't extensively vet VARs before allowing them to resell its services, but it does require them to go through extensive training and certification to maintain their status as resellers. "We expect a lot of them," he says.

Whether they use VARs or work directly with the service providers, SMBs should set up methods to regularly test and monitor their security services to be sure they're getting what they're paying for, experts say. "A lot of SMBs want to turn on the service and then forget about it, but it doesn't work that way," Smith says. "We tell customers to go by the rule of ABT -- always be testing. You need to find out what the threats are, then find out whether your provider is handling them.

"If [the provider] giving you Web filtering, there are lists of bad URLs out on the Web that are updated all the time -- test out a few bad URLs and make sure your provider is blocking them," Smith adds. "If they're giving you spam filtering, go through your quarantines and see how they're doing on false positives or false negatives. You should test all the time, even after you get comfortable that the service is working."

Most SMBs find a security service provider they like and stick with it for the long term, experts say. "A good service provider relationship is an investment -- you get to know them, and they get to know you," Kark says. "You don't want to give up that investment and switch providers just because you're getting 95 percent spam filtering and some other provider gets 97 percent. But you should build your expectations about service levels into the contract -- if it's not written down, you can't be sure you'll get that level of service over the long term."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.