For IT service providers seeking to grow their security business, now is the time to double down on strategy. First, the good news: demand is growing at a rapid clip. Gartner predicts the worldwide information security market will reach $86.4 billion by the end of 2017, up 7 percent from 2016. The firm predicts the market will hit $93 billion in 2018 and that security services will continue to be the fastest growing segment. The global managed security services market will have a CAGR of 16.6% through 2022, according to Allied Market Research.
For new players or those MSSPs which have been in the market for a while now, it’s time to consider how to differentiate your business as the security services market matures and competition gets tougher.
First, it’s useful to look at how the market has evolved and what the basic components of an MSSP should include:
- Engineering talent: Attaining the best people you can afford to hire is paramount to success-- although a difficult endeavor. These individuals should bring not only skills and experience that match your service areas, but the ability to interface with clients effectively. Security is complex, and your customers may not be versed in the language.
- Technologies: The MSSP must invest in the proper blend of tools that deliver the visibility, analysis, and historic insight allowing the firm to deliver timely security measures and responses. MSSPs should have familiarity across the security stack to meet the needs of a diverse client base and be able to recommend and promote technologies which they believe to be best-of-breed for many client environments.
- A workable strategy. “Doing it all” may be achievable for some clients yet it’s an increasingly thorny job as security needs become more expansive. Shoot for a defined market and a focused strategy, especially if your organization is a new MSSP.
- Sound messaging. Along the same lines, the MSSP should have clear messages that can be delivered to and understood by anyone at the client organization. Keep it simple, so that a prospect will understand quickly what your firm provides and the benefits of the offerings.
Ideas for specialization
1. Vertical: Customers in a given line of business will always prefer to be serviced by those who understand the nuances of their sector. Changing regulations will also continue to play a role, as industries determine how to adapt laws and standards to protect customers and sensitive data. One way to get started is to target companies in highly-regulated industries, such as healthcare, financial services and retail. In such companies, compliance is the driver for increasing the security footprint. Over time, the MSSP can educate customers on needs that go beyond compliance and grow a business relationship into a long-term partnership. What if your MSSP isn’t an expert yet in a particular vertical? Demonstrate to customers your firm’s commitment to and knowledge of best practices and standards such as NIST or CIS Critical Security Controls. This foundation gives service providers a solid base from which to build any vertical or specialized expertise.
2. Forensics: When breaches or policy violations occur, IT wants to find out why and how to prevent further damage and prevent the incident from ever happening again. A highly specialized and in-demand specialty is security forensics, which consists of tools and processes to “contain the crime scene” and conduct an investigation. The intent is also to investigate and properly document all the data so that the information can be used in a court of law. For example, a “legal hold” involves capturing an image of the data source that was breached. Trained forensic analysts can review all of the information to determine with high accuracy what transpired during the breach.
3. Metrics and monitoring: In the land of big data, security is a huge opportunity. To detect, prevent, and monitor IT systems against attacks, security tools collect enormous volumes of data every day. An MSSP can bring value through filtering out meaningful metrics and data points from the noise. Start by determining whether an organization has enough of the right types of data, and whether new or additional monitoring tools are required. Develop a program of KPIs to structure this practice. Some KPIs will be business-specific and others are common across many organizations. For instance, track alerts and the tickets created against them to analyze whether the alert is appropriate, or if it needs to be refined. A robust security KPI program can give customers a better understanding of security posture as well as progress over time. Benchmarks are another useful practice for security management. This could entail benchmarking companies against other similar companies in the same industry on key metrics, or, benchmarking against best practices, such as standard network and firewall configurations.
In any maturing industry, it’s wise to periodically determine where your firm can effectively compete and deliver superior service. The above ideas are just a start. No matter how you approach the market, never skimp on customer service and training your staff. Companies are increasingly dependent upon outside service providers to save the day, when trouble comes knocking.
Bonus: Learn how you can protect your clients for cyber-attacks here or check out the video directly below:
Justin Crotty is senior VP of channel sales and marketing at NetEnrich, which offers managed security services to its partner ecosystem. Read more NetEnrich blogs here.
