The MSSP offers a wide range of security services, as well as a number of different partnership options for ISPs.

by Jeff Goldman [February 18, 2009]

The managed security services provider SecureWorks was founded back in 1999, and now boasts more than 2,100 clients, with security operations centers in Atlanta, Chicago and Myrtle Beach. "One thing that our clients would say about us is that we have a very high level of service, and part of the way that we've garnered that reputation is by making sure that we have real security experts on the phone when they call," says company chief marketing officer Kathy Jaques.

In late 2006, SecureWorks merged with fellow security services provider LURHQ. "They were focused exclusively on the high-end enterprise clients, so what we've done in the last few years is we've completely integrated the technologies of the two organizations in a way that lets us deliver everything that they used to do, and everything that we used to do, to the full market," Jaques says.

SecureWorks 11 Executive Park Drive Atlanta, GA 30329 Voice: (877) 905-6661 salesinfo@secureworks.com

SecureWorks' greatest strength, Jaques says, is the SecureWorks Counter Threat Unit, a research team for all of the company's services. "We're doing applied security research to track down the hackers, evaluate the methods that they're using, and develop countermeasures—both in terms of the processes that we have in the SOC, and then in terms of signatures and countermeasures that are deployed on the technology that is protecting our clients," Jaques says.

A diverse client base
In doing so, Jaques says, SecureWorks' client base of over 2,100 serves the company extremely well. "Because we have a large client base, we can really see across a large number of very different kinds of clients, and can benefit from that experience and that visibility in applying protection," she says.

SecureWorks' security services are built around the company's proprietary Sherlock Security Platform and iSensor intrusion prevention appliances. "A lot of managed security services vendors are managing Cisco and Check Point and ArcSight, and are having difficulty bringing all of the different technologies together to get a single view. The way we've done this is everything's built on the Sherlock platform, which is a security information and event management platform purpose-built for security services delivery, with a SOC analyst interface and a client portal," Jaques says.

Within that portal, clients are given access to a wide range of reporting functionality. In addition to extensive pre-packaged compliance reports, key metrics on the portal include Business Risk Trend (tracking the client's ongoing progress on risk management) as well as the ability to view that trend in comparison to one's peers. "We give them the ability to see where they stand relative to our full client base, without revealing any of the other clients—or for them to see where they stand relative to other companies like them," Jaques says. "So if you're a retail organization, you could compare yourself to other retail organizations only, or if you're a bank, you could compare yourself only to other banks."

Partnerships and pricing
SecureWorks partners with service providers on both a co-branded and a white labeled basis. The Canadian telco MTS Allstream, Jaques says, is a good example. "They're white labeling our service for delivery into their client base," she says. "So the research and the actual monitoring and management are still being performed out of our SOC, but the idea with the relationship is that down the road, if they have sufficient business, a SOC would be opened in Canada—an NTS Allstream SOC that would be a mirror image of the ones that we have here in Atlanta, Chicago and South Carolina."

Pricing depends on the number of devices as well as the specific services required. SecureWorks, Jaques says, essentially offers three levels of service: full 24/7 management and monitoring, monitoring only, or self-service.

Self-service, she says, may be the option of choice for the ISP. "You get all of the same information that any of our other clients would get, but you're not getting analysts monitoring your infrastructure 24/7. You're doing it yourself, but enabled by our technology platform. The flexibility of that, I think, can be really attractive to an ISP."

Most recently, SecureWorks has launched a new vendor risk management service called Compliance Central, which assists clients in monitoring their partners' and vendors' security status—as well as a new, proprietary log retention appliance called LogVault.

The company, Jaques says, is now focused on offering more and more protection to the application layer. "Increasingly, the attacks are being targeted at the application layer, so there are several things that we're doing in 2009 that will offer increased protection for our clients and new prospects for web applications," she says.

— End

Online Resources:
   Intrusion Detection Systems Directory
   IDS Quick Reference Chart

Related articles:
	[Dec. 24, 2001]	White Paper: Reducing Network Security Risk
	[Sept. 25, 2001]	Physical Security Augments Logical Security
	[July 11, 2001]	ISP-Planet Survey: MSSPs