Managed Vulnerability Assessment

Managed Vulnerability Assessment Services typically include automated penetration testing, followed by expert analysis to identify and plug security "holes". Assessments may be conducted before and after installation of other Managed Security Services, then periodically repeated. Look carefully at the level of automation and human analysis—these vary greatly. A quick scan may appear less costly than a carefully-crafted action plan, but which will accomplish your goal? Many providers also offer on-demand custom assessments that go far beyond automated perimeter defense scanning—for example, examining an organization's security policies, methods and procedures, verifying physical premises security, and attempting to break in through social engineering.

Emergency response and forensics
Emergency Response involves damage control and service restoration following a breach. Procedures should be defined in advance by creating an Incident Response Plan. To track down the culprit and gather evidence for prosecution, call in Network Forensics experts. These are not "Managed Services" in the same sense as others included in this survey. They are as-needed professional services, available from Managed Security Service Providers. Other Managed Security offerings may include these services—for example, a Managed Firewall service agreement may include N hours of Emergency Response per quarter.

Final thoughts
This survey is intended to be representative, not exhaustive. We believe it can serve as a starting point for anyone thinking about purchasing or providing Managed Security Services. However, a survey like this cannot hope to capture the most critical dimensions of Managed Security—breadth and depth of security expertise, provider experience and track record, and ensuring a good fit between customer and provider.

Paul Gunstone, Commercial Director at Alice Networks, put this rather well: "It is obviously very difficult to show the provisions of any service in a few words on the page. Anyone buying security services needs to feel entirely happy and confident with the people, company, approach and ethos of whoever is involved. You wouldn't want to buy a house or a car from a brochure—and this sort of thing is far more important."

The information included in this survey was drawn from questionnaires completed by each participating provider. Please contact these providers directly for further information on any Managed Security Service.