How To Work With An MSSP Effectively

Historical Archive Note: This post was originally published on the Gartner Blog Network on September 3, 2014 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2014/09/03/how-to-work-with-an-mssp-effectively/ | Archive.org Snapshot

This post discusses How To Work With An MSSP Effectively, addressing enterprise architecture considerations and operational guidance based on our ongoing research inquiries on the Gartner Blog Network.

In analyzing security operations, detection telemetry, and incident handling workflows, practitioners must carefully balance organizational design, process maturity, and technology automation.

Key takeaways and recommendations:

• Define explicit operational use cases before committing to technology tooling.
• Ensure telemetry normalization and detection engineering feedback loops are established.
• Foster close collaboration between monitoring, detection engineering, and incident response teams.

Related blogs:

• Cloud Security Monitoring!
• Two Essential SIEM Notes