Information security outsourcing. TAdviser Overview

Information security outsourcing is a service provided by specialized companies to secure information systems and data with customers. Three types of outsourcing services can be distinguished.

• MSSP (Managed Security Service Provider). Information security management services provider. In this model, the company hires a provider (a third-party organization) to manage and secure its information systems. At the same time, the means of protection are installed inside the corporate infrastructure of the customer, and the provider remotely controls it. This model runs services such as vulnerability management, monitoring, detection, and response to security threats, and incident handling. Often these services are provided on the basis of the provider's operations center (SOC), which collects all telemetry from customers, processes it and makes response decisions.

• SECaaS (Security-as-a-Service). In this case, services are provided on the operator's own infrastructure, in which protection services are installed. According to this model, services can be provided such as protection against DDoS attacks, cyber intelligence, secure mail, data storage in the cloud according to the requirements of Law No. 152-FZ "On the Security of Personal Data" and the like.

• Consulting services. These can be both one-time services to meet the requirements of legislation, build threat models or prepare regulatory documents, and continuously operating services (for example, Bug Bounty) of regular security assessment (penetration testing), cyber risk insurance and others.

Information security outsourcing provides a wide range of services in Russia and around the world. There are various regional features that affect the variety of cybersecurity functions. For example, in Latin America, global cloud cybersecurity services (SECaaS) are offered with minimal expertise and a flexible licensing policy. The Middle East focuses on premium and localized MSSP services, often with the allocation of a local command for the client. In Europe and the USA, the most mature approach to cybersecurity is used, all types of services are used, including consulting services and MSSP. APAC's Asian region has its own features, such as closed markets and cultural differences, making it harder for outside players to enter this market.

• Alexey Pavlov, Business Development Director of the Center for Countering Cyber ​ ​ Attacks Solar JSOC:

Information security outsourcing markets in Russia and in the world coincide in nomenclature, but there are important differences and nuances. The main feature of the Russian market is the balance of services, services and their appearance. For example, the traditional separation into MSSP and SECaaS is slightly different from what they are used to abroad. SOC services in Russia are close to SECaaS. That is, they are more expert and deep compared to the provision of basic alerts about incidents on leased platforms in the cloud. At the same time, they are not yet being built on EDR technologies, but on SIEM (for us this is the next stage of development and by 2025 the growth rate of SOC MSSP on EDR will be higher than on SIEM). As for MSSP in terms of other technologies - WAF, UTM, Sandbox, etc. - today the list of Russian service providers is quite modest here. "

Since 2022, Russia has had its own features. Thus, the most famous global SECaaS suppliers, including Cisco Umbrella, Zscaler, Proofpoint, Palo Alto Networks and Fortinet, stopped providing services to Russian companies. Therefore, domestic commercial SOCs such as Solar JSOC, BI. ZONE TDR, MTS SOC and many others had to quickly switch to a model for providing MSSP services, and developers of security tools such as Kaspersky Lab, Positive Technologies and some others had to switch to a model for presenting their products in cloud SECaaS execution.

The choice between MSSP and SECaaS depends on the needs and capabilities of the customer company. MSSP may be preferable for companies that already have their own information security resources and simply need additional competencies and security tools. SECaaS, on the other hand, may be the best choice for companies that require a complete security team, including consulting and assistance, as well as companies that do not have sufficient resources to manage their own security.

The customer of the services himself determines the list of services that he wants to outsource to information security. For each of them, a different SLA (Service Level Agreement) is defined.

SLA for information security services is more difficult to register, since information security incidents require a more flexible approach. Russian vendors have proposed a model of unacceptable events, where the calculated number of unacceptable events for the customer is determined, and the threshold of unacceptable damage to the business of a particular organization is established. The Contractor shall take all possible actions to eliminate these risks and prevent unacceptable damage.

• Dmitry Romanchenko, Director of the Information Security Department of Rubytech:

As standard, the customer provides the contractor with a list of services that are outsourced, and each of them defines its SLA. Information security services usually include proactive support systems and information security incident response tools. If in relation to IT incidents their frequency is more or less predictable (a limited number of sources of incidents, its causes and methods of parrying), then everything is much more complicated with information security incidents. In addition to the usual failures of security systems, incidents also include random or targeted attacks on infrastructure, application systems, external and internal services that the organization uses. Therefore, SLA in relation to information security services is an order of magnitude more difficult to register. "

Companies providing information security outsourcing services mainly try to meet the needs of businesses of all sizes. Large companies may be interested in a wide range of services, such as monitoring and response, audit and consulting, development of a secure infrastructure, etc. Small and medium-sized enterprises, in turn, may prefer more highly specialized services, such as protection against DDoS attacks or consulting on network security.

• Alexey Kubarev, Director of Information Security T1 Cloud:

An external information security management service provider is necessary for commercial organizations of small and medium-sized businesses in order to competently solve information security problems, optimize the costs of information security specialists of the company in the medium and long term, efforts to select them, as well as management and control over them, while ensuring high quality of information security work in this organization. "

Customer expectations and needs may vary depending on the volume and scale of their business. Small companies often want to outsource all information security issues for an acceptable fee, while large companies are interested in obtaining comprehensive services that act as a "second pair of eyes" for their internal information security service. And here consulting services on Bug Bounty and security audit, the market of which has just begun to form in Russia, can come to the rescue.

According to Alexei Kubarev, most often information security outsourcing is transferred to information security that requires specific (and often expensive) tools, competencies, knowledge, skills and experience. Outsourcing is also given to tasks that require permits from information security regulators, including:

• formation of TA and design of information security subsystem, development of documentation required by information security requirements;
• implementation and maintenance of information protection tools;
• certification ( certification) of facilities according to information security requirements;
• analysis of the security of facilities, audit of their information security, their penetration testing.

The set of information security outsourcing services can be quite diverse, depending on the peculiarities of the business and the tasks of the customer. Core services in MSSP include monitoring and response, computer forensics, and incident management; in SECaaS - email protection and DDoS attacks; in consulting - auditing projects, training for personnel and security audit.

• Rustem Khayretdinov, Deputy General Director of the Garda Group of Companies:

Today, every customer can find the service at their fingertips. The most frequent service in the field of information security is protection against DDoS attacks, followed by email protection services (anti-phishing, anti-spam) and WAF. In all cases, the contractor is given a certain type of traffic for filtering. There is also a growing demand for outsourcing event monitoring in infrastructure, sometimes called "external SOC," but the number of contracts is still small, hardly more than a thousand. If we talk about expert services, the most popular service is penetration testing, each company needs such a service 1-2 times a year, you can calculate the demand. Sometimes penetration testing is done at the same time as a pilot on the SOC to assess both offensive and defensive qualifications. "

The main models of information security outsourcing services in Russia are Managed Security Services (MSS) and Managed Detection and Response (MDR). MSS is a model in which the information security service provider provides continuous monitoring and protection of the customer's network infrastructure. MDR offers more advanced services including detection and response to cyber attacks.

When providing information security outsourcing services, a business model is most often used in which the provider is a provider of cybersecurity services. It has its own technology stack and a team of experts who apply a specific methodology to provide service products. These products are sold at a certain margin. In some cases, MSS/SaaS of services can be a separate business, and in other cases, an auxiliary direction for the main business of the provider. Many providers also offer additional expert services such as cyber intelligence, cyber criminalism, external pentest/redtiming team, brand protection, etc. Intercompany and near-state service providers may have a non-commercial component, which is characterized by a focus on security itself, and not profit.

As for the metrics prescribed in the SLA agreements, they include indicators of service availability, response time, incident processing time and the amount of reporting provided. It is important to note that customers have increasingly demanded penalties for non-compliance with SLA requirements, which indicates an increase in requirements for service providers.

• Evgeny Lyapushkin, Head of MTS RED SOC Product Portfolio at MTS RED:

If we talk about metrics, then mainly these are indicators of service availability, response time, incident processing time, the amount of reporting provided. The important thing is that more and more customers began to present requirements for penalties for non-compliance with SLA requirements. I consider this a positive indicator that maturity in the use of information security services is growing, and more and more customers clearly understand what they want from the service provider. "

The most popular information security outsourcing services among Russian companies are monitoring and response, audit and consulting, as well as computer forensics. These services allow companies not only to prevent security incidents, but also to respond quickly to them, as well as analyze and investigate attacks. Moreover, the requirements for responding to incidents appeared in regulations, so companies are forced to comply with them, for which they have to contact professionals. In light of the ever-changing threat landscape, Russian companies are also taking an interest in staff training to increase employee awareness of information security issues and strengthen the information protection group within the company.

Thus, some of the information security tasks that are most often outsourced include the following.

• Vulnerability management - outsourcing tasks to find, analyze and eliminate vulnerabilities in information systems. For this, both single penetration tests and Bug Bounty programs are used.

• Security Monitoring - Outsourcing network monitoring, detection, and response to security incidents.

• Threat Management - outsourcing tasks for analyzing and monitoring information security threats, as well as developing and implementing risk minimization plans.

• Identity and access management - outsourcing tasks for user authentication, privilege management and access control to information resources.

• Security Audit - Outsourcing security assessment, analysis, and audit tasks to verify compliance with requirements and standards.

• Training and awareness: outsourcing the tasks of training employees in the field of information security and raising their awareness of threats and methods of protection.

• Backup and recovery management - Outsource business-critical backup and storage tasks and plan and recover from incidents.

• Development and implementation of security policies: outsourcing of tasks to develop, update and implement information security policies, standards and procedures.

One of the new services that may appear in the near future is the identification of inaccurate information and fakes. This is important in the context of a growing number of online manipulation and the spread of misinformation. Machine learning technologies can be used to create models that can distinguish truthful information from false information, even if it is generated by a neural network. Such automated services can help specialized experts in their work and provide more reliable protection against manipulation and fakes.

In addition, with an increase in the level of threats and the complexity of cyber attacks, we can expect the development of specialized services for detecting the results of artificial intelligence. These services will contribute to a more accurate analysis and understanding of the actions and conclusions made by automatic systems, which will prevent possible errors and improve security in general.

Evaluation of the effectiveness of outsourcing services in the field of information security can be carried out both through internal control mechanisms and with the involvement of external auditors or consultants and carried out according to the following criteria.

• Quality of services provided: assessment of the quality of outsourcing services in the field of information security includes such aspects as competence and expertise of specialists, provision of timely and effective solutions to problems, compliance with standards and requirements of information security.

• Cost reduction: The information security outsourcing cost estimate should take into account the comparison of the cost of information security outsourcing with the cost of maintaining its own information security team. The assessment should also take into account potential risk mitigation and possible savings (e.g. for infrastructure and equipment upgrades).

• Level of security: The outsourcer's assessment should include an analysis of its protective mechanisms, policies and security practices. The outsourcer must comply with the requirements of industry standards and regulations in the field of information security.

• Incident Response Level: Evaluating an outsourcer's effectiveness also includes its ability to detect and respond to information security events in a timely manner (prevent attacks).

• Level of trust and communication: the effectiveness of information security outsourcing can also be assessed based on the level of communication between the customer and the outsourcer. Communication should be open, trusting, transparent and effective to ensure timely exchange of information about security events and make the necessary decisions.

The use of machine learning and artificial intelligence technologies is a very promising direction in the information security market. These technologies have great potential to improve the effectiveness of protection against cyber threats and prevent security incidents.

Information security outsourcing is a widespread practice both in Russia and around the world. However, the Russian information security outsourcing market has some distinctive features. For many years, many Russian organizations did not trust third-party information security service providers and preferred to conduct this activity within the company. As a result, the Russian market has long been limited to the services of providers to protect against DDoS attacks.

Features of the Russian market today: the creation of a fairly large number of commercial SOCs of various sizes and capacities, the implementation of complex contracts for outsourcing information security and the operation of customer protection systems, as well as the implementation of an information security service model, where organizations create specialized services and provide them to customers.

It should be noted that in Russian practice SOC is often understood as information security monitoring, investigation and detection of incidents, and in the West SOC also includes comprehensive information security management of the organization, including the development and operation of security systems.

The Russian information security outsourcing market has strong expert managed cybersecurity services such as MSS, MDR, cyber intelligence,. anti-DDoS However, the development of basic cloud services/until SaaSPaaS recently was relatively weak. The Russian market is similar to the markets of India the Middle East, where the strong influence of large enterprises and the public sector also prevails, and the presence of small and medium-sized enterprises is insignificant. This leads to the fact that the Russian market is more focused on managed cybersecurity services MSSP, and not on basic cloud services SECaaS. At the same time, Russia has high requirements for expertise, both in services and in cybersecurity solutions.

For example, Russian teams often adapt SIEM to their tasks, rewriting the vast majority of the rules, while the world's SIEM solutions use built-in correlation rules. Russia also pays great attention to complex tools, widgets and settings, while world solutions seek to simplify management and have a simpler interface.

Thus, the Russian information security outsourcing market is distinguished by a high representation of expert managed services and weak development of basic cloud services. As well as high requirements for expertise in cybersecurity.

One-time consulting services for regulatory support of information security projects, training and system integration are also well developed on the market, but regular consulting services such as Bug Bounty, security audits and cyber risk insurance are just beginning their development.

At the same time, the current situation in the information security outsourcing market in Russia is characterized by the insufficient supply of professional services and the presence of price wars. There are many different players on the market with different approaches to the implementation of services.

However, with the development of the diversity and complexity of cyber attacks, as well as the shortage of personnel in the field of information security, the information security outsourcing market in Russia has developed significantly. Currently, many companies can no longer provide their cybersecurity without SOC or Web Application Firewall (WAF) services.

• Evgeny Lyapushkin, Head of MTS RED SOC Product Portfolio at MTS RED:

According to the statistics of 2022, Russia has become the most attacked country in cyberspace, in 2023 these statistics may no longer be so terrible, but it does not show that, with fewer, attacks have become much more difficult, and the severity of their consequences has increased. "

Compared to foreign markets, the Russian information security outsourcing market is still developing, but with the increase in the number and complexity of cyber threats and the awareness of the need to protect information, it has the potential for further growth. At the same time, there is a redistribution of players, roles and competencies. The departure of most foreign vendors from Russia has become an incentive for the development of their own solutions, which is a positive aspect for the economy. It also allows Russian specialists to develop their competencies and create solutions based on the best world practices.

• Dmitry Kuzevanov, Director of the Monitoring and UserGate: Response Center

If we talk about growth figures, the capacity of the entire Russian information security market is now approximately 230 billion rubles. By 2026, it will double - to 460 billion. At the same time, the information security services market is projected to reach 145 billion by the same period. "

• Rustem Khayretdinov, Deputy General Director of the Garda Group of Companies:

Today you can buy any security feature in the form of an expert or managed service. The Russian market repeats all global trends with a lag of seven to ten years, so we can learn from other people's mistakes and choose already tested working business models. "

The development of the information security outsourcing market in 2022 and 2023 in Russia was associated with increased pressure from both cybercriminal organizations and "hostile" state and near-state cyber groups. At this time, there was an increase in targeted and targeted attacks, as well as DDoS attacks. As a result, companies are faced with the need to strengthen their cybersecurity and are now gradually abandoning the use of foreign solutions in this area. Cybersecurity outsourcing is becoming one of the ways to solve growing problems, allowing you to quickly and effectively respond to emerging threats, as well as compensate for the lack of personnel and expertise. As a result, participants in the information security outsourcing market in Russia gain experience in aggressive conditions, develop strong products and technologies, and form successful teams.

• Alexey Malnev, Director for Service and Technology Partnership Development, Positive Technologies:

Traditionally, the service is growing faster than the cybersecurity industry, and there is a global trend of switching to an outsourcing model - often a hybrid one. In the coming years, 5-10, the landscape of cyber threats will deteriorate (and this is a very stable trend), while a change in the technosphere, an increase in the number of IoT devices, an increase in the number of data, the development of the Industrial Internet will lead to a total increase in the surface of attacks (opportunities to implement them). And the strongest shortage of personnel will be superimposed on all this. Therefore, the answer here is obvious - outsourcing has a great future. "

The current situation in the information security outsourcing market in Russia is characterized by an increased demand for protection services against attacks on perimeters and web resources of companies such as WAF, vulnerability management, anti-DDoS and SOC. The growing market for cyber intelligence services is also associated with data leaks and the spread of attacks through Telegram channels. In addition, the new requirements of regulators also stimulate growth in the information security outsourcing market.

Many customer companies are already considering using new services, such as SECaaS, which will allow them to quickly increase the volume and quality of services offered and ensure more efficient information security.

If you look at the rest of the world, where coverage with information security services is much higher than in Russia, the growth rate of this market will be less. At the same time, the wider use of artificial intelligence in information security services is predicted, which will allow more effective detection and prevention of cyber attacks.

The leader of the Russian information security outsourcing market, according to the first TAdviser rating, prepared on the basis of revenue from relevant services, is the company. In Solar 2022, its revenues from information security outsourcing services increased by 32.6% and reached 3.7 billion rubles. The top 3 also includes companies Rubytech and. Jet Infosystems The top three are ahead of all other companies in the ranking by a clear margin.

Several key trends can be distinguished in the prospects for the development of the information security outsourcing market in Russia and the world.

1. Trend of transition to outsourcing model. There is a global trend towards the outsourcing model of information security, especially the hybrid model, where organizations combine internal resources and services of external providers. This is due to the rapid growth of information security services compared to the industry.

# Worsening cyber threat landscape. In the next 5-10 years, the cyber threat landscape is expected to deteriorate, which is a persistent trend. This is due to a change in the technosphere, the growth of IoT devices, the volume of data and the development of industrial IoT solutions. All this will lead to increased opportunities for the implementation of cyber attacks.

1. The demand for information security outsourcing in the Russian Federation will continue to grow. At the same time, outsourcers will be forced to concentrate on providing services exclusively in the domestic market without the use of foreign solutions.
2. Shortage of personnel. Simultaneously with the growth of the quality of threats, the shortage of personnel in the field of information security will also increase. This means that organizations will actively look for external resources to ensure their security, as well as implement smarter AI-based technologies that will be difficult to deploy in the infrastructure of one company.
3. Increase competition for specialists. Against the background of personnel shortages and increased competition in the industry, outsourcers will be forced to actively fight to attract the most gifted and progressive specialists, whose salaries and other compensations may increase as a result.
4. New Service Products. It is expected that a change in the scale of infrastructures, data and cyber threats will lead to the emergence of new service products in the field of information security. Some of the predicted services include monitoring and managing the surface of new-level attacks, coordinating with SOC services and processes, managing vulnerabilities, and monitoring the external information security landscape around organizations.
5. Develop SOCaaS services. Intelligent services for remote security and incident investigation will also actively develop in the future. The range of services provided using SOCaaS will be expanded. Automation of analysis of existing threats on the Internet and their processing using artificial intelligence methods is one of the directions of development of such services.
6. Deep specialization. A possible increase in the number of drones and cars with autopilots will lead to the emergence of specialized services in the field of information security to protect such devices and systems.

Attacks on the Russian infrastructure will intensify, and reliability requirements will increase accordingly. T1 Cloud, understanding this trend, has already paid special attention to security, offering information security consulting services and developing information security services that are available both in the cloud (SecaaS) and on-site at the client (on-premium), - said Alexey Kubarev, Director of Information Security T1 Cloud.

Business is already striving to strengthen information security competencies and get support from reputable and competent external service providers. Attacks are becoming more complex, and a comprehensive approach is required to protect them, which only a large provider can provide. The competence of the service company, the services of which the organization uses, will also be important, since attacks have now appeared that are carried out through the basic services of service companies. Centralization of IT services will be increasingly important, but the risks associated with centralization must also be taken into account. Planning a reliable and secure information security infrastructure is becoming one of the most important tasks for business in the Russian Federation.

• Security of information systems. TAdviser Overview
• The largest information security companies in Russia
• Map of the Russian information security market 2023
• IT Services and IT Outsourcing