0

If I ever suspect a security incident exceeding internal capacity & skill sets, my plan calls for outside professionals. In choosing a specific Company, I expect to expose the company to these risks:

  1. Company does not have someone available for us right when we need them
  2. Company sends someone lacking experience & competence to help us
  3. our understanding of how much it costs to involve Company is way off
  4. their services are are delayed beyond the desired damage control, e.g. by our inability to provide the documentation and credential-sharing they need, or by our inability to efficiently communicate with essentially unknown contractors

What I have:

  • two companies which someone I trust praised
  • hourly rates (but no idea how they translate to totals)

Questions I considered:

  • How long has Company been in the security business? -> XX years.
  • Does Company present at relevant conferences? -> Yes, at X-con.
  • Does Company employ sufficient personnel to suggst immediate availability? -> They claim XX!
  • How does Company homepage look? -> Full of essentially meaningless security buzzwords
  • Do they employ notable people? -> Yes, author of tool X worked there at some point.
  • Did we encounter them before? -> I once read a pretty neat writeup on Company blog. And I was once in a short call with Ms W. from Company who confirmed that yes, they do "incident response" a lot.

I do not believe these questions adequately help mitigate those risks. How should I improve my vetting to verify whether my choices really do mitigate some of the relevant risks?

0
0

When vetting a company where you are unqualified to assess the service they would provide, the main thing to ask for are references where you can talk to their own customers.

As for your list of risks that you want to mitigate:

The biggest mitigation is the contract, not the qualifying questions you ask.

Company does not have someone available for us right when we need them

If you need a certain availability, that should be in the SLA, not a question on a vetting list.

Company sends someone lacking experience & competence to help us

This is also an SLA issue. The maximum level of the expertise in the company is determined by the vetting process, but who they ultimately send needs to be covered in an SLA.

Our understanding of how much it costs to involve Company is way off

This isn't a vetting question at all, but a contract question.

we lack experience & competence to efficiently communicate with essentially unknown contractors during a crisis

we lack appropriate documentation and credential-sharing procedures to get them setup quickly

These are not vetting questions at all, but completely separate issues. I'm not sure why they are on the list.

4
  • So my mistake mostly revolves around thinking that "X hour response time (24/7)" and "hourly rate" has little practical implications? – user258000 May 27 at 9:34
  • "X hour response time (24/7)" is part of an SLA and the SLA is part of the contract. – schroeder May 27 at 9:36
  • "hourly rate" has zero security implications... We are a security site, not a procurement/legal site. – schroeder May 27 at 9:36
  • Well, if the risks I considered are either not addressable with security-specific questions or cannot be appropriately dealt with outside of concrete legalese, I guess I have my answer. Thank you. – user258000 May 27 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.