If I ever suspect a security incident exceeding internal capacity & skill sets, my plan calls for outside professionals. In choosing a specific Company, I expect to expose the company to these risks:
- Company does not have someone available for us right when we need them
- Company sends someone lacking experience & competence to help us
- our understanding of how much it costs to involve Company is way off
- their services are are delayed beyond the desired damage control, e.g. by our inability to provide the documentation and credential-sharing they need, or by our inability to efficiently communicate with essentially unknown contractors
What I have:
- two companies which someone I trust praised
- hourly rates (but no idea how they translate to totals)
Questions I considered:
- How long has Company been in the security business? -> XX years.
- Does Company present at relevant conferences? -> Yes, at X-con.
- Does Company employ sufficient personnel to suggst immediate availability? -> They claim XX!
- How does Company homepage look? -> Full of essentially meaningless security buzzwords
- Do they employ notable people? -> Yes, author of tool X worked there at some point.
- Did we encounter them before? -> I once read a pretty neat writeup on Company blog. And I was once in a short call with Ms W. from Company who confirmed that yes, they do "incident response" a lot.
I do not believe these questions adequately help mitigate those risks. How should I improve my vetting to verify whether my choices really do mitigate some of the relevant risks?