Every decision has its trade-offs. Whether your background is in business or technology, it’s likely one of the first trade secrets you learned. That’s part of the reason that putting together a strong IT strategy is so challenging– you constantly have to leverage space and speed, convenience and security. Managed IT services have long been under fire as a security concern, but how much of a threat do they really pose? Plenty of other experts would argue that managed IT services actually improve the overall quality of an organization’s cyber security defenses.

Here are a few things that every business owner, tech-expert, and IT professional should consider when making up their minds about whether or not Managed IT Services are worth the risk:

• Why people are concerned about managed services in the first place
• How managed service vendors have addressed these concerns
• Tools for assessing the risk posed by individual managed service vendors

Managed IT services are intimidating to some organizations because there is some uncertainty as to how sensitive information is handled after it’s handed over to the external vendor.

Cyber Security Concerns About Managed Services

Sharing Information

Any middle school student can tell you how quickly telling one or two people a secret can lead to it becoming public information. The more people who have access to sensitive information, the more likely it is to spread, and the more potential it has to end up somewhere you don’t want it to be. Many companies express that this is a major cyber security concern that gives them pause when considering managed IT services. In order to allow a vendor or third party IT provider to take control over some aspect of a company’s IT, information has to be shared.

Handing Over the Reins

Bringing in an external service provider to take over an IT service is another concern that arises for many business considering adopting managed services as a part of their IT strategy. Outsourcing IT tasks inherently means that the in-house IT department has less control over what decisions are made and how they are implemented. Some of this displaced responsibility lands in the lap of the business manager in charge of managing the relationship with the managed service provider. This can lead to strategy inconsistencies and other blips that may become a security liability.

It’s important to understand whose eyes will be on your information when considering managed IT services, and an audit is an excellent way to accomplish this.

Addressing Security Concerns with Managed Services

Managed Cyber Security as a Service

There are a wide variety of managed IT services out there. In fact, some organizations even provide cyber security defense as a managed service. Managed cyber security services can include anything from firewall management to patch management and vulnerability analysis. This offers one way of mitigating potential cyber security risks. Taking advantage of managed cyber security either on its own or in tandem with other managed security services ultimately results in a more comprehensive IT strategy, which helps keep an organization’s cyber security defenses strong.

Audit Vendor Behavior

Managed security service providers– reputable ones– should have a series of security practices and protocols designed to ensure their interaction with a company is not responsible for compromising its data. An effective way to assess whether or not a vendor has security protocols in place that meet the needs and expectations of a given business is to conduct an audit. By outlining the security precautions that are necessary at each level– from the perimeter to the UI– a business can regain some of the control that is lost by outsourcing a critical IT function.

Behaviors to Monitor

If you’re going to go the audit route, there are some elements of a vendor’s cyber security protocol you definitely don’t want to miss out on assessing. When putting together your audit plan, consider evaluating your managed service vendor handles situations such as:

• Access management.Who has access to sensitive information? How do they make sure the only people accessing information are the people who should be?
• Updating software.How frequently are updates released? How do they assess and address security concerns in each update?
• How often do they patch their software? How long are patches left in place before a full update is released?
• Vulnerability analysis.How often do they test for weaknesses in the cyber defenses? How thorough is their vulnerability analysis?
• Self-monitoring.Do they regularly assess their own cyber security protocols? How?

For startups and small businesses, managed IT services provide a convenient way to expand their cyber security resources.

Assessing Managed Service Providers

Another great way of maintaining security when considering a managed service provider is by thoroughly assessing a vendor before considering a partnership with them. Here are a few major indicators that managed IT services may be a worthwhile and secure investment:

Cyber Security Certifications

Industry security certifications are put in place to give customers an easy means of assessing a vendor. Selecting a managed services vendor who meets the standards of industry certifications helps ensure that any information shared with them isn’t compromised. A few certifications relevant to managed IT services include:

• Certified Information Systems Security Professionals (CISSP)
• Certified Information Security Managers (CISM)
• Certified Ethical Hackers (CEH)
• Information Systems Security Management Professionals (ISSMP)
• Global Privacy Enforcement Network Certified Penetration Testers (GPEN)
• Cisco Certified Network Associates (CCNA)
• Cisco Certified Networking Professionals (CCNP)

Expanding Resources

Launching a business isn’t easy, and just like everything else, it involves a considerable amount of prioritizing. Some startups and small businesses may find it challenging to to meet their cyber security needs with the resources they are currently able to allocate to IT. In this situation, managed services may be an excellent solution. By outsourcing cyber security tasks to a larger company, startups and small businesses can:

• Reduce IT spending, allowing for funds to be reallocated to growth-driven products
• Take advantage of the additional resources a larger organization is able to support
• Improve their overall cyber security

Conclusion

The information provided here is a small sampling of the debate over whether managed IT services help or hinder cyber security efforts. Based on this evidence, it seems safe to conclude that, while managed services may introduce cyber security risks to an organization, there are effective ways to monitor and minimize those risks while still taking advantage of everything that managed IT services have to offer. But ultimately, you have to decide for yourself. When it comes to managed IT services, is the IT solution worth the risk?

About the Author

Melissa Pallotti is a journalist and editor at Nakturnal who specializes in content related to technology and IT. She received her BA from the University of Pittsburgh and is based in Pittsburgh, Pennsylvania. Melissa can be reached via her personal LinkedIn and Twitter profiles, or by contacting Nakturnal.