So moving on, we're going to talk
about outsourcing considerations.
So one of the first considerations
to look at is the current and future
quality of work
performed by these teams.
So organizations should consider not
only the quality,
the breadth and depth of the
outsourcing of work, but
also efforts to ensure the quality
of future work.
For example, minimizing turnover
and burnout, providing a solid
training program for new employees.
Organization should think about how
they could objectively assess the
quality of the outsourced work.
So, again, it's kind of similar to
if you were going to want to look at
your internal
incident response team, you would
also want to look at a way of how
you can evaluate that outside
team or that outside
source to know if
you're getting your money's worth.
So you would also want to look at
the division of responsibilities.
So organizations are often unwilling
to give an outsource authority to
make operational decisions for
the environment.
You see that a lot with the United
States government, where government
employees have the ability
to essentially make decisions
and contract with the government.
And then you have the government
contractors who essentially
do the work as is required.
And contractors can't really make
any decisions or commit the
government
to certain actions of
spending money.
And this example could be
essentially disconnecting a Web
server.
So it's it's really important
to document what type of
responsibilities
that you want to have outside
organizations to do
and to have certain types of
decision points to allow them
the ability to know when they should
or could take certain
actions.
For example, one particular
outsourced model addresses this
issue by having the outsource
to provide incident data
to the organization's internal team,
along with recommendations for
further handling of the incident
than the internal team ultimately
makes. The operations operational
decisions with the outsource
can continue to provide the support
as needed.
Another consideration that you might
have is sensitive information
revealed to the contractor.
So dividing incident response
responsibilities and restricting
access to sensitive information
could limit this.
For example, a contractor may
determine what a what
user ID was an incident.
So, for example, could the user I.D.
one, two, three, four, five, six,
but not know what person is
associated with the user I.D.
so employees can then take over the
investigation?
Nondisclosure agreements
are one possible option for
protecting the disclosure of
sensitive information, but
it's likely you in your
organization, you may have
specially compartmented to everyone
in the organization, even knows what
other departments are doing.
So that's very common.
But you just want to be able to have
a way to to work with or work
through some of those considerations
if you do have or do work
with a lot of sensitive information.
Some other outsourcing
considerations are the lack of
organization, specific knowledge,
so accurate analysis and
prioritization of incidents are
dependent on specific knowledge of
the organization's environment.
So the organization should provide
the outsourced or regularly updated
documents that define what
incidents it is concerned about,
which resources are critical and
what level of response
should be under various
circumstances.
The organization should also
report all changes and updates
made to its IT infrastructure
network configuration systems
to that outside contractor.
Otherwise, the contractor has to
make a best guess how each incident
should be handled.
Inevitably leading to a mishandled
incident and frustration on both
sides. So communication
is going to be very key at
doing this. If you've ever responded
to an incident, particularly
even within your own organization,
oftentimes who may have
a diagram of your server
room or eyeteeth
room and even
within your own organization, it's
not up to date.
Ideally, you would be able to figure
out how that works.
But if you're an outsider going in
an organization, that's
even harder. So it's important
to have good communication
between your contractors.
So lack of organization specific
knowledge can also be a problem.
One incident response is not
outsourced.
If communications are weak among
teams or organizations simply
does not collect the necessary
information.
The next consideration is going to
be a lack of correlation.
So correlation among multiple data
sources is going to be very
important if your intrusion
detection system records an
attempted attack against a web
server.
But the outsourcing has no access
to the server logs, it may be unable
to determine whether the attack
was successful.
So to be efficient, the server will
require administrative privileges
to critical systems and security
device logs remotely over secure
channel.
This will increase your admin cost,
and it will probably introduce
additional access entry points and
increase the risk of unauthorized
disclosure of sensitive information.
So those are just some of the some
things to be aware of.
So oftentimes, if you're trying to
provide that extra information
to the outsource or you
may be opening yourself up
to additional
kind of vulnerabilities.
So the next consideration is going
to be handling incidents
at multiple locations.
So as we talked about earlier,
a lot of large enterprises are
spread out across the United States,
across globally.
So effective incident response work
often requires physical presence
at the organization's facilities.
So if the outsourcers offside,
consider whether they consider where
the source is located, how
quickly it can respond
to that incident or have an incident
response team at that facility.
And how much will that cost?
So consider on site visits,
perhaps, perhaps the research
facilities or areas where they
outsource or should not be permitted
to work as well.
So, again, if you've got one of
those secure
facilities or
you're working in a government
skiff, you may not
want to have the outsourced or the
outsourced or may not be permitted
to work in that area due to security
constraints.
And then the next consideration is
maintaining incident response skills
in-house.
So organizations that completely
outsource incident response
should strive to maintain basic
incident response skills
inside and situations
may arise in which the outsourcing
is unavailable, which could be
maybe you have a contract dispute
or they go out of business.
So the organization should be
prepared to perform all of its own
incident handling or at least have
someone there who's knowledgeable
about sensitive handling.
And that also goes hand in
hand with being able to evaluate
that outsource.
So as long as you have someone
within that organization who has
some knowledge of the incident
response, you are protecting
yourself.