Understanding the Process and Ownership for Threat Response

The scope of managed security service provider (MSSP) roles and responsibilities in the area of threat response is often misinterpreted in terms of the process and ownership. One of the most important elements of a successful security partnership relates to how an organization and the MSSP coordinate event and incident response activities.

It is important to note that while the MSSP should be able to provide information and guidance regarding impact analysis and responding to threats, it is typically the organization’s responsibility to own the final determination of potential impact and the threat response actions needed. Organizations are advised to clearly understand the who and how of handling client-side activities for impact analysis and threat response.

A typical MSSP will use its monitoring and automated intelligence capabilities to identify potentially serious security events. If such an event is discovered, the MSSP will escalate it to the organization’s security contacts along with countermeasure recommendations. The security analysts are typically responsible for the initial review of an escalated event to confirm whether it poses a threat. If warranted, the security analyst invokes the appropriate threat response process according to internal policies.

Threat response generally includes active collaboration between an MSSP and the organization security analysts for impact analysis and investigation. A remediation plan, if needed, must be created with the appropriate actions being communicated to their owners. If device policy changes are needed, analysts should be prepared to work with the MSSP to have the changes defined, approved and implemented. If appropriate, your computer security incident response plan (CSIRP) would be evoked.

Tailored Security Information Analysis for a Threat Response

If needed to supplement your capability for researching and responding to security incident tickets, some MSSPs provide optional named security intelligence analyst (SIA) resources. Often, this type of resource can be considered an “add-on” element of the scope of contract.

SIA resources can also help provide custom threat analysis and handle threat intelligence and event analysis. Most organizations will want to evaluate their needs in their area based on internal staff/skills and availability of security analysis bandwidth. The lack of a unified incident management process, coupled with inexperienced staff, can increase the business impact of security incidents.

If you have strong security analysis skills and are able to engage the MSSP-provided analysis tools, a named MSSP resource in this area may not be necessary. However, if you are short on necessary security analysis staff or skills, you may benefit from having a named resource focused on security intelligence for your organization.

Read the White paper: Building a security incident response plan that works

Incident Response Plan

An organization’s incident response plan is the foundation for all incident response and recovery activities. You own the plan; the MSSP does not. Consequently, regular gap assessments and benchmarking exercises are needed to help ensure the soundness of your organization’s incident response program.

Cyberstress testing through scenario-based exercises is especially useful. It can help organizations understand the consequences of various events and actions and how to be better prepared to address such circumstances. Stress testing also validates incident response processes and overall plan execution and assesses an organization’s readiness to respond to a serious security incident.

Your organization’s CSIRP should specify how incidents should be handled. The incident-handling checklist, published by the National Institute of Standards and Technology (NIST), outlines which activities should be covered in the CSIRP.

NIST has proposed a straightforward forensic process model that consists of four steps: collection, examination, analysis and reporting. This model describes a general process for extracting data from various media and performing analysis to draw the essential information that can serve as evidence from the data. It is important to note that there are several models that have been designed to define the forensic process. While most models are similar in terms of basic principles, organizations should adopt the model that most closely aligns with their operational and business needs.

It is advisable to consider third-party services to review, design and/or test your CSIRP. Ask your MSSP which consulting services it can offer in these areas.

Your security operations programs depend on effective threat response preparation and the ability to execute threat response. Although the MSSP is a contributor in your threat response capabilities, organizations must be aware that many elements of a threat response plan lie beyond the MSSP scope, with much of it driven by clients.

As a cornerstone of your defense against malicious hackers, malware, human error and a host of other threats, a CSIRP is the map that guides your response to a successful attack. It should define the roles and responsibilities of all respondents, establish authority for making major decisions and define communication flows and notification procedures. Without a CSIRP, your incident response team can waste invaluable time and resources figuring out what to do, leading to potentially higher costs and greater damage to your organization and your reputation.


This article is part 2 of a four-part article series. This article series discusses how to maximize the value you receive from your MSSP relationship. Parts 3 and 4 will highlight additional key focus areas necessary to maximize value in the MSSP relationship.

More from Security Services

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Ermac malware: The other side of the code

6 min read - When the Cerberus code was leaked in late 2020, IBM Trusteer researchers projected that a new Cerberus mutation was just a matter of time. Multiple actors used the leaked Cerberus code but without significant changes to the malware. However, the MalwareHunterTeam discovered a new variant of Cerberus — known as Ermac (also known as Hook) — in late September of 2022.To better understand the new version of Cerberus, we can attempt to shed light on the behind-the-scenes operations of the…

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

12 min read - As of December 2023, IBM X-Force has uncovered multiple lure documents that predominately feature the ongoing Israel-Hamas war to facilitate the delivery of the ITG05 exclusive Headlace backdoor. The newly discovered campaign is directed against targets based in at least 13 nations worldwide and leverages authentic documents created by academic, finance and diplomatic centers. ITG05’s infrastructure ensures only targets from a single specific country can receive the malware, indicating the highly targeted nature of the campaign. X-Force tracks ITG05 as…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today