There’s always been a long list of acronyms for all the tools and technologies used in the security industry, but the catalog just keeps getting longer, with the latest point of confusion being the sprawling abbreviations used to describe security services. Take, for example:

• Managed Security Services (MSS)
• Managed Detection & Response (MDR) services
• Security Operations Centers as a Service (SOCaaS)

When most companies today need the help of at least one managed security services provider, IT leaders must understand the difference between these services and, more importantly, how to choose what’s best for them. Here are some quick definitions and tips to help compare and contrast security services.

MSS vs. MDR services

MSS Explained: MSS, the abbreviation in this list that’s likely the most familiar to most readers, describes a broad set of security services. Traditional services that fall under an MSS include technology management and security threat monitoring. These services are designed for those with internal security operations teams that need help managing tasks across multiple security technologies.

But as security has evolved, so too have the services. As such, providers needed a way to update their offerings to fit the changing needs of their customers. Enter a new set of acronyms:

MDR Explained: Managed detection and response takes the MSS concept one step further, focusing on the critical actions of security operations: detecting and responding in the moment. MDR services include advanced threat detection services, threat intelligence capabilities, and, most importantly, incident response — positioning certified security analysts to take action against any identified malicious activity immediately.

The Key Difference: While you may find that some MSS providers perform a limited number of templatized response actions, they generally escalate actions to the client to handle in-house. Meanwhile, MDR providers take an active role in response, customizing threat response actions around their client’s systems, processes, and compliance requirements. MDR services are also known for putting endpoint security at the center of their service. MDR services provide a team of security professionals that address cyber threats on behalf of their clients. While an MSS provider may provide a client a list of priority alerts to respond to, an MDR service will both produce that list and act on it too.

MDR benefits:

• Accelerated threat discovery
• Faster response time
• Reduced dwell time—the amount of time an attacker has inside your IT environment before being detected and contained
• Additional security personnel: certified analysts and expertise

SOCaaS or SOC Services

Security Operations Centers as a Service (SOCaaS) is the new flavor du jour, and according to Forrester, it sits somewhere between MSS and MDR. Think of it this way: SOCaaS executes detection and response workflows akin to MDR, but instead of putting endpoint protection platforms at the epicenter, it typically puts security information and event management (SIEM) at the epicenter.

Many SOCaaS providers don’t include critical response services. They simply focus on technology platforms, escalating security incidents to the client to handle. SOCaaS is recognized for log ingest, tuning, and Security Operations Center (SOC) augmentation — not threat detection and response services.

Keep in mind, these are generalizations and not hard and fast definitions. You might find solutions that break the mold, as each provider has their own approach and way of compiling security technologies and services into one offering. One important note: Most SOCaaS solutions don’t include critical threat response services.

Use cases: When to use what

• When you need to support your internal security operations, turn to an MSS provider
• When you need to find and respond to threats as fast as possible, use an MDR service
• When SIEM problems are your biggest concerns, start with SOCaaS and then expand

People and process are 90% of security success

For decades, IT leaders have been solving security problems simply by slapping on another technology, but that approach is no longer effective. In fact, services (people and expertise) are more critical than technology today. Gartner’s “Market Guide for Managed Security Services” summarizes this well by advising that an effective security program is 60% process, 30% expertise, and 10% technology.

Whether you need MSS, MDR, or SOCaaS, you will want a trusted partner with industry expertise and a capable team. But you’ll also want to ensure the right strategy, services, and technologies are in place. Here are some buyer criteria from Nemertes Research to help guide in any search:

Strategy

• Improvement approach: Industry-leading framework for proactive improvement
• Risk-based approach: System for assessing, prioritizing, and communicating risks
• Incident approach: Process for addressing and resolving threat incidents

Services

• Environment coverage: Protection for endpoint, network, cloud, and on-premise
• Intelligence feeds: Threat intelligence subscriptions are integrated with solutions
• Active threat-hunting: Proactive searches to find undetected threats

Technology

• Toolset options: The provider works with the client’s existing tools
• AI and automation: Analytics and technologies to accelerate security processes
• Metrics and dashboarding: Metrics are tracked and accessible in a unified portal

Learn about managed security services from Comcast Business here.