PathetiQ<p>Mini Guide: Selecting a cybersecurity vendor for SMBs</p><p>Cybersecurity is now common and a requirement for all organizations to secure themselves and their data, both company and clients. For SMBs that's usually highly complex. They do not have the knowledge, nor the resources to correctly chose cybersecurity vendors or to fully understand the reports they will receive from their work. And sadly, we live in a world where sales and marketing prevail. </p><p>This mini guide will help SMBs leadership and employees to evaluate what they are being sold and how to make a better choice regarding cybersecurity vendors services or tooling. It is hard for anyone outside of cybersecurity to validate the quality or even if the vendors aren't selling you snake oil.</p><p>_This guide is intended to all business owners, decision makers, analysts, _sysadmins or any other person in a role of decision to acquire a cybersecurity _software or service from a cybersecurity vendor. </p><p>Whatever a vendor is selling you, a firewall, a managed services (ex: Security Operation Center, SIEM, etc.), a SaaS (Software as a service) or even a security test (intrusion test, security assessment, etc.), these next few steps will help you! You will be able to confirm if they are an experienced company and team, if they are only reselling a security product, or if they are the right fit for you.<br>Before diving into the mini-guide, you really need to understand the most important rule in information security/cybersecurity...</p><p>There is NO magic solution nor magic product that will solve your security. None! Nada! Niyet! Aucune! You cannot buy something to be fully secure. This will never happen.</p><p>No software, product or concept will make your organization secure, none!<br>Security is about processes and humans and it's always a work in progress. It's the same as doing any administration work in your company: you don't pay your taxes once and stop, it's year after years. Buying a software or a SaaS won't make you secure. It's how you configure it and how you use it (the processes) that will make you secure in the long term. </p><p>The main thing about buying a software or service whatever it is, is to have employees that will own the processes surrounding that new tool or service. The processes and playbooks will describe how to use it and overtime will be improved to follow the business needs. Buying and shelving a tool will not make you secure like the tool was supposed to help you be. </p><p>Main steps to validate a security vendor<br>1. Does the vendor have any employees with a security title in the company?<br>- Look at their LinkedIn page. <br>- Go to the "People" tab.<br>- Search for "security", "cybersecurity", "infosec", "hacking", "red team".<br>- If the results are inconclusive, they might just be a reseller or they are in the business without knowledge. Don't use this vendor.<br>- If the result is less than a 10 security employees per 100 regular employees. They are usually under budgeted or have a really young team and are at the beginning of their team. <br>- Make sure to look at the experience of all security employees to validate that they aren't new in the industry. You are looking for at least 5 to 10 years of experience in average. Juniors are fine obviously, but they need multiple seniors for support.<br>- Make sure they have a manager/director of the security team and security employees. VP, CSO, CISO, Head of security, etc.</p><p>2. Validate the company reputation<br>- Is the company giving talks to security conferences around the world or locally? (not sponsor shows - not a place where you pay to talk)<br>- Is the company have any public reports or documentation to review to validate what their work looks like?<br>- Does the company have public security tools on GitHub or other online repositories?<br>- Reach out to previous clients to ask their thoughts<br>- Reach out to local security communities (non-profit, local conference, etc.) to gather objective inputs from experts in the domain.</p><p>3. If the vendor says that their solution will fix all your security issues... skip that vendor or find how they can integrate into your security controls. Remember no solution fixes everything.</p><p>4. If the vendor says that you don't need anything else for your security, no other vendor or process... skip that vendor</p><p>5. If the vendor doesn't offer you help to establish your processes to run their tool or services... skip that vendor</p><p>6. If they have a few people working in the company, all with a few years of security experience, they explain to you how the tool works (training), which process should be in build and that there's no relation to the fact that this is a magic solution you are on a good track and should continue to work with this vendor! Congrats! </p><p>Common sense<br>All in all, it's common sense, but weirdly, we trust companies by default. It's not because a company exists that they have the experience nor do they have the knowledge to help you.</p><p>Hoping your research in a security vendor will be easier in the future.</p><p>And if you found this interesting, let me know! <br><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/smbs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>smbs</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/guide" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>guide</span></a> <a href="https://infosec.exchange/tags/miniguide" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>miniguide</span></a></p>