Post banner
Cloud Security 6 Min Read

11 Questions to Ask Before Investing in a Cloud Security Solution

Whether you’re in security, operations, or another related discipline, choosing the right cloud security products can be a complex process. With thousands of options, each with their own nuances, how do you know which tool, or mix of tools, is going to be right for your organization? The following questions are designed to help you identify the solutions that will fit your specific needs and requirements. Use them as you make your decision, and the entire process will be much more seamless.

1. Will the security product support you throughout the risk-management process?

Managing risk is an ongoing process that needs to be handled strategically. You can’t afford to have gaps in coverage, but you also probably don’t have time or resources to manage multiple  tools to get the job done. So you want to be sure that, whichever solution you choose, it can help with the four main phases of risk management:

  • Identification
  • Assessment
  • Mitigation
  • Ongoing monitoring

Your goal is to identify the specific functionality of the tools that address each of these. A comprehensive intrusion detection platform (see below) often covers all the above, by combining multiple detection and risk assessment techniques to monitor the security of your infrastructure — at speed and scale. Specifically, a comprehensive platform will provide a series of detection capabilities that include:

  • Behavior on the host
  • Control plane monitoring
  • Software vulnerability management
  • File integrity monitoring
  • Threat detection

Together, these five features will manage your risk end-to-end.

Intrusion Detection Platform (IDP)

Question to Ask:

  • Does the solution address all four stages of the risk management process? How does it do this?

2. Does the product work across different environments?

If your company is operating in a mixed environment, the solution you choose should too. Many solutions say they support cloud, for example, but are unable to support any hybrid or on-premises setups — which can prove challenging if you are either transitioning to the cloud or are operating both on-prem and in the cloud. To cover all your environments and for ease of management, the best option is to find a solution that supports cloud, hybrid cloud, multi-cloud, on-premises, and containerized environments in a single console.

Question to Ask:

  • What types of environments does the solution support?

3. Will the product help you achieve both security and compliance?

Whether you are shopping for a vendor because of a security need or a compliance need, look for a solution that addresses both issues in one. Even if you just have a compliance need right now, why spend money on a tool that can’t help you later on with your security goals? Be smart with your budget and look for tools that do more than check a single box — look for vendors that can keep your systems both secure and compliant.

Question to Ask:

  • Does the solution offer both security and compliance features?

4. How much time will this product save you vs. how much time will you need to put into it?

While many security tools are designed to save you time over the long run, you want to be sure they are not going to require a lot of front end work to get them up and running. Many companies buy security tools to become more efficient, but often they don’t understand the time investment required to get real value out of them. Before making a decision, be sure you understand the Total Cost of Ownership (TCO). Getting details from the vendor on setup, integration, and deployment requirements will make this clear to you.

Questions to Ask:

  • What does the deployment process look like?
  • How quickly will we start seeing a return on investment?
  • What kinds of efficiencies can we expect to see by using this tool?

5. How experienced does a person need to be in order to run this product?

Will you need a full-time, experienced  employee to write custom code in order to deploy the product into your security environment, or can you put a junior engineer on it for a few hours? Clarify this question with the vendor so you can determine who on your team will need to be involved. The answer to this question, as with the one above, will help you calculate the TCO of the product and indicate whether you can get real value out of it based on the resources you have available.

Questions to Ask:

  • Who in your company should be the owner of a tool like this?
  • What are the operational and maintenance requirements?

6. How will this product help you differentiate between day-to-day activity and actual problems?

The goal of using many security tools is to help your team do things better and faster. So, the right tools should be able to do most of the heavy lifting for you — suppressing the noise and raising the flag only when there’s an actual problem. If it can’t help you do this quickly, accurately, and without much human intervention, it may end up slowing you down rather than enabling you to speed up operations.

Question to Ask:

  • How does the product sort through daily events and then notify me of issues?

7. If you’re compromised, what will the process look like? How will this product fit in?

Today, it is not a matter of if, but when, a security incident will happen. As a security professional, it’s your job to plan for these worst-case scenarios. To that end, you need to know how the tool you’re evaluating will help during the incident response process. Knowing where it fits in and how it can accelerate Mean Time To Response (MTTR) will tell you if it will be truly useful when you will need it most.

Questions to Ask:

  • How does this product help me during incident response?
  • What kind of data will it provide me that will aid in formulating a response?

8. Does this vendor use their own products?

If a vendor doesn’t eat their own dog food, that should be a big red flag. After all, if the company itself doesn’t find the product useful or robust enough, why should you? If they do use it internally, it can be helpful to hear firsthand how they use it and how it makes their team more effective or efficient.

Question to Ask:

  • Does the vendor use this product internally? If so, how? If not, why not?

9. What is the product’s stability and performance record?

When a security incident hits, you need to be sure your tools are firing on all cylinders. That is why it’s important to know how stable and reliable a security tool is before buying it. Here are several things to look into:

  • Uptime and service reliability
  • Performance on SLAs
  • Certifications
  • Customer attestations
  • How long they’ve been in business

Together, these questions can reveal a lot about the product and how well it will serve you, not only day-to-day, but in times of crisis.

Questions to Ask:

  • What is the uptime and service reliability guarantee?
  • Can we speak to a few of the vendor’s existing customers?

10. Does the vendor provide good tech support and customer service?

Before investing in any solution, be sure you are comfortable with the level of support the company provides. If something goes wrong with the product or you need further information on how to use it, you should be able to reach out to the company for help. Look to see how comprehensive their phone and email support are, and whether they offer additional training, or other resources that will be helpful to you.

Questions to Ask:

  • What level of support will I receive both during setup and on a day-to-day basis?
  • What about in an emergency scenario?

11. Will this vendor continue to evolve as technology changes?

Given the speed at which technology is changing today, you don’t want to be left in the dust with an expensive and outdated tool. It’s fair to ask a vendor what their product roadmap looks like and see how they plan to keep up with the pace of innovation. You need to feel confident that the technology you choose today will suit your needs tomorrow and that you are not going to wind up wasting money on a solution that you will have to rip and replace in a few years.

Questions to Ask:

  • What does the vendor’s product roadmap look like?
  • How does the vendor keep up with the latest security requirements?

Mastering the Vendor Selection Process

With these questions in hand, you can feel confident that you are getting the information you need in order to make an intelligent decision. By treating security as a serious investment, you will be better prepared to meet your organization’s needs now and well into the future. When you are able to identify solutions that are truly well-built by experienced, customer-centric vendors, you can deploy an effective security strategy within your organization — one that will deliver ROI from Day One and also scale as your company grows.

For a full framework on buying cloud security solutions, be sure to download a free copy of our eBook: The Cloud Infrastructure Security Buyer’s Guide.