Case Study byJason Briody, Information Security Officer, KMD Brands
Background
KMD Brands is a global outdoor, lifestyle, and sports company, consisting of three iconic brands: Kathmandu, Rip Curl, and Oboz. Our company's purpose is to inspire people to explore and love the outdoors.
Like many retail businesses, we hold information about our customers, their orders with our brands, and other sensitive data. We take the security of this information very seriously – a major security incident could cause reputational damage, harm customers, or impact our ability to trade – so to help protect our information and networks, we partner with companies like The Missing Link.
The Goal
Our ultimate goal when engaging The Missing Link was to be alerted to any high priority security issues ASAP.
With detection being an essential part of the NIST Cyber Security Framework, we wanted to improve our ability to detect and respond to threats quickly.
The Selection Process
We went to market to find a partner for our Security Information & Event Management (SIEM) and penetration testing in 2020.
We sent out a Request for Proposal to several providers, then narrowed the responses down to a handful that we invited in. Each provider was asked to present their SIEM platform, how they would implement the technology, and what a managed SIEM service would look like for our business.
The Missing Link stood out – their technical team was head and shoulders above the other vendors we evaluated. We felt confident they knew the history of the cybersecurity, digital forensic, and incident response industries, and were familiar with the technologies and principles we were discussing. They understood and articulated the biggest risks to our business as a retailer and explained how the tooling they’d implement would mitigate those risks.
While some vendors were quite abstract about the details of their recommendations, I liked the fact that The Missing Link was prepared to let us interact with the tooling they recommended. We really wanted to understand the data they would be receiving and reviewing – and they facilitated that.
Even The Missing Link team members who weren’t technical experts in cybersecurity were responsive to our needs. They were happy to interpret the issues facing our business and worked closely with us to resolution. Other vendors tended to dance around issues they weren’t familiar with.
In terms of cost, The Missing Link was at parity with the other vendors. The priority for us was to engage with a strong security partner for our SIEM project, and The Missing Link fit the bill and the budget.
The Relationship
We have an excellent rapport with The Missing Link team. While we did provide feedback on some aspects of the implementation we felt could be improved, our day-to-day lines of communication are very open – the regular SIEM-as-a-Service calls between the KMD Brands Security Team and The Missing Link are calls I can honestly say I look forward to.
Similarly, when dealing with a different team for a penetration test on one of our eCommerce sites there were no issues – their communication was very clear, as was their reporting. The way they described mitigations and their roadmap for remediation were clear. It's not easy for people to communicate complex issues in a straightforward way, and I appreciate that they did this well. Based on this positive experience, we will use them for future penetration tests. I’m actually scheduling a few with them right now.
The Difference
Personally, it's good to have a partnership with a company like The Missing Link. Being able to pick up the phone and ask for recommendations on specific issues makes our job easier – we're really able to leverage their knowledge.
I feel comfortable calling them to ask for advice on other projects, and they're always happy to help. They've even provided scoping sessions with an architect at no charge and introduced us to other vendors’ tool suites, whether they were working with those vendors or not. Again, being able to seek opinions from various individuals makes a difference.
For KMD Brands, it's good to have confidence in The Missing Link's technical abilities, especially when dealing with some of the most sensitive data we hold…including the security of our customers' information.
