(Full disclosure: I build and run software pen-testing and security teams as a sub-function of building security software, and developing software securely. My company is not listed in any of the services recommendations below.)
Should you build a security team or pen-testing team?
While a few responders here have alluded to internal penetration testing, building and maintaining such a team is difficult to impossible for many organizations, particularly smaller companies that are not in the security business. These skills are hard to come by in hiring. If you choose to train internal staff then you bear an increased attrition risk on top of the monetary and opportunity cost of training. The risk is that once the skills are acquired the staff with such skills are in high demand in the industry so most companies experience increased attrition from such personnel because there are plenty of other companies willing to pay top dollar for those skills. (BTW, I do recommend training your staff on security, but not necessarily investing as deeply as what would be needed to "build a pen testing team".)
Hire a 3rd-party so you can focus on your core business.
My recommendation for a company your size would be to enlist the skills of a commercial firm that specializes in penetration testing. This buys you legitimacy in the eyes of your management and executives. Rather than "that security guy over in IT" telling us we need to improve security, it's coming from a company that helps secure the likes of Fortune 1000 companies.
Example pen testing companies include Core Security, Offensive Security, Trustwave, and Cigital -- whose CEO (Gary McGuire) literally "wrote the book" on software security. To avoid confusion, the service you're looking for is called "network penetration testing". (The "network" term distinguishes it from "software penetration testing". This is important because if you do general searches on "penetration testing" you'll find plenty of firms that specialize in testing new software before it's released, which also happens to be called "penetration testing." I personally refer to that aspect of software security testing as "vulnerability analysis", but that would need to be a separate post on the Secure Software Development Lifecycle.)
Don't surprise your executives with a successful breach.
The most important thing is to ensure that someone at the CxO or Board level is informed and involved ahead of time, before the testing starts. (Otherwise you're inviting legal problems since these types of attacks are illegal if the company didn't specifically request them to be performed.)
Pen Testing is a good way to show that real issues exist. A good pen tester will actually breach a system and obtain private data in order to show the severity of the issue. However, how do you generate enough interest to gain the support for pen testing? You can use the following methods to gain support for deploying AntiVirus, for Pen Testing, or for any legitimate work that needs to be done to harden your infrastructure, control your risk, and protect your customers.
How to Generate Support
1. Appeal to the company's natural desire to limit risk and liability, while defending against competitors.
Just a few examples...
a. Company or Executive liability.
The CEO and board of directors can be held personally liable if they're shown to have known that a business risk existed and they did nothing to remediate the risk. So, you can leverage this (gently) in your communication. Once they're on board with the need to self-assess, they may even elect to conduct physical pen testing of the company premises. (i.e., Talk your way past the front desk by pretending to be the fire marshall, then during the "fire inspection" install key-logging USB sticks that phone home, on all the machines.)
b. Costs or lost revenue from PCI-DSS.
If you receive payments through credit cards, the PCI-DSS "standard" mandates that certain security solutions must be implemented within the business infrastructure. Credit card companies have come up with this as a way of shifting the liability for fraudulent transactions from them, to you (the customer-facing business). If you were to be audited (and I'm dealing with a medium-sized business that's being audited right now), you could be forced to bring in 3rd-party security vendors or managed-service-providers to assess and implement security, all at a much higher cost than you could do on your own, or risk being cut off from processing by Visa, MC, and/or AmEx until you can prove that you've corrected the issues and have paid for an independent audit. You should seek more info on this on your own, as this is a real-world liability that's showing up for more and more businesses.
c. Downtime and revenue-impact from government intervention.
The FBI monitors internet traffic for signs of malware infections phoning home. I've been involved in several instances where the FBI contacted a business and told them that their network was infected. The risk here is that they could confiscate computers or have your backbone drop(s) cut off until the exploited systems were cleaned. Since you're an ISP, if you're colo'd then you may incur costs from the colo facility for them to have personnel onsite to deal with the FBI. If you run your own data-center, then you could see servers or racks disappear or at least be taken offline for some time while forensics are performed. This downtime could be devastating to the business.
d. Competitive Attacks
Did you know that your competitors can leverage the services of an attacker-for-hire to DDOS your network to negatively impact your customers? Alternately, they could choose to attempt access to your internal systems in order to acquire sensitive business-roadmap information, or pricing, vendor, or customer lists.
e. Hackers -- aka "Security Researchers"
(For the purists our there, yes these are actually called "Crackers", but let's stick with the vernacular for now.)
An unprotected network, or insufficiently protected endpoints, could end up being the target (pun intended) of black-hat, grey-hat, or white-hat hackers. In other words, an independent 3rd-party may find a way to breach your systems for fun or profit.
Outcomes could include:
Company funds stolen through compromised banking login credentials, or directly accessed (owned) internal systems;
Having to notify your customers that your systems have been breached, and their customer data (passwords, credit-card numbers, etc) has been stolen;
Having to negotiate ransom payments with attackers to regain access to critical internal systems that they've encrypted in order to lock you out and force you to pay;
Having to negotiate with "security researchers" to gain sufficient time to patch internal systems or close security holes, before they "go public" with information that they've defeated your perimeter security or layered defense mechanisms. The more aggressive "researchers" may provide proof-of-concept tools or even detailed instructions on how to replicate the attack, so that other researchers may validate their findings (while hackers leverage the newly-disclosed info for an actual attack).
One critical point to add: By taking on the title of "IT Security Manager", you need to be aware that if one of the above outcomes actually occurs, Execs are likely to look to you with the question "how did you let this happen?" In that circumstance, they're unlikely to remember your past proposals requesting their support for security policies and programs.
2. Build awareness.
a. Share security information internally within your company. Create a custom weekly newsletter where you choose security topics most applicable to your business and add your personal analysis of the risk or applicability to your company, along with what users or the company can do for prevention. For realtime sources of information, subscribe to an RSS feed from the security industry experts (Eric Krebs or Bruce Schneier are excellent) or solution-providers (great feeds / blogs include TripWire's "The State Of Security", Symantec's "Threat Intel", Kaspersky's "Securelist", and Google's "Online Security Blog", among many others).
b. Conduct some penetration testing or vulnerability analysis of your own to highlight systems that are vulnerable to attack. I'd recommend picking up a tool that attempts to exploit network vulnerabilities such as Metasploit (great, widely used, but grab a book to guide your way) or Core Impact (expensive). You should also look into pen testing or vulnerability analysis apps that simply flag the presence of vulnerabilities, such as Cenzic Hailstorm (recently acquired by Trustwave, the pen testing company I listed above). The results probably won't surprise you, but will surprise your users when you email them the report of successful attacks against their machine(s).
The aggregate reports and stats from these tests should give you a decent set of intelligent data points to use to influence the managers, users, and executives regarding security technology program. This is also a good start to the discussion and planning for "we should conduct independent / 3rd-party pen tests on a regular basis".
More Info
Additional good sources of info:
CERT: http://www.cert.org/information-for/system-administrators/
NIST (security standards, and security and risk-management frameworks):
: http://csrc.nist.gov/
ISO (security standards): (Looks like I don't have enough reputation to post more than two links, so you'll just have to Altavista it ^H^H^H^H I mean Google it. :) )
To answer another one of your questions directly, specifically, "Is there a role/function dedicated to information security and/or information management?":
The security "position", "team", or "role" varies by company and segment. Very large companies may have a CISO (Chief Information Security Officer) and respective org. More frequently I've worked with InfoSec (Information Security, usually as part of the IT org, though sometimes part of Operations or the COO org), and occasionally NetSec and AppSec (Network Security and Applications Security, respectively). Some companies will also split out Incident Response (detecting and responding to attacks or breaches, then conducting post-attack forensics) as a separate operational function. In your role, it sounds like you could benefit by wrapping the InfoSec moniker around your role.
Good luck Akam!
[TL;DR?T*B]
