Managed Detection and Response - The Definition

Implementing an effective cyber security program against today’s cyber threats is challenging. Many companies lack the expertise, resources, technology, and domain knowledge to monitor and investigate potential breaches in their infrastructure 24/7. As a result, many small and large companies are looking to external managed services for assistance. Managed detection and response (MDR) is a specific type of managed security service that helps companies move beyond just prevention and monitoring (two strategies that continue to fail to stop successful attacks) and get ahead of the cyber attack timeline. MDR achieves this through a combination of integrated technology, monitoring, and a real-time response capability should an attack occur.

True MDR services have the following characteristics:

• MDR Services Help in Dissecting An Attack. Companies would rather avoid an attack in the first place than be exposed to one and have to pick up the pieces afterward. Some managed detection and response services, therefore, offer services that dissect the nature of the attack and then build systems around preventing a similar threat from causing damage in the future.
• MDR Is Provided Using Third-Party Tools. MDR providers use their own network solutions and monitoring tools to protect a business’s IT infrastructure. The third-party monitoring company will set up checkpoints at the perimeter of the company’s network and be vigilant for any potential threats.
• Most Detection is Done by Humans. Although some companies offer automated security tools, the best are usually operated by humans. People are in a unique position to identify any security breach and then inform the customer of any potential security issues.

• Overcomes Lack of Internal Security Talent. Cybersecurity experts are currently in high demand and the job market cannot supply the rapidly growing need. Finding and keeping qualified cybersecurity professionals is both costly and challenging, making it almost impossible for organizations without large IT security budgets to hire the experience they need. Small and medium-sized businesses are disproportionately affected but even large organizations struggle to meet their staffing needs. External services, like MDR, alleviate this challenge. With MDR, small to large companies augment their security staff and expertise overnight.
• Helps Businesses Respond to Threats. Although some firms have the capacity to detect threats, many have neither the skill set nor the knowledge to respond to and neutralize them. Implementing, managing, and monitoring complex end-point detection systems takes time and skill, something that many small- and medium-sized businesses lack. MDR helps companies detect and respond to threats faster and more efficiently than most organizations can internally achieve due to technology, expertise, and an exclusive focus on security. Good MDR services analyse possible threats within minutes and can conduct an active response in just as much time.
• Helps Manage Alert Volume. The sheer volume of security alerts from traditional security solutions often overwhelms organizations. As a result, many organizations stop actively monitoring them or only monitor a subset of IT activity. Chasing false positives quickly fatigues an internal security team. Although indicators of compromise (IOCs) may be present, a lack of resources or complacency can cause analysts to miss early suspicious events. MDR services leverage technology and expertise to better monitor an environment and catch IOCs earlier, stopping a breach from becoming a large-scale compromise.
• Solves the Skills Gap. Many companies struggle with a skills gap between their IT professionals and the rapidly-changing nature of today’s cyberattacks. Hiring challenges were addressed earlier. Unfortunately, simply hiring more staff does not ensure they have the experience to close outstanding skill gaps. MDR helps mitigate this problem by providing organizations with the components of a sophisticated security team without the price tag.
• Resolves Underlying Security Flaws. Most companies unwittingly and unnecessarily expose themselves to security breaches through bad practice. Since good MDR services are actively monitoring an infrastructure’s attack surfaces and actively threat hunting they can identify existing or previously unknown issues that can be remediated to help prevent attacks. Often, companies need outside help to identify these issues and instruction on how to remediate them and MDR services offer this capability.

MDR is a more active, endpoint-focused, advanced threat-focused security service than most traditional managed security services, like log monitoring and firewall management. Most managed security service providers (MSSPs) offer some “perimeter protection” and monitoring. However, they often rely on automation and detection of known bad to generate alerts; very few regularly threat hunt or delve deeply into the security practices of an organization. Furthermore, most only offer monitoring and have little to no response capability should a breach occur. They may provide instructions or remediation steps, but stop short of actively responding to a breach (or charge a significant amount extra to provide incident response support).

MDR, on the other hand, ensures defense not only at the perimeter but also monitors the internal activity of organization, especially its user activity, privileged accounts, and lateral movement. In addition, MDR does not rely solely on automation, but pairs it with knowledgeable security experts who maintain knowledge of the latest hacker tradecraft and techniques and can analyse the nuances of a suspicious event.

A key differentiator as mentioned above, is an MDR service’s ability to respond to incidents. Managed security service providers will often provide limited real-time response capabilities and rely on the organization its monitoring to remediate or detain compromises. True MDR services have the capability to remotely resolve and remediate around the clock ensuring any breaches are quickly isolated and contained. Examples of response may include endpoint isolation, process kill, file hash captures, etc. MDR, therefore, offers more of a bespoke service explicitly tailored to each firm’s security needs.

Cyber adversaries are well aware that organizations are running a suite of traditional security products with many focused at perimeter protection. They also know that many organizations have limited resources or knowledge to defend against the latest tactics and techniques and monitor 24/7. In order to stay ahead of the hackers, organizations are utilizing Managed Detection and Response (MDR) to augment their security technology and staff and ensure they maintain the upper hand in the cyber security.