Understanding Managed Detection and Response – and what to look for in an MDR solution | WeLiveSecurity

The
threat
landscape
is
evolving
at
breakneck
speed
and

corporate
cyberattack
surfaces
expand,
with
many
trends
and
developments
kicked
into
overdrive
as
a
result
of
the
surge
in
digital
transformation
investments
during
and
after
the

COVID-19
pandemic.

But
the
growth
of
the
attack
surface
often
results
in
a
gap
between
attackers
and
defenders
–
across
skills,
capabilities
and
resources.
Fortunately,
there
are
things
that
corporate
security
teams
can
do
to
(re)gain
some
of
the
initiative,
for
example
ensuring
that
their
approach
is
proactive
and
considers
prevention,
detection
and
response,
including
possibly
by
outsourcing
capabilities
to
expert
industry
partners.

Managed
detection
and
response
(MDR)
combines
all
this.
But
not
all
solutions
are
created
equal,
so
let’s
take
a
look
at
why
your
organization
may
need
MDR,
and
five
key
things
to
look
for
in
a
service
offering.

Why
you
need
MDR?

The
pandemic-era
surges
in
investments
can
be
observed
in
trends
such
as:

• 
  Rapid
  adoption
  of
  cloud
  computing
  which
  is
  outpacing
  internal
  skills,
  leading
  to
  
  misconfigurations
  that
  expose
  organizations
  to
  attack.
• 
  An
  emerging
  
  hybrid
  workplace
  which
  means
  potentially
  more
  unmanaged
  machines
  at
  home
  and
  more
  distracted,
  risk-taking
  employees
  using
  them.
• 
  A
  surge
  in
  
  supply
  chain
  complexity
  that
  provides
  attackers
  with
  opportunities
  to
  
  target
  managed
  service
  providers
  (MSPs),
  upstream
  open
  source
  repositories
  and
  smaller
  suppliers.
• 
  Ransomware
  as
  a
  service
  (RaaS),
  which
  has
  democratized
  the
  ability
  to
  launch
  sophisticated
  multi-stage
  ransomware
  attacks.
• 
  Use
  of
  legitimate
  tooling
  for
  lateral
  movement,
  which
  makes
  it
  harder
  to
  spot
  the
  tell-tale
  signs
  of
  a
  breach.
• 
  A
  cybercrime
  underground
  saturated
  with
  breached
  data,
  possibly
  making
  it
  child’s
  play
  for
  attackers
  to
  sneak
  past
  perimeter
  defenses
  using
  legitimate
  credentials.
• 
  A
  mature
  cybercrime
  economy
  where
  individual
  players,
  such
  as
  Initial
  Access
  Brokers
  (IABs),
  all
  have
  a
  clearly
  defined
  role
  in
  the
  attack
  supply
  chain.
• 
  An
  increase
  in
  published
  CVEs
  that
  gives
  threat
  actors
  even
  more
  opportunities
  to
  compromise
  their
  targets.

All
of
these
trends
and
more
make
compromise
more
likely.
2021

saw
publicly
reported
data
breaches
in
the
US
hit
an
all-time
high.
And
it
makes
those
incidents
harder
to
detect,
and
more
costly
to
contain.
The
mean
time
to
identify
and
contain
a
data
breach

now
stands
at
277
days,
and
the
average
cost
is
US$4.4
million
for
2,200
to
102,000
compromised
records.

When
prevention
is
not
enough

In
this
context,
a
preventative
approach
to
security
simply
isn’t
good
enough.
Determined
threat
actors
will
always
find
a
way
into
your
corporate
network—if
not
via
vulnerability
exploitation,
then
by
using
breached,
phished
or
brute-forced
credentials.
That
means
you
must
add
threat
detection
and
response
to
preventative
efforts.
This
approach
posits
that
if
attackers
get
past
your
defenses,
you
have
the
continuous,
granular
monitoring
in
place
to
spot
any
signs
of
suspicious
activity
before
the
bad
guys
have
had
a
chance
to
make
an
impact.
Your
SecOps
team
rapidly
responds
to
contain
the
incident
before
it
becomes
a
serious
breach.

Extended
detection
and
response
(XDR)
is
an
increasingly
popular
way
of
achieving
this.
It
combines
critical
detection
capabilities
across
endpoint,
email,
cloud
and
other
layers
plus
response
and
remediation
to
stop
attackers
in
their
tracks.
However,
for
some
organizations,
XDR
isn’t
a
panacea.
Its
usefulness
can
be
limited
by:

• 
  In-house
  skills
  gaps
  which
  mean
  there
  are
  few
  trained
  analysts
  to
  operate
  the
  XDR
  tooling
• 
  Deployment
  and
  management
  challenges,
  again
  due
  in
  part
  to
  staff
  shortages
  and
  particularly
  acute
  when
  managing
  XDR
  across
  multiple
  regions
• 
  High
  cost
  of
  staffing
  and
  buying
  and
  maintaining
  the
  right
  XDR
  tools
• 
  Alert
  overload
  from
  tools
  that
  fail
  to
  accurately
  prioritize
  threats
  for
  stretched
  analysts

That’s
why
MDR
is
increasingly
favored.
It
effectively
hands
over
management
of
XDR
to
an
expert
outsourcing
provider,
meaning
that
their
trained
analysts
handle
threat
detection,
prioritization,
analysis
and
response.
However,
with
so
many
solutions
on
the
market,
how
can
you
choose
the
right
one
for
your
business?

Five
things
to
look
for
in
an
MDR
vendor

MDR
is
at
its
best
a
blend
of
industry
leading
technology
and
human
expertise.
They
come
together
in
what
is
ostensibly
a
managed
Security
Operations
Center
(SOC)
where
skilled
threat
hunters
and
incident
managers
analyze
the
output
of
tooling
to
help
minimize
cyber-risk.
Here
are
five
things
to
look
for
in
a
service:

• 
  Excellent
  detection
  and
  response
  technology:
  Shortlist
  providers
  whose
  products
  are
  well-known
  for
  high
  detection
  rates,
  low
  false
  positives
  and
  a
  light
  overall
  footprint.
  Independent
  analyst
  appraisals
  and
  
  customer
  reviews
  can
  help.
• 
  Leading
  research
  capabilities:
  Vendors
  that
  run
  renowned
  virus
  labs
  or
  similar
  will
  be
  best
  placed
  to
  stop
  emerging
  threats.
  That’s
  because
  their
  experts
  are
  researching
  new
  attacks
  and
  how
  to
  mitigate
  them
  every
  day.
  This
  intelligence
  is
  invaluable
  in
  an
  MDR
  context.
• 
  24/7/365
  support:
  Cyberthreats
  are
  a
  global
  phenomenon
  and
  attacks
  could
  come
  from
  anywhere,
  so
  MDR
  teams
  must
  be
  monitoring
  the
  threat
  environment
  at
  all
  times
  of
  day
  and
  night.
• 
  Top
  quality
  customer
  service:
  The
  job
  of
  a
  good
  MDR
  team
  isn’t
  just
  to
  detect
  and
  respond
  rapidly
  and
  effectively
  to
  emerging
  threats.
  It’s
  to
  act
  like
  an
  extension
  of
  the
  in-house
  security
  or
  SOC
  team.
  This
  should
  be
  a
  partnership,
  not
  simply
  a
  commercial
  relationship.
  That’s
  where
  customer
  service
  comes
  in.
  Providers
  should
  marry
  hyperlocal
  language
  support
  with
  global
  presence
  and
  delivery.
• 
  Services
  tailored
  to
  order:
  No
  two
  organizations
  are
  the
  same.
  So
  MDR
  providers
  should
  be
  able
  to
  customize
  their
  offerings
  for
  each
  client,
  based
  on
  their
  size,
  the
  complexity
  of
  their
  IT
  environment
  and
  required
  level
  of
  protection.

The
global
MDR
market

is
predicted
to
grow
at
a
CAGR
of
16%
over
the
coming
five
years
to
reach
US$5.6
billion
by
2027.
With
so
much
at
stake
and
so
many
vendors
out
there,
it
pays
to
do
plenty
of
due
diligence
before
making
your
decision.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts