January 27, 2023
For most organisations, cyber security is a secondary function. It’s essential, but it can feel like a distraction from their true business.
For these organisations, trying to build and maintain a cutting edge cyber security program—including real-time threat detection and response capabilities—is typically expensive, time-consuming, and frustratingly ineffective.
Thankfully, there’s an alternative: MDR.
What is Managed Detection and Response?
MDR stands for Managed Detection and Response—a catch-all term for managed security services related to security operations and incident response. Provided by a Managed Security Services Provider (MSSP), MDR services can extend an organisation’s in-house security or IT capabilities or complement an existing outsourced IT provider.
A quality MDR service combines cyber security technology, expertise, and architecture to maximise the efficiency of the customer’s entire IT infrastructure and provide thorough protection across the full attack surface. Precise implementations vary depending on the customer’s needs.
For example, an SME likely has very different needs compared to a much larger organisation, both in terms of the IT infrastructure to be protected and the level of support required. Similarly, an MSSP would provide a different level of MDR service for a business that already has some full-time security personnel compared to a business that outsources IT altogether and has minimal security in place.
Common MDR Components
While there is no standard framework for MDR services, most quality implementations include the following:
Endpoint Detection and Response (EDR) — technology and processes designed to detect, investigate, and contain security incidents on endpoint devices, e.g., laptops, smartphones, servers, etc. This generally involves a combination of an EDR solution to identify possible incidents and create alerts and a human analyst to investigate, triage, and remediate.
Network Detection and Response (NDR) — similar to EDR but aims to detect suspicious and malicious behaviours at the network layer. This usually combines an NDR solution to monitor and analyse raw network traffic with a human analyst to further triage, investigate, and respond to alerts.
Security Operations Centre (SOC) — a team of experienced analysts dedicated to detecting, assessing, and preventing cyber threats. Typically, a SOC team operates 24/7/365 by rotating team members in shifts. In addition to EDR and NDR, an effective SOC is armed with various monitoring, analytics, and intelligence tools to support incident detection, investigation, and response.
By combining these capabilities—plus others required to meet a customer’s specific needs—an MDR provider has everything in place to detect, investigate, and respond to threats arising anywhere in the customer’s IT environment.
The MDR Workflow
While each provider naturally has its own operating protocols, most MDR services follow an incident workflow that roughly resembles the following:
Detect. While many threats are prevented at their source by protective solutions like firewalls, many more evade these controls. The MDR provider detects these threats by collecting activity logs and telemetry from across the entire IT environment and using a combination of automation and expert human analysis to distinguish between legitimate usage and suspicious or malicious activity.
Prioritise. When an incident is identified, the next step is to determine its severity. MDR providers use a combination of human expertise, real-time threat intelligence, and advanced data analytics—plus a detailed understanding of the customer’s environment—to identify the highest priority threats for immediate attention.
Investigate. Once prioritised, an experienced human analyst thoroughly investigates each incident to eliminate false positives and identify any steps needed to remediate threats. This step relies on a combination of analyst expertise and security tooling.
Respond. Many security incidents require prompt, accurate remediation steps to avoid harm to the customer’s environment or data. In most cases, it’s not practical (or desirable) for MDR providers to have full administrator access to a customer’s IT environment. Instead, providers typically identify the correct steps and guide the customer’s IT or security personnel or outsourced provider to ensure full remediation.
Learn. An expert MDR provider continuously learns from the incidents and activity observed in a customer’s IT environment, providing guidance on how to prevent similar incidents from occurring again in the future.
Redesign. MDR providers should support customers to continuously tighten their security programs by redesigning systems, technology stacks, and processes to minimise cyber risk and protect key assets and data from evolving cyber threats.
What Benefits Should You Expect?
Should your organisation work with an MDR provider?
- Always-on threat coverage. An MDR provider can deliver 24/7/365 coverage at a fraction of the cost of building the same capabilities in-house. For most SMEs—and even some larger organisations—the cost of developing serious threat protection capabilities is prohibitive, while working with an MDR provider is much more realistic.
- Rapid scaling. Similar to Security Operations Centres (SOC), scaling is one of the toughest parts of building in-house threat prevention capabilities. However, this consideration is avoided altogether when working with an MDR provider—the provider can instantly scale the service as needed to fit the customer’s changing needs.
- Protection against the latest threats. The threat landscape is constantly evolving, necessitating a continual investment in training, tooling, and process redesign to protect an organisation against the latest threats. An MDR provider can easily absorb this cost, as these services are core business functions.
- Faster threat detection and remediation. Due to scale, investment, and staff expertise, an MDR provider is typically better equipped to quickly and effectively detect threats to a customer’s environment than an in-house team.
Is MDR Right for Your Organisation?
For some organisations, it’s worthwhile to invest in building and maintaining world-class cyber security capabilities even though their core business lies elsewhere. However, for many, managed alternatives like MDR are simply more cost-effective and provide a greater security ROI.
Want to see how MDR could protect your organisation from evolving cyber threats at a substantially lower cost than developing the same capabilities in-house? CyberOne provides the UK’s most advanced MDR service, delivered from our award-winning Cyber Defence Centre in Milton Keynes.
To find out how CyberOne can help protect your business, contact us today.