Managed detection and response

Managed Detection and Response (MDR) is an outsourced service that provides organizations with services to detect cyber threats and eliminate them once they are discovered. The MDR service combines both technology and human expertise to ensure the defence of clients. The detection service is primarily and actively dedicated to the detection of cyber threats prior to the occurrence of a cyber attack.

What does the MDR department do for an organization?

MDR solves an important problem that is affecting more and more companies: the lack of security skills within organisations. While training and the establishment of specialized security teams capable of hunting down threats on a full-time basis may be feasible for large organizations that can afford it, most companies will find this proposition difficult given their limited resources. This is particularly true for medium and large organizations that are often the target of cyber attacks, but lack the resources or manpower for such teams.

Even organizations that are willing to spend time and money may have difficulty finding appropriate personnel. Indeed, the skills required to be able to recognize signals related to a cyber attack are scarce even among computer security specialists.

The second reality is the inability of companies to juggle a variety of security tools that require unique knowledge to make them work. As a result, organizations find themselves with a series of security tools that are inadequately configured to meet their security needs. The MDR service, using its own technology, always offers the optimal configuration for the customer. StreamScan has developed its own artificial intelligence technology to maximize detection rates for its clients.

An often overlooked issue when it comes to cybersecurity is the volume of alerts that security and IT teams receive on a regular basis. Many of these alerts cannot be easily identified as malicious and need to be verified on an individual basis. In addition, security teams need to correlate these threats, as correlation can reveal whether seemingly insignificant indicators all add up as part of a larger attack. This can overwhelm small security teams and rob them of valuable time and resources for their other tasks.

MDR aims to solve this problem not only by detecting threats, but also by analyzing all the factors and indicators involved in an alert. MDR also provides recommendations and changes to organizations based on the interpretation of security events. One of the most important skills that security professionals need is the ability to contextualize and analyze compromise indicators in order to better position the organization against future attacks. Security technologies may have the ability to block threats, but digging deeper into the how, why and what of incidents requires a human touch.

The MDR is designed to address the problem of an organization's lack of cybersecurity expertise. It addresses the more advanced threats that an in-house IT team cannot fully address, ideally at a lower cost than what the company would have to spend to build its own dedicated security team. The MDR can also provide the organization with access to tools that it does not normally have access to.

How does the MDR compare to the Managed Security Service (MSS)?

Organizations have traditionally turned to Managed Security Service (MSS) providers for their external security needs. Unlike MDR vendors, who can detect lateral movement within a network, MSSPs typically use perimeter-based technology as well as policy-based detections to identify threats. In addition, the types of threats faced by SSGs are known threats, such as vulnerability exploits, recurring malware, and high-volume attacks. SSGs have security professionals who manage, monitor, and analyze logs, but often at a low level of detail. Essentially, GSU is able to manage an organization's security, but usually only at the perimeter level, and their analysis does not involve extensive forensic analysis, threat research, and analysis. Teams providing GSD have a more in-depth knowledge of computer attacks and how to prevent them.

In terms of service, MSSPs typically communicate by email or telephone, with security professionals as secondary access, while MDR providers provide 24/7 continuous monitoring, which some GSUs may not offer.

However, the MSSPs continue to provide added value to organizations. For example, managing the firewalls and other day-to-day security needs of an organization's network is a more appropriate task for a GSU than a DRG provider, which offers a more specialized service. As a result, GSS and MDR vendors can work together - with MDR vendors focusing on proactive detection and behavioural analysis of more advanced threats and providing remediation recommendations for organizations once threats are discovered.

StreamScan and its MDR?

StreamScan's MDR provides a wide range of security services, including alert monitoring, alert prioritization, investigation and cyber threat tracking. It uses artificial intelligence models and applies them to computer, network and server data to correlate and prioritize advanced threats. StreamScan's team of specialists invests all their energy in detecting and preventing the next computer attack on its customers' computers.

How do you track down cyber threats?

Detection

StreamScan's threat trackers continuously monitor machine-to-machine communications at the heart of the organization. They perform advanced analysis to look for specific indicators of compromise and then make decisions in terms of threat priority.

Analysis

Once a detected potential threat is correlated and prioritized, a team of qualified personnel investigate the origin and scope of the attack, after which a detailed analysis of the threat and its impact is determined.

Response

StreamScan trackers alert the organization to the incident and will also provide root cause analysis, security recommendations and toolkits to help the organization manage the incident.

To learn more about the Managed Detection and Response service contact a StreamScan Cyber Security Advisor.