If there’s one thing the past decade has shown us, it’s that change happens faster than even expected. Looking across today’s enterprise customer, we’ve seen applications become more modular and containerized and data being shared and analyzed in new ways. Adding to this, infrastructures today are more often spread across hybrid multi cloud environments.
Changes across each of these domains and a workforce that has more recently been developing codes from home is a double-edged sword. It puts a growing pressure on security teams to maintain visibility and to detect and respond to threats. Any lack of visibility, plus a lack of time, skilled staff and an increase in alert fatigue, has placed most IT teams in an unstable area.
What is Managed Detection and Response?
Endpoints remain the key high ground between defenders and attackers. To hold this advantage, security teams need to do many things simultaneously. Their jobs require increased accessibility, better telemetry, increased remote forensics and more granular containment and response options. And of course, all this needs to be run by a well-trained team of experts. These driving factors have fueled significant adoption of managed detection and response (MDR) services. According to a recent 2020 study by Verizon, 94% of respondents not already using an MDR service are currently evaluating or have plans to evaluate MDR over the next 18 months.
So how does an effective MDR service helps clients achieve their goals through the lenses of four key strategic outcomes:
Align your security strategy to your business.
Protect your digital users, assets and data.
Manage your defenses against growing threats.
Modernize your security with an open, multicloud platform.
Align Your Strategy to Your Team
In general, alignment is thoroughly knowing the business and showing how the security strategy enables its success. In the context of MDR, this knowledge and practical work take many forms.
Know What Data Is Most Important
It starts with knowing that not all assets should be treated equally. There are benefits to assessing and pinpointing the most critical assets ahead of time. In order to do this, MDR analysts should know the business well; know its core products and services; and know the users, data and critical systems required to deliver them.
Both the MDR provider and their client should know which assets are the highest priorities and have the most material impact before an incident happens. For example, production servers should take priority above legacy dev systems slated for decommission. While the latter is fast and easy to address, the former could impact the bottom line. MDR analysts can demonstrate their alignment with the business by simply knowing these details in advance.
Focused Hunts
Nearly all MDR services offer or include a threat hunting component, though definitions, methodologies and implementations vary widely. While most industry experts agree threat hunting is helpful, it can be challenging for security teams to demonstrate how hunting directly supports business objectives.
One way to show alignment is for MDR service providers to demonstrate how hunts are customized and directly relevant to high-value assets such as key identities, critical systems or sensitive data. Another method is to demonstrate how MDR service providers are incorporating threat intelligence relevant to the organization into the hunts, perhaps based on geography or threats to the client’s industry.
Make The Risks and Responses Clear
When working with an MDR service provider, communication can be the lifeblood that determines success or failure at all levels. When communication speed, depth, accuracy, medium, frequency and audience have to be just right nearly all the time, it can be one of the hardest things to perfect. This is amplified by the fact that all MDR service providers contend with client scaling challenges at some point.
Clients want MDR service providers that explain risks clearly, succinctly and in terms that are relevant and practical. Throughout the partnership, MDR service providers can demonstrate higher value by helping customers understand month-over-month and year-over-year gains in overall security posture. They can provide a report card showing the impacts of the strategic investments and related improvements.
Managed Detection and Response In a Fast Changing World
Aligning an MDR service to the unique needs of the business first requires knowing what the objectives are. This can be obtained in a number of ways, including regular assessments and workshops to prioritize and clarify goals. When looking for a MDR provider, ask these questions:
How does your MDR provider prioritize your most critical assets?
How does your MDR provider demonstrate how it uses that data to monitor, detect, investigate and hunt?
Does the MDR provider clearly communicate in a way that demonstrates its understanding of the business and how it aligns to the organization’s strategy?
Let us know if you enjoyed this short article and we will expand on this series expanding on MDR thoughts and observations.
Opmerkingen