Managed Detection and Response cover Giacomo Lanzi

Managed Detection and Response: a new preventive approach

Estimated reading time: 6 minutes

The constant use of communications over the network in a corporate context makes it essential to take precautions for computer security. As we have seen on other occasions, the dangers can come from different fronts: phishing , ransomware , data breach , etc. The implementation of new strategies such as Managed Detection and Response allows to mitigate risks and identify potential threats.

In this article, we’ll take a closer look at this new approach, focusing on advanced threats and the benefits of this new approach for businesses.

Managed Detection and Response security

Advanced-persistent-threats and SIEMs

A search of CardinalOPS , carried out on Fortune 1000 companies, highlights how companies using a system SIEM , however, encounter problems of cyber attacks. This is due, as Yair Manor, co-founder of CardinalOPS, in part to the visibility . Basically, the big companies have no real knowledge of the extent of their infrastructures and this leaves some openings from which it is possible to enter.

Systems with SIEM implementation, although they guarantee good IT security, are often mishandled by internal company technicians. Research shows that only 16% of standard threat protection techniques are actually applied by employees . Interesting data that show how an average of 25% of SIEM rules are violated or even never activated by security officers. It is therefore not easy to determine what are the best criteria to apply once the cyber attacks have occurred.

Among the 1000 companies surveyed, many of them invest considerable capital, in the billions of dollars, in order to identify the greatest number of correlations and events related to the corporate attack.

The process of constant improvement of SIEM systems underlines how this can be a real solution with a centralization and rationalization of the flow of incidents. In addition to choosing an effective security system, it is essential to have experienced technicians to be able to use the tools correctly.

Managed Detection Services & amp; Response: what are they

As noted in the previous lines, a SIEM-based system is effective, but not foolproof . In a situation where there is uncertainty of reliability, a new strategy is born to mitigate the risk. Specifically, there was the introduction of the Security Orchestration, Automation & amp; Response (SOAR) in SOCs, capable of automating repetitive workloads and detecting false positives. We also talked about it in a specific article in which we analyzed the advantages of this approach.

As it is easy to deduce, not all companies have implemented an efficient SOC system in their company, although it is now possible to find “ as a Service ” versions such as what we offer .

In this context, where the ability to identify the anomalous threat in the shortest possible time is essential, an innovative strategy is placed: Managed Detection & amp; Response (MDR) .

This service strategy is about identifying the threat as quickly as possible and containing it before it reaches its maximum level . There is therefore a change of approach due to the need to monitor potential threats around the clock. This is possible with a dedicated service capable of carrying out surveys 24 hours a day and for the whole week .

This approach implements an advanced, intelligent analysis aimed at reporting and solving the problem. Companies that choose our SOCaaS can take advantage of a service capable of speeding up the collection process and data analysis, freeing them from potential threats .

It should also be considered that the automation of the collection and analysis phases lowers maintenance prices for the company’s IT department. An advantage that cannot be ignored, offered by the decentralization of security services, such as SOCaaS from SOD.

The advantages of MDR

In order to fully understand the potential of Managed Detection and Response, it is advisable to analyze the concrete benefits that individuals and companies find in this service.

Organizations using an MDR solution can immediately reduce detection time (and therefore response time). Threats can be identified in minutes, giving you the ability to take immediate action.

But reducing time-to-detect from months to minutes isn’t the only advantage of an MDR. Companies can also:

  • Increase resilience to potential attacks by optimizing the security configuration and eliminating rogue systems .
  • Identify and stop hidden and sophisticated threats through a continuous threat hunting .
  • Respond to threats more effectively and restore endpoints to a known state through guided response and managed remediation.
  • Redirect personnel from response work to reactive and repetitive incidents towards more strategic projects.

The incidence of ransomware

Companies know very well that one of the most difficult problems to eradicate within the corporate IT context, is the ransomware . A Managed Detection and Response strategy can defeat these threats and better manage phishing campaigns. Although employees may have a good background in cybersecurity, in many cases they are prone to trivial errors . In this regard, we recommend that you evaluate our ethical phishing service, to focus on training as a weapon against phishing .

Companies that do not have a dedicated team, in many cases manage cybersecurity with superficiality, belittling and underestimating the simplest cyber attacks. Being able to preventively eliminate a potential problem is a benefit that should not be underestimated, especially if you are bound to a continuous flow of incoming and outgoing data.

Managed Detection and Response cover

Prevention

The MDR strategy aims to prevent attacks and not to eradicate them once they are unassailable. Unfortunately, dealing with a cyber attack is particularly expensive, not only due to the difficulty of recovering the lost information, but also to restore its correct functioning.

A prevention service is the ideal answer to free yourself from potential dangers , protecting not only your company, but also the employees who can become victims in turn.

Conclusions: a concrete solution

Not all MDR services are identical to each other and it is advisable to rely on those who have been working for years and are committed to making this technology more and more effective.

The services offered by SOD, such as SOCaaS, guarantee an ideal solution for every company . Thanks to the introduction of state-of-the-art security software and solutions, SOD is in a position to offer a service aimed at the best possible prevention for corporate protection.

Customization and the choice of a dedicated service allow you to better manage company production. In an age when it is essential to protect yourself from cyber threats, a service dedicated to prevention is the smartest solution.

If you want to know how our solutions can help your business, do not hesitate to contact us, we will be happy to answer any questions.

Link utili:

SOAR: coordination for cyber security

SOAR: what it is and how it can be useful for companies

What is threat intelligence?

Use cases of a SOCaaS for companies part 2

Share


RSS

More Articles…

Categories …

Tags

RSS Dark Reading

RSS Full Disclosure

  • Disclosing Vulnerability of CLink Office 2.0 May 23, 2022
    Posted by chan chan on May 23Dear Sir/Madam, I would like to submit a vulnerability found on CLink Office 2.0. I had contacted the vendor 60 days before but in vain. # Exploit Title: Multiple blind SQL injection vulnerabilities in in CLink Office 2.0 Anti-Spam management console # Date: 30 Mar 2022 # Exploit Author: […]
  • [tool] tplink backup decryptor. May 23, 2022
    Posted by retset on May 23Yet another "tool" to decrypt a backup configs for some tplink wifi routers. Only tested on latest fw for "Archer C7". I hope that it will be useful for someone. https://github.com/ret5et/tplink_backup_decrypt_2022.bin
  • SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP® Application Server, ABAP and ABAP® Platform (Different Software Components) May 18, 2022
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on May 18SEC Consult Vulnerability Lab Security Advisory < 20220518-0 > ======================================================================= title: Multiple Critical Vulnerabilities product: SAP® Application Server ABAP and ABAP® Platform (Different Software Components) vulnerable version: see section "Vulnerable / tested versions" fixed version: see SAP security notes...
  • PHPIPAM 1.4.4 - CVE-2021-46426 May 18, 2022
    Posted by Rodolfo Augusto do Nascimento Tavares via Fulldisclosure on May 18=====[ Tempest Security Intelligence - ADV-03/2022 ]========================== PHPIPAM - Version 1.4.4 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil =====[ Table of Contents ]================================================== * Overview * Detailed description * Timeline of disclosure * Thanks & Acknowledgements * References =====[ Vulnerability […]
  • LiquidFiles - 3.4.15 - Stored XSS - CVE-2021-30140 May 18, 2022
    Posted by Rodolfo Augusto do Nascimento Tavares via Fulldisclosure on May 18=====[ Tempest Security Intelligence - ADV-12/2021 ]========================== LiquidFiles - 3.4.15 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil =====[ Table of Contents]================================================== * Overview * Detailed description * Timeline of disclosure * Thanks & Acknowledgements * References =====[ Vulnerability...
  • Watch multiple LockBit Ransom get DESTROYED Mass PWNAGE at scale! May 18, 2022
    Posted by malvuln on May 18Watch multiple LockBit Ransom get DESTROYED Mass PWNAGE at scale! https://www.youtube.com/watch?v=eg3l8a_HSSU
  • github.com/malvuln/RansomDLLs / Catalog of current DLLs affecting vulnerable Ransomware strains. May 18, 2022
    Posted by malvuln on May 18Reference list for my Ransomware exploitation research. Lists current DLLs I have seen to date that some ransomware search for, which I have used successfully to hijack and intercept vulnerable strains executing arbitrary code pre-encryption. https://github.com/malvuln/RansomDLLs
  • APPLE-SA-2022-05-16-2 macOS Monterey 12.4 May 17, 2022
    Posted by Apple Product Security via Fulldisclosure on May 16APPLE-SA-2022-05-16-2 macOS Monterey 12.4 macOS Monterey 12.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213257. AMD Available for: macOS Monterey Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed […]
  • APPLE-SA-2022-05-16-6 tvOS 15.5 May 17, 2022
    Posted by Apple Product Security via Fulldisclosure on May 16APPLE-SA-2022-05-16-6 tvOS 15.5 tvOS 15.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213254. AppleAVD Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel […]
  • APPLE-SA-2022-05-16-5 watchOS 8.6 May 17, 2022
    Posted by Apple Product Security via Fulldisclosure on May 16APPLE-SA-2022-05-16-5 watchOS 8.6 watchOS 8.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213253. AppleAVD Available for: Apple Watch Series 3 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free […]

Customers

Newsletter