Managed Detection and Response cover Giacomo Lanzi

Managed Detection and Response: a new preventive approach

Estimated reading time: 6 minutes

The constant use of communications over the network in a corporate context makes it essential to take precautions for computer security. As we have seen on other occasions, the dangers can come from different fronts: phishing , ransomware , data breach , etc. The implementation of new strategies such as Managed Detection and Response allows to mitigate risks and identify potential threats.

In this article, we’ll take a closer look at this new approach, focusing on advanced threats and the benefits of this new approach for businesses.

Managed Detection and Response security

Advanced-persistent-threats and SIEMs

A search of CardinalOPS , carried out on Fortune 1000 companies, highlights how companies using a system SIEM , however, encounter problems of cyber attacks. This is due, as Yair Manor, co-founder of CardinalOPS, in part to the visibility . Basically, the big companies have no real knowledge of the extent of their infrastructures and this leaves some openings from which it is possible to enter.

Systems with SIEM implementation, although they guarantee good IT security, are often mishandled by internal company technicians. Research shows that only 16% of standard threat protection techniques are actually applied by employees . Interesting data that show how an average of 25% of SIEM rules are violated or even never activated by security officers. It is therefore not easy to determine what are the best criteria to apply once the cyber attacks have occurred.

Among the 1000 companies surveyed, many of them invest considerable capital, in the billions of dollars, in order to identify the greatest number of correlations and events related to the corporate attack.

The process of constant improvement of SIEM systems underlines how this can be a real solution with a centralization and rationalization of the flow of incidents. In addition to choosing an effective security system, it is essential to have experienced technicians to be able to use the tools correctly.

Managed Detection Services & amp; Response: what are they

As noted in the previous lines, a SIEM-based system is effective, but not foolproof . In a situation where there is uncertainty of reliability, a new strategy is born to mitigate the risk. Specifically, there was the introduction of the Security Orchestration, Automation & amp; Response (SOAR) in SOCs, capable of automating repetitive workloads and detecting false positives. We also talked about it in a specific article in which we analyzed the advantages of this approach.

As it is easy to deduce, not all companies have implemented an efficient SOC system in their company, although it is now possible to find “ as a Service ” versions such as what we offer .

In this context, where the ability to identify the anomalous threat in the shortest possible time is essential, an innovative strategy is placed: Managed Detection & amp; Response (MDR) .

This service strategy is about identifying the threat as quickly as possible and containing it before it reaches its maximum level . There is therefore a change of approach due to the need to monitor potential threats around the clock. This is possible with a dedicated service capable of carrying out surveys 24 hours a day and for the whole week .

This approach implements an advanced, intelligent analysis aimed at reporting and solving the problem. Companies that choose our SOCaaS can take advantage of a service capable of speeding up the collection process and data analysis, freeing them from potential threats .

It should also be considered that the automation of the collection and analysis phases lowers maintenance prices for the company’s IT department. An advantage that cannot be ignored, offered by the decentralization of security services, such as SOCaaS from SOD.

The advantages of MDR

In order to fully understand the potential of Managed Detection and Response, it is advisable to analyze the concrete benefits that individuals and companies find in this service.

Organizations using an MDR solution can immediately reduce detection time (and therefore response time). Threats can be identified in minutes, giving you the ability to take immediate action.

But reducing time-to-detect from months to minutes isn’t the only advantage of an MDR. Companies can also:

  • Increase resilience to potential attacks by optimizing the security configuration and eliminating rogue systems .
  • Identify and stop hidden and sophisticated threats through a continuous threat hunting .
  • Respond to threats more effectively and restore endpoints to a known state through guided response and managed remediation.
  • Redirect personnel from response work to reactive and repetitive incidents towards more strategic projects.

The incidence of ransomware

Companies know very well that one of the most difficult problems to eradicate within the corporate IT context, is the ransomware . A Managed Detection and Response strategy can defeat these threats and better manage phishing campaigns. Although employees may have a good background in cybersecurity, in many cases they are prone to trivial errors . In this regard, we recommend that you evaluate our ethical phishing service, to focus on training as a weapon against phishing .

Companies that do not have a dedicated team, in many cases manage cybersecurity with superficiality, belittling and underestimating the simplest cyber attacks. Being able to preventively eliminate a potential problem is a benefit that should not be underestimated, especially if you are bound to a continuous flow of incoming and outgoing data.

Managed Detection and Response cover

Prevention

The MDR strategy aims to prevent attacks and not to eradicate them once they are unassailable. Unfortunately, dealing with a cyber attack is particularly expensive, not only due to the difficulty of recovering the lost information, but also to restore its correct functioning.

A prevention service is the ideal answer to free yourself from potential dangers , protecting not only your company, but also the employees who can become victims in turn.

Conclusions: a concrete solution

Not all MDR services are identical to each other and it is advisable to rely on those who have been working for years and are committed to making this technology more and more effective.

The services offered by SOD, such as SOCaaS, guarantee an ideal solution for every company . Thanks to the introduction of state-of-the-art security software and solutions, SOD is in a position to offer a service aimed at the best possible prevention for corporate protection.

Customization and the choice of a dedicated service allow you to better manage company production. In an age when it is essential to protect yourself from cyber threats, a service dedicated to prevention is the smartest solution.

If you want to know how our solutions can help your business, do not hesitate to contact us, we will be happy to answer any questions.

Link utili:

SOAR: coordination for cyber security

SOAR: what it is and how it can be useful for companies

What is threat intelligence?

Use cases of a SOCaaS for companies part 2

Share


RSS

More Articles…

Categories …

Tags

RSS Dark Reading

RSS Full Disclosure

  • Backdoor.Win32.Hellza.120 / Authentication Bypass September 20, 2022
    Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21_B.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Hellza.120 Vulnerability: Authentication Bypass Description: The malware listens on TCP ports 12122, 21. Third-party adversarys who can reach infected systems can logon using any username/password combination....
  • Backdoor.Win32.Hellza.120 / Unauthorized Remote Command Execution September 20, 2022
    Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Hellza.120 Vulnerability: Unauthorized Remote Command Execution Description: The malware listens on TCP ports 12122, 21. Third-party adversarys who can reach infected systems can issue commands made available by the...
  • Trojan.Ransom.Ryuk.A / Arbitrary Code Execution September 20, 2022
    Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/5ac0f050f93f86e69026faea1fbb4450.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan.Ransom.Ryuk.A Vulnerability: Arbitrary Code Execution Description: The ransomware looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a vuln DLL execute our own code, […]
  • Trojan-Dropper.Win32.Corty.10 / Insecure Credential Storage September 20, 2022
    Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/f72138e574743640bdcdb9f102dff0a5.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Corty.10 Vulnerability: Insecure Credential Storage Description: The malware stores its credentials in cleartext within the Windows registry. Family: Corty Type: PE32 MD5: f72138e574743640bdcdb9f102dff0a5 Vuln ID:...
  • Re: over 2000 packages depend on abort()ing libgmp September 20, 2022
    Posted by Matthew Fernandez on Sep 19What is the security boundary being violated here? As a maintainer of some of the packages implicated here, I’m unsure what my actionable tasks are. The threat model(s) for my packages does not consider crashes to be a security violation. On the other side, things like crypto code frequently […]
  • SEC Consult SA-20220915-0 :: Local Privilege Escalation im SAP® SAPControl Web Service Interface (sapuxuserchk) September 16, 2022
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 15SEC Consult Vulnerability Lab Security Advisory < 20220915-0 > ======================================================================= title: Local privilege escalation product: SAP® SAPControl Web Service Interface (sapuxuserchk) vulnerable version: see section "Vulnerable / tested versions" fixed version: see SAP security note 3158619 CVE number: CVE-2022-29614...
  • SEC Consult SA-20220914-0 :: Improper Access Control in SAP® SAProuter September 16, 2022
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 15SEC Consult Vulnerability Lab Security Advisory < 20220914-0 > ======================================================================= title: Improper Access Control product: SAP® SAProuter vulnerable version: see section "Vulnerable / tested versions" fixed version: see SAP security note 3158375 CVE number: CVE-2022-27668 impact: high homepage:...
  • over 2000 packages depend on abort()ing libgmp September 16, 2022
    Posted by Georgi Guninski on Sep 15ping world libgmp is library about big numbers. it is not a library for very big numbers, because if libgmp meets a very big number, it calls abort() and coredumps. 2442 packages depend on libgmp on ubuntu20. [email protected]:~/prim$ apt-cache rdepends libgmp10 | wc -l 2442 gawk crash: [email protected]:~/prim$ gawk […]
  • APPLE-SA-2022-09-12-5 Safari 16 September 12, 2022
    Posted by Apple Product Security via Fulldisclosure on Sep 12APPLE-SA-2022-09-12-5 Safari 16 Safari 16 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213442. Safari Extensions Available for: macOS Big Sur and macOS Monterey Impact: A website may be able to track users through Safari web extensions Description: A logic issue […]
  • APPLE-SA-2022-09-12-4 macOS Monterey 12.6 September 12, 2022
    Posted by Apple Product Security via Fulldisclosure on Sep 12APPLE-SA-2022-09-12-4 macOS Monterey 12.6 macOS Monterey 12.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213444. ATS Available for: macOS Monterey Impact: An app may be able to bypass Privacy preferences Description: A logic issue was addressed with improved state management. […]

Customers

Newsletter