What is Managed Detection and Response (MDR)?

In this 101, we’re going to cover:

• What is MDR?
• How Does MDR Work?
• What is the Difference Between MDR and MSSP?
• Benefits of Managed Detection and Response (MDR)
• How is Cybereason MDR Different?

WHAT IS MDR?

As we launch a new year, there's plenty to worry about in cybersecurity. Most people are aware of the growing threats to our personal and professional data security in general. Many are becoming more aware of specific threats, like the Log4Shell vulnerability now being exploited by both nefarious state and non-state sponsored agents and hackers to deploy ransomware attacks worldwide.

Many of us, including leaders of many targeted organizations, know less about the types of responses and technology we can deploy to defend ourselves and prevent future attacks. 

Part of the problem is that we find ourselves overwhelmed and confused by the terminology used in cybersecurity and how each protocol or technology can help us defend ourselves against cyberattacks. 

Let's begin the learning process with a commonly used industry term, Managed Detection and Response (MDR). 

MDR is a suite of outsourced services allowing organizations to identify, monitor, respond to, and limit the impact of cybersecurity threats. Organizations can deploy these services without building or significantly expanding internal security operations centers and staff to meet the volume and sophistication of these threats.

Many companies have a problem: cybersecurity threats must be monitored and responded to quickly, and threat purveyors work just as hard to develop and exploit new vulnerabilities. Companies need a constantly aware, consistently improving resource of people and technology to fight this battle. However, most companies have neither the expertise nor the dedicated budget to develop such a resource. As a result, some companies find themselves falling behind and falling prey to intruders and hackers.

MDR is a sensible alternative to scaling security operations to respond to and prevent rapidly evolving threats. 

HOW DOES MDR WORK?

Managed Detection and Response typically involves planning and applying technology and expertise to the core network and endpoint security responsibilities, including:

DEPLOY

Cover an organization's entire network of endpoints to minimize the vulnerability to threats as soon and as thoroughly as possible.

DETECT

Continuous, 24/7 monitoring of an organization's networks and endpoints, often using an endpoint detection and response (EDR) tool and up-to-date threat intelligence data to identify security incidents and instantly notify the right people and systems for triage and response.

TRIAGE

Enable the organization's security team to quickly validate and prioritize detected threats based on the context of each event and its most likely impact.

RESPOND AND REMEDIATE

Notify the security team to take recommended actions and (or) trigger automatic responses to defeat and eradicate each high-priority threat and return the system to its unthreatened status.

REPORT

Create a detailed report for each incident. It should identify the threat, how (and when) it was detected, steps taken, and how the incident was resolved.

WHAT IS THE DIFFERENCE BETWEEN MDR AND MSSP?

Managed Security Services Providers (MSSP) fill some, but not all, the roles in MDR. MSSPs typically provide detection, notification, and alert services but no response or remediation. Their customers, or other outsourced security services, must respond to those alerts, remove threats, and prevent future intrusions.

BENEFITS OF MANAGED DETECTION AND RESPONSE (MDR)

Managed Detection and Response is a comprehensive network and endpoint security service that incorporates all the MDR roles and responsibilities outlined above and offers the following key benefits to its customers:

• Provides the expertise, systems, threat intelligence, and processes to identify and deal with an up-to-date list of known threats without building an in-house, state-of-the-art security operations center.
• Reduces or removes the need to dedicate people and systems to identify, track, respond to, and prevent global cybersecurity threats.
• Reduces or removes the need and expense of attracting, employing, and continuously training new cybersecurity talent.
• It's a security solution offering continuous threat hunting, detection, and remediation—you may not need your entire Global SOC team online all the time to provide the security your business requires.
• It's scalable to meet an organization's growing needs, and its capabilities undergo continuous improvement and expansion without additional R & D investment by customers.
• Its implementation can result in a lower total cost of ownership (TCO) for effective security capabilities.

HOW IS CYBEREASON MDR DIFFERENT?

Cybereason MDR provides a fully Managed Detection and Response solution with essential advantages over other providers.

SOPHISTICATED THREAT DETECTION

Global cybersecurity threats are constantly and quickly evolving. We can no longer rely on alerts to detect known compromises because sometimes there's no malicious code to detect. An example of this is the 2021 Solar Winds attack. Our experts take a more operation-centric approach, looking instead at outcomes or behaviors from intrusion into systems that we can use to detect threats and prevent breaches. That's part of our constantly evolving research and development to stay ahead of cybersecurity threats and their instigators.

Learn more about our sophisticated approach to threats and actual responses from our team.

RESPONSE, REMEDIATION, AND PREVENTION

Threat detection is what many cybersecurity firms and technologies provide—we go much further. After detection, we get to work helping your team understand and immediately act upon the most severe threats by applying our MalOp Severity Score to each threat. Each MalOp detected is automatically mapped to the Mitre ATT&CK^TM framework, analyzed by our experts, and evaluated in terms of our customers' critical asset status and recoverability, then assigned a MalOp Severity Score.

We then apply Cybereason's Extended Response, our proactive, automated remediation capability, to detect, triage, and remediate each threat based on its MalOp Security Score.

With this MDR solution in place, we can: 

• Detect a threat < 1 minute
• Triage a threat < 5 minutes
• Remediate a threat < 30 minutes

Download a data sheet on Cybereason MDR services. 

FLEXIBLE DEPLOYMENT

Our MDR solution is available in three packages, Cybereason MDR Essentials, Complete, and Mobile. The three packages are fully scalable and designed to fit any size organization, and customers can select a package that best suits their organization's needs.

Managed Detection and Response has become a smart alternative to building and maintaining in-house security operations centers. It also offers a more effective alternative to MSSP providers through rapid response and remediation to detected threats. Cybereason's MDR solution goes beyond industry-standard detection and response and provides a more sophisticated, integrated approach to the entire process of eliminating and preventing threats. That's why Cybereason has been named a Strong Performer in the Forrester Wave™: Managed Detection and Response, Q1 2021 report.

Learn more about Cybereason MDR services.

Back to Cybersecurity 101