Threat Detection and Response has become a critical concern for today’s security teams so they can defend their organisations from exploitation by advanced threats.
According to the 2018 Trustwave Global Security Report, it takes an average of 83 days to discover a cybersecurity breach. Advanced threats are bypassing traditional security measures and are compromising the integrity of IT environments at an alarming rate.
In response to this trend, a new class of services known as Managed Detection and Response (MDR) have emerged from a growing list of speciality providers and forward-thinking Managed Security Services Providers (MSSP).
However, as with most emerging services, the challenge is to discover which capabilities best meet the specific needs of each business.
In addition to 24x7x365 monitoring and notification, MDR services employ incident response and remediation capabilities that often include proactive threat hunting.
In essence, MDR is focused on solving the broader challenges of threat detection and response comprehensively, by quickly identifying both known and unknown threats, rapidly validating their presence and spread within an organisation, and then quickly eradicating the threat.
The goal is to reduce the attacker dwell times by short-circuiting the kill chain, minimising any potential damage done and shorten the cycle to remediation.
It is thus important for organisations to combine Managed SIEM with Managed Threat Detection to get greater value and increased resilience.
This is also important as organisations start to shift investment from preventive controls such as firewalls and endpoint protection, as cyber attacks have continued, becoming more sophisticated and harder to detect with point solutions alone.
Key benefits MDR services provide include:
Trustwave up-levels traditional MSSP competencies like device management and log collection, providing the foundation for organisations to consider more proactive security like endpoint detection and response and proactive threat hunting.