What is Managed Detection and Response?
Managed Detection and Response (MDR) is a managed cybersecurity service that detects intrusions, malware, and malicious activity in your network and assists in responding quickly to eliminate and mitigate those threats. MDR typically combines a technology solution with outsourced security analysts that extend your technologies and team.
Isn’t That What MSSPs or Managed SIEMs Do?
No. Managed Security Service Providers (MSSPs) monitor network security controls and may send alerts when anomalies are identified. MSSPs typically do not investigate the anomalies to eliminate false positives, nor do they respond to real threats. This means that abnormalities in network usage are forwarded to your IT personnel who must then dig through the data to determine if there is a real threat and what to do about it.
Doesn’t My Firewall Protect My Network?
Kind of… Firewalls and other preventive forms of cybersecurity are very important and effective at preventing basic cyberattacks. However, over the past decade it has become clear that preventive cybersecurity technologies are not enough to secure an organization’s network. Further, they are yet another source of alerts, log messages, and events that contribute to the “alert fatigue” being universally suffered today. Recent major hacks such as the Target Hack of 2013, the Yahoo Hack of Dec. 2016 (1 of 2 that year) and the Anthem Hack of 2015 demonstrate how easily cybercriminals can breach a firewall and steal millions of credit cards numbers, medical files and other forms of PII/PHI.
What’s All This Talk About Artificial Intelligence?
Artificial intelligence as applied to security problems is nascent. Automating intelligence using computing has potential, but that potential won’t be met for some time AND there’s a growing arms race with criminals that weaponize AI to defeat AI. Today, and for the foreseeable future, the only reliable analysts are human.
With that said, artificial intelligence can be an incredible force multiplier to human expertise. For example, CI Security’s monitoring platform, Critical InsightTM, uses advanced analytics to sift through millions of network events and identifies suspicious activity for human investigation. Our analysts then conduct an investigation and use replayable packet capture to confirm whether or not a security incident has occurred. If confirmed, our Security Operations Center (SOC) issues an Incident Action Plan, and works with your team or service provider to eradicate the compromise before any actual loss occurs. This response includes both the preservation of evidence and full recovery monitoring.
What Sets Critical Insight Apart as a Managed Detection and Response Solution?
- Deep expertise aligned to your organization's cybersecurity requirements and vulnerabilities.
- Dedicated Security Analysts monitoring your network for threats.
- Advanced Analytics, and Integrated Threat Intelligence to accurately identify threats.
- Complete Event Investigations, freeing your IT resources from the burden of false positives.
- Individual Incident Action Plans to defeat the threats, minimize damages and reduce recovery time.
- Post-incident response and recovery assistance.
- Auditability and regulatory compliance.
- Positive effect on key cybersecurity metrics: incident frequency, time to incident close, cost per incident.