Using MDR cost-effectively against cyberattacks

The 4 key components of your fight against cyber security threats

A previous blog post, Becoming cyber resilient: Managed Detection & Response shuts down security breaches quickly and efficiently, discussed the ideal approach to addressing cybersecurity threats in a rapidly changing world. Before we build on this, let’s briefly go over the main components of this approach again:

1. Security Operations Centre (SOC) consists of analysts who monitor your organization for possible cybersecurity breaches. They have three main tools in their arsenal.
2. Security Information & Event Management (SIEM) system collects logs from a variety of sources and provides real-time analysis and notifications of suspicious events.
3. Network Detection and Response (NDR) analyses network traffic, determines the risk level, detects anomalies and, through integration with other systems, can even respond automatically in some cases. A malicious connection, for example, can be blocked by the firewall immediately. The SOC analysts evaluate the reports from the NDR and react accordingly.
4. Endpoint Detection and Response (EDR) monitors the use of endpoints (computers or mobile devices), detects abnormal behaviour and can sometimes respond automatically. It allows SOC analysts to connect directly to the endpoints, retrieve information and data, and intervene where necessary. For example, an endpoint can immediately be removed from the network in the event of an intrusion, which minimizes any possible damage.

Analyst firm Gartner has named these three systems the ‘SOC Visibility Triad’. They each have their unique advantages and complement each other, allowing a SOC to do its job optimally in terms of detection and response.

Start small, grow later

While the combination of SIEM, NDR and EDR forms an ideal toolbox for a SOC, it is perfectly possible to start with just one or two components. After all, each of these components can also be used separately. You can start with one component to keep costs low, and add other components as you gain experience with your security approach.

SIEM is more well established than NDR and EDR. We commonly see two scenarios:

• You already have a SIEM and want more insight into threats and to be able to respond more efficiently
• You don't have a SIEM yet and want to build your security architecture as effectively as possible

Let’s look at these scenarios in more details.

From SIEM to a complete security architecture

If your organization has had a proactive approach to security for some time, your SOC may already have a SIEM up and running, whether on-premises or in the cloud, or even in a hybrid architecture. But as we discussed in our earlier blog post, a SIEM alone is not enough to detect today's sophisticated security attacks. What's more, with a SIEM-only approach you're missing out on fast response capabilities.

The most cost-effective next step in this situation is to complement your SIEM with EDR. This increases threat visibility, addresses the growing threat of endpoint system breaches, and optimizes the cost of your SIEM. It also allows you to respond more quickly to threats, reducing the operational impact. If you want to go one step further, you can also implement NDR for visibility in the network, particularly in environments where you cannot roll out EDR. This allows you to achieve full integration and the fastest possible response times.

Starting from scratch

If you do not have an SIEM yet, make EDR your first priority. This technology is the most cost-effective, and it allows you to respond quickly to threats from the outset.

Then, extend visibility with an SIEM. This will let you add logs from a variety of critical sources, even from the cloud. Your security system will then be able to analyse much more data for suspicious events. In a third step, you can add a network perspective with an NDR.

Always up to date

Compliance rules are becoming ever stricter, and so you need to be aware of the latest requirements and understand how to meet them.

In this process, you have to be aware that cybersecurity threats are evolving rapidly. Today's cybercriminals have become more professional, are launching more sophisticated and targeted attacks than in the past, and this will only continue.

Continuously keeping up with the latest regulations and the changing security landscape is quite a challenge. The IT department in any business requires in-depth expertise to find the right solutions.

That is why for many companies – with or without a CISO – cooperating with an external party is the best plan of action.

24/7 access to security experts

There is currently a shortage of security experts on the labour market. As a result, not all organizations have the required security profiles in their workforce. If a security incident occurs, you probably do not have the in-house expertise and skills to respond quickly and appropriately.

It’s also important to remember that cybercriminals do not sleep. Often these operations are not run by one individual, but by a gang, operating internationally and trying to break into your company around the clock. Few organizations have the resources to detect and respond to cyber threats 24/7.

By outsourcing to a proven security expert, you don't have to worry about any of this. With Cegeka Managed Detection and Response, you can rely on experienced analysts who keep countless organizations safe every day. And thanks to our scale, we can do this more cost-effectively – allowing you to focus on your core activities.

Want to know how MDR investments could benefit you? Or do you need help convincing your management of the importance of the investment?