What is Managed Detection and Response (MDR)?

What is Managed Detection and Response?

Managed Detection and Response (MDR) is a managed cyber security service that provides intrusion detection of malware and malicious activity in your network, and assists in rapid incident response to eliminate those threats with succinct remediation actions. MDR typically combines a technology solution with outsourced security analysts that extend your technologies and team.

Isn’t that What MSSPs or Managed SIEMs Do?

No. Managed Security Service Providers (MSSPs) monitor network security controls and may send alerts when anomalies are identified. MSSPs typically do not investigate the anomalies to eliminate false positives, nor do they respond to real threats. This means that abnormalities in network usage are forwarded to your IT personnel who must then dig through the data to determine if there is a real threat and what to do about it.

Doesn’t My Firewall Protect My Network?

Kind of… Firewalls and other preventive forms of cybersecurity are very important and effective at preventing basic cyberattacks. However, over the past decade it has become clear that preventive cybersecurity technologies are not enough to secure an organization’s network. Further, they are yet another source of alerts, log messages, and events that contribute to the “alert fatigue” being universally suffered today. Recent major hacks such as the Marriot Hack of 2018, the Anthem Hack of 2015, and the Target Hack of 2013 demonstrate how easily cybercriminals can breach networks at enterprise organizations to steal millions of credit cards numbers, medical records, and other forms of PII/PHI.

What’s All This Talk About Artificial Intelligence?

Artificial intelligence as applied to security problems is nascent. Automating intelligence using computing has potential, but that potential won’t be met for some time AND there’s a growing arms race with criminals that weaponize AI to defeat AI. Today, and for the foreseeable future, the only reliable analysts are human.

With that said, artificial intelligence can be an incredible force multiplier to human expertise. For example, CI Security’s monitoring platform, Critical Insight, uses advanced threat detection to sift through millions of network events and identify suspicious activity for human investigation. Our analysts then conduct an investigation and use replayable packet capture to confirm whether or not a security incident has occurred. If confirmed, our Security Operations Center (SOC) issues an Incident Action Plan, and works with your team or service provider to respond, remove, and remediate the compromise before any actual loss occurs. This response includes both the preservation of evidence and full recovery monitoring.

What Sets Critical Insight MDR Apart as a Managed Detection and Response Solution?

Deep expertise aligned to your organization's cybersecurity requirements and vulnerabilities
Dedicated Security Analysts monitoring your network for threats
Embedded MDR tools with Advanced Analytics and Integrated Threat Intelligence to accurately identify threats
Complete Security Event Investigations, freeing your IT resources from the burden of false positives
Individual Incident Action Plans to defeat the threats, minimize damages and reduce recovery time
Post-incident response and recovery assistance
Auditability and regulatory compliance
Positive effect on key cybersecurity metrics: incident frequency, time to incident close, cost per incident