This is the first in a five-part blog series on Managed Detection and Response as it drives strategic security outcomes for businesses.

If there’s one thing the past decade has shown us, it’s that change happens faster than expected. Looking across the modern enterprise, we’ve seen applications become more modular and containerized and data being shared and analyzed in amazing new ways. In addition, infrastructures are more often spread across hybrid multicloud environments.

Source: IBM Security

Changes across each of these domains and a workforce that more often codes from home is a double-edged sword. It puts mounting pressure on security teams to maintain visibility and to detect and respond to threats. Lack of visibility, plus a lack of time, skilled staff and an increase in alert overload, has placed most IT teams on an unstable path.

What is Managed Detection and Response?

Endpoints remain the primary high ground between defenders and attackers. To hold this advantage, security teams need to do multiple things at once. Their jobs require increased accessibility, deeper telemetry, increased remote forensic work and more granular containment and response options. And of course, all this needs to be run by a well-trained team of experts. These driving factors have fueled significant adoption of managed detection and response (MDR) services. According to a recent 2020 study, 94% of respondents not already using an MDR service are currently evaluating or have plans to evaluate MDR over the next 18 months.

In this multipart blog series, we’ll explore how an effective MDR service helps clients achieve their goals through the lenses of four key strategic outcomes:

  1. Align your security strategy to your business.
  2. Protect your digital users, assets and data.
  3. Manage your defenses against growing threats.
  4. Modernize your security with an open, multicloud platform.

Align Your Strategy to Your Team

In the broadest sense, alignment is thoroughly knowing the business and showing how the security strategy enables its success. In the context of MDR, this knowledge and practical work take many forms.

Know What Data Is Most Important

It starts with knowing that not all assets should be treated equally. There are benefits to assessing and pinpointing the most critical assets ahead of time. In order to do this, MDR analysts should know the business well; know its core products and services; and know the users, data and critical systems required to deliver them.

Both the MDR provider and their client should know which assets are the highest priorities and have the most material impact before an incident happens. For example, production servers should take priority above legacy dev systems slated for decommission. While the latter is fast and easy to address, the former could impact the bottom line. MDR analysts can demonstrate their alignment with the business by simply knowing these details in advance.

Focused Hunts

Nearly all MDR services offer or include a threat hunting component, though definitions, methodologies and implementations vary widely. While most industry experts agree threat hunting is helpful, it can be challenging for security teams to demonstrate how hunting directly supports business objectives.

One way to show alignment is for MDR service providers to demonstrate how hunts are customized and directly relevant to high-value assets such as key identities, critical systems or sensitive data. Another method is to demonstrate how MDR service providers are incorporating threat intelligence relevant to the organization into the hunts, perhaps based on geography or threats to the client’s industry.

Make The Risks and Responses Clear

When working with an MDR service provider, communication can be the lifeblood that determines success or failure at all levels. When communication speed, depth, accuracy, medium, frequency and audience have to be just right nearly all the time, it can be one of the hardest things to perfect. This is amplified by the fact that all MDR service providers contend with client scaling challenges at some point.

Clients want MDR service providers that explain risks clearly, succinctly and in terms that are relevant and practical. Throughout the partnership, MDR service providers can demonstrate higher value by helping customers understand month-over-month and year-over-year gains in overall security posture. They can provide a report card showing the impacts of the strategic investments and related improvements.

Managed Detection and Response In a Changing World

Aligning an MDR service to the unique needs of the business first requires knowing what the objectives are. This can be obtained in a number of ways, including regular assessments and workshops to prioritize and clarify goals. When looking for a MDR provider, ask these questions:

  • How does your MDR provider prioritize your most critical assets?
  • How does your MDR provider demonstrate how it uses that data to monitor, detect, investigate and hunt?
  • Does the MDR provider clearly communicate in a way that demonstrates its understanding of the business and how it aligns to the organization’s strategy?

Check out Part 2 of this series to explore the keys to protecting your organization, and learn more about IBM Security Managed Detection and Response Services.

More from Intelligence & Analytics

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Moving at the Speed of Business — Challenging Our Assumptions About Cybersecurity

The traditional narrative for cybersecurity has been about limited visibility and operational constraints — not business opportunities. These conversations are grounded in various assumptions, such as limited budgets, scarce resources, skills being at a premium, the attack surface growing, and increased complexity. For years, conventional thinking has been that cybersecurity costs a lot, takes a long time, and is more of a cost center than an enabler of growth. In our upcoming paper, Prosper in the Cyber Economy, published by…

Overcoming Distrust in Information Sharing: What More is There to Do?

As cyber threats increase in frequency and intensity worldwide, it has never been more crucial for governments and private organizations to work together to identify, analyze and combat attacks. Yet while the federal government has strongly supported this model of private-public information sharing, the reality is less than impressive. Many companies feel that intel sharing is too one-sided, as businesses share as much threat intel as governments want but receive very little in return. The question is, have government entities…

Tackling Today’s Attacks and Preparing for Tomorrow’s Threats: A Leader in 2022 Gartner® Magic Quadrant™ for SIEM

Get the latest on IBM Security QRadar SIEM, recognized as a Leader in the 2022 Gartner Magic Quadrant. As I talk to security leaders across the globe, four main themes teams constantly struggle to keep up with are: The ever-evolving and increasing threat landscape Access to and retaining skilled security analysts Learning and managing increasingly complex IT environments and subsequent security tooling The ability to act on the insights from their security tools including security information and event management software…