This is the first in a five-part blog series on Managed Detection and Response as it drives strategic security outcomes for businesses.

If there’s one thing the past decade has shown us, it’s that change happens faster than expected. Looking across the modern enterprise, we’ve seen applications become more modular and containerized and data being shared and analyzed in amazing new ways. In addition, infrastructures are more often spread across hybrid multicloud environments.

Source: IBM Security

Changes across each of these domains and a workforce that more often codes from home is a double-edged sword. It puts mounting pressure on security teams to maintain visibility and to detect and respond to threats. Lack of visibility, plus a lack of time, skilled staff and an increase in alert overload, has placed most IT teams on an unstable path.

What is Managed Detection and Response?

Endpoints remain the primary high ground between defenders and attackers. To hold this advantage, security teams need to do multiple things at once. Their jobs require increased accessibility, deeper telemetry, increased remote forensic work and more granular containment and response options. And of course, all this needs to be run by a well-trained team of experts. These driving factors have fueled significant adoption of managed detection and response (MDR) services. According to a recent 2020 study, 94% of respondents not already using an MDR service are currently evaluating or have plans to evaluate MDR over the next 18 months.

In this multipart blog series, we’ll explore how an effective MDR service helps clients achieve their goals through the lenses of four key strategic outcomes:

  1. Align your security strategy to your business.
  2. Protect your digital users, assets and data.
  3. Manage your defenses against growing threats.
  4. Modernize your security with an open, multicloud platform.

Align Your Strategy to Your Team

In the broadest sense, alignment is thoroughly knowing the business and showing how the security strategy enables its success. In the context of MDR, this knowledge and practical work take many forms.

Know What Data Is Most Important

It starts with knowing that not all assets should be treated equally. There are benefits to assessing and pinpointing the most critical assets ahead of time. In order to do this, MDR analysts should know the business well; know its core products and services; and know the users, data and critical systems required to deliver them.

Both the MDR provider and their client should know which assets are the highest priorities and have the most material impact before an incident happens. For example, production servers should take priority above legacy dev systems slated for decommission. While the latter is fast and easy to address, the former could impact the bottom line. MDR analysts can demonstrate their alignment with the business by simply knowing these details in advance.

Focused Hunts

Nearly all MDR services offer or include a threat hunting component, though definitions, methodologies and implementations vary widely. While most industry experts agree threat hunting is helpful, it can be challenging for security teams to demonstrate how hunting directly supports business objectives.

One way to show alignment is for MDR service providers to demonstrate how hunts are customized and directly relevant to high-value assets such as key identities, critical systems or sensitive data. Another method is to demonstrate how MDR service providers are incorporating threat intelligence relevant to the organization into the hunts, perhaps based on geography or threats to the client’s industry.

Make The Risks and Responses Clear

When working with an MDR service provider, communication can be the lifeblood that determines success or failure at all levels. When communication speed, depth, accuracy, medium, frequency and audience have to be just right nearly all the time, it can be one of the hardest things to perfect. This is amplified by the fact that all MDR service providers contend with client scaling challenges at some point.

Clients want MDR service providers that explain risks clearly, succinctly and in terms that are relevant and practical. Throughout the partnership, MDR service providers can demonstrate higher value by helping customers understand month-over-month and year-over-year gains in overall security posture. They can provide a report card showing the impacts of the strategic investments and related improvements.

Managed Detection and Response In a Changing World

Aligning an MDR service to the unique needs of the business first requires knowing what the objectives are. This can be obtained in a number of ways, including regular assessments and workshops to prioritize and clarify goals. When looking for a MDR provider, ask these questions:

  • How does your MDR provider prioritize your most critical assets?
  • How does your MDR provider demonstrate how it uses that data to monitor, detect, investigate and hunt?
  • Does the MDR provider clearly communicate in a way that demonstrates its understanding of the business and how it aligns to the organization’s strategy?

Check out Part 2 of this series to explore the keys to protecting your organization, and learn more about IBM Security Managed Detection and Response Services.

More from Intelligence & Analytics

2022 Industry Threat Recap: Manufacturing

It seems like yesterday that industries were fumbling to understand the threats posed by post-pandemic economic and technological changes. While every disruption provides opportunities for positive change, it's hard to ignore the impact that global supply chains, rising labor costs, digital currency and environmental regulations have had on commerce worldwide. Many sectors are starting to see the light at the end of the tunnel. But 2022 has shown us that manufacturing still faces some dark clouds ahead when combatting persistent…

Cybersecurity in the Next-Generation Space Age, Pt. 3: Securing the New Space

View Part 1, Introduction to New Space, and Part 2, Cybersecurity Threats in New Space, in this series. As we see in the previous article of this series discussing the cybersecurity threats in the New Space, space technology is advancing at an unprecedented rate — with new technologies being launched into orbit at an increasingly rapid pace. The need to ensure the security and safety of these technologies has never been more pressing. So, let’s discover a range of measures…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

The 13 Costliest Cyberattacks of 2022: Looking Back

2022 has shaped up to be a pricey year for victims of cyberattacks. Cyberattacks continue to target critical infrastructures such as health systems, small government agencies and educational institutions. Ransomware remains a popular attack method for large and small targets alike. While organizations may choose not to disclose the costs associated with a cyberattack, the loss of consumer trust will always be a risk after any significant attack. Let’s look at the 13 costliest cyberattacks of the past year and…