This is the first in a five-part blog series on Managed Detection and Response as it drives strategic security outcomes for businesses.

If there’s one thing the past decade has shown us, it’s that change happens faster than expected. Looking across the modern enterprise, we’ve seen applications become more modular and containerized and data being shared and analyzed in amazing new ways. In addition, infrastructures are more often spread across hybrid multicloud environments.

Source: IBM Security

Changes across each of these domains and a workforce that more often codes from home is a double-edged sword. It puts mounting pressure on security teams to maintain visibility and to detect and respond to threats. Lack of visibility, plus a lack of time, skilled staff and an increase in alert overload, has placed most IT teams on an unstable path.

What is Managed Detection and Response?

Endpoints remain the primary high ground between defenders and attackers. To hold this advantage, security teams need to do multiple things at once. Their jobs require increased accessibility, deeper telemetry, increased remote forensic work and more granular containment and response options. And of course, all this needs to be run by a well-trained team of experts. These driving factors have fueled significant adoption of managed detection and response (MDR) services. According to a recent 2020 study, 94% of respondents not already using an MDR service are currently evaluating or have plans to evaluate MDR over the next 18 months.

In this multipart blog series, we’ll explore how an effective MDR service helps clients achieve their goals through the lenses of four key strategic outcomes:

  1. Align your security strategy to your business.
  2. Protect your digital users, assets and data.
  3. Manage your defenses against growing threats.
  4. Modernize your security with an open, multicloud platform.

Align Your Strategy to Your Team

In the broadest sense, alignment is thoroughly knowing the business and showing how the security strategy enables its success. In the context of MDR, this knowledge and practical work take many forms.

Know What Data Is Most Important

It starts with knowing that not all assets should be treated equally. There are benefits to assessing and pinpointing the most critical assets ahead of time. In order to do this, MDR analysts should know the business well; know its core products and services; and know the users, data and critical systems required to deliver them.

Both the MDR provider and their client should know which assets are the highest priorities and have the most material impact before an incident happens. For example, production servers should take priority above legacy dev systems slated for decommission. While the latter is fast and easy to address, the former could impact the bottom line. MDR analysts can demonstrate their alignment with the business by simply knowing these details in advance.

Focused Hunts

Nearly all MDR services offer or include a threat hunting component, though definitions, methodologies and implementations vary widely. While most industry experts agree threat hunting is helpful, it can be challenging for security teams to demonstrate how hunting directly supports business objectives.

One way to show alignment is for MDR service providers to demonstrate how hunts are customized and directly relevant to high-value assets such as key identities, critical systems or sensitive data. Another method is to demonstrate how MDR service providers are incorporating threat intelligence relevant to the organization into the hunts, perhaps based on geography or threats to the client’s industry.

Make The Risks and Responses Clear

When working with an MDR service provider, communication can be the lifeblood that determines success or failure at all levels. When communication speed, depth, accuracy, medium, frequency and audience have to be just right nearly all the time, it can be one of the hardest things to perfect. This is amplified by the fact that all MDR service providers contend with client scaling challenges at some point.

Clients want MDR service providers that explain risks clearly, succinctly and in terms that are relevant and practical. Throughout the partnership, MDR service providers can demonstrate higher value by helping customers understand month-over-month and year-over-year gains in overall security posture. They can provide a report card showing the impacts of the strategic investments and related improvements.

Managed Detection and Response In a Changing World

Aligning an MDR service to the unique needs of the business first requires knowing what the objectives are. This can be obtained in a number of ways, including regular assessments and workshops to prioritize and clarify goals. When looking for a MDR provider, ask these questions:

  • How does your MDR provider prioritize your most critical assets?
  • How does your MDR provider demonstrate how it uses that data to monitor, detect, investigate and hunt?
  • Does the MDR provider clearly communicate in a way that demonstrates its understanding of the business and how it aligns to the organization’s strategy?

Check out Part 2 of this series to explore the keys to protecting your organization, and learn more about IBM Security Managed Detection and Response Services.

More from Intelligence & Analytics

ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)

7 min read - In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others. ITG10's tactics, techniques and procedures (TTPs) overlap with APT37 and ScarCruft. The initial delivery method is conducted via a LNK file, which drops two Windows shortcut files containing obfuscated PowerShell scripts in charge of downloading a…

7 min read

SOCs Spend 32% of the Day On Incidents That Pose No Threat

4 min read - When it comes to the first line of defense for any company, its Security Operations Center (SOC) is an essential component. A SOC is a dedicated team of professionals who monitor networks and systems for potential threats, provide analysis of detected issues and take the necessary actions to remediate any risks they uncover. Unfortunately, SOC members spend nearly one-third (32%) of their day investigating incidents that don't actually pose a real threat to the business according to a new report…

4 min read

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read