Outsourced Detection And Response To Cybersecurity Threats
The vast majority of organizations still need to have, and probably never will have, in-house cybersecurity threat detection and response capabilities. But the need is there nonetheless. Hence the development of specialized services. It is one of many publishers or equipment suppliers to go down this path. Bitdefender announced its MDR Foundations service in mid-July, designed for organizations with limited resources.
Kudelski Security has also recently strengthened its offer by opening a new service center, called Cyber Fusion Center, in Madrid. Mandiant launched its MDR service in beta for CrowdStrike Falcon and SentinelOne Singularity Endpoint customers in mid-June. Cybereason and Kaspersky also offer MDR services. Sophos opened its own in the fall of 2019.
The vast majority of organizations still need to have, and probably never will have, in-house cybersecurity threat detection and response capabilities. But the need is there nonetheless. Hence the development of specialized services. It is one of many publishers or equipment suppliers to go down this path. Bitdefender announced its MDR Foundations service in mid-July, designed for organizations with limited resources.
Kudelski Security has also recently strengthened its offer by opening a new service center, called Cyber Fusion Center, in Madrid. Mandiant launched its MDR service in beta for CrowdStrike Falcon and SentinelOne Singularity Endpoint customers in mid-June. Cybereason and Kaspersky also offer MDR services. Sophos opened its own in the fall of 2019.
A Movement Started Several Years Ago
Earlier still, in 2015, F-Secure acquired a penetration testing specialist, incense, before announcing the launch of a rapid detection service. Since then, F-Secure has continued to aggressively roll out its services strategy, first with the acquisition of Inverse Path in early 2017, then Digital Assurance, and finally the acquisition of MWR Infosecurity last June. In 2018, Trend Micro entered the managed security services field.
All these initiatives have one thing in common: they underline the need for offers combining products and managed services to meet needs that traditional suppliers of SMEs, even VSEs, need help meeting. And which, alone, they are unable to cope with. What needs? Have 24/7 supervision of the security of its information system. And this is both when internal capacities are absent and when they are insufficient to achieve this objective.
For Gartner, which explained it in a market guide published in the fall of 2021 and updated in April, this is the main objective: “use the services of MDR to obtain operational center capacities of 24/7 modern security, delivered remotely, when in -house capabilities do not exist, or when the organization needs to accelerate or augment existing operational security capabilities.” The firm estimates that 50% of organizations will use MDR services by 2025.
Accelerate Detection And Response
Deploying detection tools is good, but with someone to keep an eye on them and then act on them, there’s little point. Overall, Gartner explains that MDR services are “designed to reduce the time between threat detection and response”. However, MDR services are only part of the larger set of managed security services available on the market, such as exposure management and incident response. Suppose cybersecurity providers have gradually turned to MDR services.
In that case, it is because their tools are essential for them: they are the ones that provide the telemetry data (or at least some) necessary for the detection and the qualification of threats after contextualizing the events observed. It also involves using threat intelligence developed in-house or purchased from third parties. The positioning of the French Sekoia.io, and the wider ecosystem approach visible in the French cybersecurity sector, show here all their relevance.
Outsource, But Without Standing Idly By
Outsourcing detection and response, however, should be seen as something other than a silver bullet. Certainly, Gartner notes, client organizations are interested in asking their service provider to ensure containment and blocking of the threat once it has been detected. But its complete neutralization “is the customer’s responsibility”.
Additionally, while an EDR can aid in threat containment, it may impact legitimate business functions depending on threat propagation. And this knowledge of the functional architecture of the environment is the responsibility of the client organization of MDR services.
Gartner further points out that it is “essential to refine security processes if we hope to improve overall results”. This will help improve results and maintain good working relationships with them”. The firm also recommends taking out a retainer-type incident response contract. If they offer regular income to service providers, these contracts make it possible to speed up the response in case of an incident when deadlines matter most.
