6 Criteria for Choosing a Managed Detection and Response Provider

The cost of cyber crime around the globe is estimated to increase by an alarming $10.5 trillion annually by 2025. It’s a price tag no organization wants to be part of. Between the increase in cyberattacks and new and changing government and industry cybersecurity regulations, organizations are turning to managed detection and response (MDR) services. The demand is so great, industry analysts estimate the size of the global MDR market to increase from $419.7 million in 2017 to $1,658.0 million by 2022.

As you evaluate MDR providers for your organization, make sure your choice meets our six criteria for the right mix of expertise and tools to strengthen and enhance your security posture.

What a managed detection and response provider is

Managed detection and response (MDR) providers deliver continuous threat monitoring, detection, and response services at the host and network layers. They offer advanced analytics, threat intelligence, and expertise on investigating and responding to cyber threats.

Organizations seek the guidance, expertise, and tools of an MDR provider when:

• The staff lacks technical knowledge to establish and manage security operations.
• They lack the right technical tools and technology to secure their infrastructure.
• They need to offset the costs of maintaining their in-house security team.
• Their available security infrastructure needs enhanced managed solutions.

As the cyber threat landscape expands, organizations choose an MDR provider to help them keep ahead of threats instead of going it alone with their in-house cybersecurity team.

6 criteria for choosing a managed detection and response provider

MDR providers have a critical role in maintaining an organization’s security posture. When evaluating potential providers, make sure they meet the following criteria.

1. Adapt their service to your needs

Finding the right MDR provider for your organization depends on your needs for an MDR solution. The provider you choose must be able to customize their services, solution, and output to fit your range of needs. Inquire about how they adapt their services and approach to their client’s unique business needs. Also, ask for examples of how their approach has worked with clients in the past and how they’ve met their future security goals.

A qualified provider works with you to understand your security operations, infrastructure, and goals. A provider that can demonstrate the level of flexibility you need is a valuable asset when your organization comes face to face with a cyber attack.

2. Work with or enhance your existing security stack

Before searching for an MDR provider, inventory your organization’s security stack so you understand what you have and what you need. Keep in mind that, if your current system is more complex, it might be more expensive to use than simply transitioning or migrating to a different platform. Another factor to consider is the maturity level of your internal processes and technology stack.

Search for an MDR provider with a comprehensive solution that can work with or enhance your existing security stack. Choose one that has a different set of tools than your security architecture to give your existing stack broader coverage.

3. Configure your logs to include the right data and detail

When reviewed regularly, logs play a critical role in identifying and responding to a malicious threat. Because the enormous amount of data that systems generate makes it difficult to review these logs manually, log monitoring software—such as security information and event management (SIEM) tools—comes in handy. These tools automate the collection and aggregation of logs so analysts can review and analyze them for events that could create potential threats.

Choose an MDR provider who uses a well-configured and customizable SIEM tool to manage your logs. By having the ability to customize their tool, the MDR provider can work with you to implement and tune it to deliver meaningful alerts that make sense for your environment.

4. Support your incident response activities

To mitigate threats against your IT infrastructure, you must have the ability to detect threats and capture security incidents. When evaluating an MDR provider, inquire about their approach to incident response, including services and tools, especially ones that work with the MITRE ATT&CK framework. Also, ask how they work with co-managed or third-party managed environments; the answer helps determine your budget for retaining MDR services.

Incident response might seem as easy as applying a patch, blocking a threat, or tuning settings, but not quite. Choose an MDR provider who goes beyond these basics to deliver deep insights about a cyberattack.

5. Openly communicate and demonstrate transparency

Communication is the key to any successful relationship. Besides your personal and peer relationships, this adage applies to your relationship with your MDR provider. Ask the MDR provider how they manage communication with their clients both on a regular basis and during incident response. Make sure they have a plan for how they establish communication channels and protocols.

Also, observe whether the MDR provider demonstrates transparency in their communications from the start. This trait sets the stage as you go forward with them as your MDR provider. They should be able to explain the “what” and “why” for each stage of the MDR service, especially when an attack happens. They also need to be open and honest with everyone involved in delivering both good and bad news.

6. Provide an experienced team who uses the latest security tools

Choose an MDR provider that has deep experience in understanding, detecting, analyzing, and stopping potential threats. They should serve as an extension of your team and act as both a resource and source of knowledge for you and your team.

Your MDR provider should combine their expertise and security tools to deliver:

• Continuous monitoring, alerts, and detection, including endpoint detection and response, for known and zero-day threats
• Simplified alerting and actionable threat intelligence
• Support and appropriate response for each incident
• Easy-to-deploy sensors with the latest security countermeasures available
• Machine learning and AI-backed engines with constant updates for threat protection

MDR providers with this level of cybersecurity support uncover anomalies and expose potential threats specific to your users and the activities that lead to them.

Marcum Technology provides a full cybersecurity service offering. If you need any help, from beginning a review of your security posture to investigating a cybersecurity incident, or even if you just want to ask for advice on a situation you are facing, please contact us at [email protected]. #AskMarcumTechnology