Article
March 18, 2021
Article
March 18, 2021
In September of 2020 we dove into Five Questions to ask your MSSP to help IT professionals navigate the complexity of choosing the right Managed Security Services Provider. Below is a quick summary of those questions:
Today, we want to talk about a solution we believe is starting to eclipse MSSP and that is Managed Detection and Response or MDR services. Gartner defines MDR providers as “24/7 threat monitoring, detection and lightweight response services to customers leveraging a combination of technologies deployed at the host and network layers, advanced analytics, threat intelligence, and human expertise in incident investigation and response.” In layman’s terms, you can consider Managed Detection and Response providers as coaches who will identify the attacks within your environment, notify you of issues (within minutes) and advise you on remediation steps, however they will not provide the actual staff or “hands-on” services like an MSSP would.
Let’s talk about the main reasons why organizations might choose an MDR provider, over an MSSP, and what you need to consider in your evaluation. Below are a few key questions we use to determine how an offering like this might fit with one of our clients.
One of the first questions we ask clients is: How mature is your security posture today? For organizations who have made large investments in technology, staff and resources, an MDR solution might not be the best fit as many of their benefits are already being covered internally. However, for the large majority of organizations this is not the case. Typically, we find organizations tend to be understaffed and under resourced when it comes to their security operations which therefore puts them in a compromising position.
Another key point is around technology investments. Has your organization made investments in technology tools like firewalls, endpoint threat detection, or email security? If so, you might find a MDR solution to be the perfect complement as an MDR provider will ingest data points from these individual toolsets and offer a better picture of the overall health of your environment. The providers will not rip and replace your technology investments, instead they focusing on monitoring them.
Potentially the most fundamental question an organization must ask is whether they have adequate headcount to monitor their assets and environment 24/7/365. As you can imagine, for 9 out of 10 organizations the answer here is no. This is why MDR solutions have become so popular over the last 24-36 months. We find many companies make large investments in technology, but do not adequately staff their security team to support the tools.
Outsourcing one or many aspects of your security operations to a third party is like a marriage. It takes trust, work and commitment to deliver success. Your organization and its leadership must understand and support the implications of outsourcing something as critical as security. Your MDR vendor’s success ultimately is your organizations success. It’s imperative you make sure all your stakeholders support this decision. You might consider brokering meetings between the potential vendor and your leadership team so everyone is on the same page and agree on expectations and deliverables. If this piece is missing, things have the potential to get messy.
Lastly, a common scenario we see today is when one of our clients already use a managed services provider in some form or fashion and said provider can also offer managed security services. In many cases, but not all, this tends to be a concern for us. The pros of this scenario is vendor consolidation and your existing provider has intimate knowledge of your environment. The downside here is virtually the same. Using one vendor for multiple services tends to create a level of risk should this provider perform poorly, go out of business, lose critical team members, etc. We advise our clients, especially in security, that vendor diversity is good for the business and to mitigate risks. You wouldn’t necessarily want your plumber fixing your car just because you have their number on speed dial already.
In closing, Managed Detection and Response services are not a silver bullet for any organization, however if implemented successfully these solutions can help mitigate risk, augment your security staff and prevent critical events from impacting your environment. We believe this market will only increase in size and competition, which is a great thing! More competition equates to vendor R&D which equates to next generation toolsets to protect your critical assets.
If you want to learn more about MDR and how it compares to MSSP providers, please contact us, we’ll walk you through your options and considerations at no cost.