Proactively Managing Cyber Threats

It seems that every week there are news stories about one company being attacked by Ransomware, another hit with Business Email Compromise, and yet another that has been phished. Cybercrime continues to grow, and the impact on businesses is tremendous. Recovering from an attack or breach can be costly. First you have forensic and investigation activities which often include crisis management. Then we move onto costs associated with notifying data subjects and third parties. Business disruption costs also occur from downtime, let alone the cost of potentially losing current customers and new ones.

So how can you stay on top of cyber threats and cybercrime? While there are many activities a company needs to do, Managed Detection and Response (MDR) can be an appropriate place to start.

MDR is a service that allows for a skilled partner to act as extension of your own cyber team. They provide a dedicated Security Operations Center (SOC) to actively monitor your systems 24x7x365. Their primary goals are to detect threats, analyze, investigate and actively respond to them with the intention to thwart them in their tracks.

With the prevalence of ongoing attacks, having a MDR can be highly advantageous. Here are three benefits of leveraging an MDR service.

1. Improve Security Maturity and Effectiveness – MDR providers will leverage people, processes and technology to identify threats. Let’s start with a concept called Indicators of Compromise (IOC). IOCs refer to activity within your network that can be defined as unusual activity. Think of these as potential red flags. An example is a user who lives in North America. Now imagine their corporate account is continuously connecting to your network from another continent. In this scenario it could either be a cyber criminal or maybe just a team member who is traveling. Regardless, this could be defined as an IOC which needs to be investigated. These types of red flags can often go unnoticed without the right technology, processes and people who are trained and dedicated to spot them. This is where both maturity and effectiveness come in. MDR teams will greatly improve your mean time to detect and your mean time to remediate threats and vulnerabilities.
2. Full-Time Coverage with Active Response – With the increased sophistication of cyber criminals, it’s important to place emphasis on quick response. Above I mentioned mean time to detect and mean time to remediate. The bad guys don’t always sleep, so how will you know about that high priority IOC at 2 a.m.? This is where 24x7x365 coverage comes into play. The SOC analysts can act as an extension of your security team and tailor services to your industry and business. Having dedicated SOC analysts performing forensic analysis to validate alerts and eliminate false positives keeps your existing team focused on business priorities. SOC teams can act independently and also get in touch with your internal teams to partner when needed.
3. Demonstrating Accountability and Trust – As cybercrime continues to grow and the bad guys press on, we need to hold ourselves accountable. Companies are obligated to put cyber capabilities in place to detect potential compromise and perform due diligence in acting upon that risk. While no company, big or small, is immune to an incident, we must always be responsible stewards of our systems. We owe it to our customers, who have high expectations of data protection. We owe it to our employees, who rely on us to protect their personal employee information. We owe it to our company, to protect the health of the organization.

Many strategies exist to be able to detect cyber threats. Whether you leverage an in-house model or a combined approach with a partner, there are benefits. If you are not familiar with a Managed Detection and Response model, I encourage you to check it out and see if it’s right for your company.