You have limited IT resources but need MDR services. How can you make sure you're getting the best?

Here are recommendations: Clearly Define Requirements: Identify specific security requirements, prioritize critical assets & define most concerning threats Specialized Providers: Consider specialized providers with expertise in threat detection and response, offering focused and efficient services for resource-effective cybersecurity Cost-Effectiveness: Compare costs among MDR providers and assess the value they offer Prioritize Essential Features: Such as threat detection, incident response & continuous monitoring Scalability: Choose an MDR capable of scaling services according to your organization's size and growth Leverage Cloud-Based Solutions: To offload infrastructure responsibilities & providing a cost-effective

Have careful planning and prioritization: 1. Focus on critical assets, identifying and prioritizing resources within your environment and concentrating MDR efforts on monitoring and protecting these essential components; 2. Phased implementation, considering starting with a smaller scope, such as monitoring a subset of systems, and gradually expanding as resources become available; 3. Leverage open-source solutions, exploring cybersecurity tools and solutions that might align with your budget constraints, being cautious, and ensuring they meet your security requirements; and 4. Regularly review and adjust your MDR implementation. If certain aspects are resource-intensive without significant benefits, consider adjusting the strategy.

I also recommend understanding the current maturity level of information security processes, especially incident management, vulnerability and patch management, access management and change management. You should improve them before implementing MDR services...

One of the important aspect is how efficient the MDR service is. How fast can they detect, contain and remediate the threat? It's the best to find out what's the longest time taken for MDR service to fix the issue.

Before settling or choosing an MDR solution, firstly do am in house evaluation of your assets both physical and digital to know what you have and what you intend to protect. Then carry out an assessment of various solutions by have a proper assessments of the datasheets of all products being considered and also the rate at which they respond to customer requests, patch release updates, compatibility with current devices and then cost now and over 2/3 years time. One important factor that can't be overlooked is your data exposure, you have to check properly so you are not falling short of your country's data compliance law/regulations.

MDR is all about ROI- In most of the cases you can build you own MDR but that will cost you time, money and a lot of resources. By threat modeling your environment you can identify security requirements, pinpoint security threats and potential vulnerabilities, quantify threat and vulnerability criticality, and prioritize remediation methods. Usually MDR services will bring you a best time-to-value.

When selecting an MDR services you should look at the following: 1. Evaluate offerings including 24x7 monitoring. 2. Assess their expertise, experience and track record. 3. Ensure scalability and flexibility. 4. Check their advanced tool set. 5. Confirm compliance with industry regulations. 6. Set priorities and cadence calls with the MDR Vendor. 7. Ask for references. By considering these factors, you can choose and MDR partner that suites your organization's security needs within your resource constraints.

In navigating the complex digital landscape with finite IT resources, a strategic approach to Managed Detection and Response (MDR) is key. Begin with a comprehensive analysis of your current security infrastructure, pinpointing vulnerabilities and compliance needs. This enables a focused MDR selection, tailored to your organisation’s specific requirements. A well-chosen MDR not only bolsters your defense but also offers cost-efficiency by addressing precise gaps. Embrace MDR as a pivotal tool for both enhancing security and driving economic value.

By assessing your security goals, you can effectively communicate your requirements to MDR providers and ensure that their offerings align with your specific needs. This process will enable you to make an informed decision and choose the best MDR service for your organization. 1. Identify your main security challenges and risks 2. Consider your compliance requirements and industry standards 3. Evaluate your current security capabilities and gap 4. Define your security goals 5. Prioritize your needs

I think the most important factor in selecting a MDR is an evaluation of your asset , identify and classify your assets , then look up potential providers in this field based on many factors like reviews from those who have used them, ratings on and from SME's who have superior understanding of how these MDR's work , then narrow down your choice to about three that can be evaluated via a POC. A very important factor in this journey is the cost, wanting to have MDR is not enough because the cost of protecting an asset CANNOT be more than the value of the asset. So we need to keep that in mind

Scope and depth of services: 1. Types of threats covered: Look for MDR services that offer comprehensive threat detection and response capabilities, including malware, ransomware, phishing attacks, insider threats, and more. 2. Monitoring and detection: Assess the provider's ability to continuously monitor your environment, analyze logs and network traffic, and detect suspicious activities or anomalies. 3. Incident response: Evaluate the MDR provider's incident response capabilities, including their processes, methodologies, and response times. 4. Remediation and recovery: Consider the provider's ability to help you recover from security incidents, including assistance with system restoration, data recovery, and post-incident analysis.

When evaluating MDR services, prioritise both their scope & quality. Examine the range of threats they cover, the tools & platforms they support, & their customisation & integration capabilities. Equally critical is the proficiency of the MDR team—consider their credentials, responsiveness, & communication skills. Also, assess the cost-effectiveness: scrutinise the pricing model, contract T&Cs, & the potential ROI. A comprehensive MDR service that is adaptable to your specific needs, backed by an expert team & fitting within your budget, can not only strengthen your cybersecurity defenses but also contribute to your business's overall efficiency and growth. This strategic choice is instrumental in enhancing your organisational resilience.

Before choosing an MDR, dissect their offerings: threat scope, supported tools, and customization options. #FeatureCheck Then, grill the team: are they certified, communicative, and fast to respond? #ExpertSquad Finally, consider value, not just cost: pricing models, contracts, and potential ROI for your business. #WiseInvestment Choose an MDR that empowers your security, not just drains your budget. #SecureFuture

When choosing an MDR service consider the following: 1. Expertise in your industry - they will be more familiar with the specific threats and regulatory requirements. 2. Scalability and Flexibility: Ensure the MDR service can scale with your business and is flexible enough to adapt to your needs. 3. Incident Response Capabilities: Evaluate the provider's incident response protocols and their ability to quickly contain and mitigate threats. 4. Integration with Existing Systems: Ensure the MDR service can integrate with your current IT infrastructure and security tools. 5. Customer References and Reputation: Look for customer testimonials and check the provider's reputation in the cybersecurity community.

Easy way to understand the overall scope: highest detection coverage, accurately and conclusively reports of adversary techniques. MITRE Engenuity ATT&CK Evaluations pinpoints the majority of those features.

Detection: Who has sharper eyes? Compare threat intel, log analysis, and machine learning power. Response: Faster on the draw? Look for swift incident investigation, containment, and proactive threat hunting. Visibility: Clear picture or blurry mess? Evaluate real-time alerts, customizable dashboards, and insightful reports. Bonus Round: Does your MDR champion offer compliance support, vulnerability management, and seamless integration? Benefits: Stronger shield, lighter wallet? Consider improved security, cost savings, expert leverage, 24/7 vigilance, and easy scaling. Remember: Choose the MDR that suits your unique needs, not just the flashiest features.

Breach and Attack Simulation (BAS) tools can be used to evaluate the performance and effectiveness of MDR services. BAS tools operate by simulating a wide array of cyberattacks and breach scenarios in a controlled and safe manner to test the effectiveness of security defenses and the MDR team's ability to detect, respond to, and mitigate real-time threats. They can identify blind spots in detection capabilities, test incident response protocols, and ensure the MDR's threat hunting processes are efficient and effective. By using BAS as a tool, organizations can proactively verify the resilience of their MDR provider. BAS testing also keeps the MDR team alert and maintains high performance standards.

I would recommend you not to start with BAS and PoCs. MDR is cost-benefit centric approach. BAS tools wont be able to simulate a real hands-on-keyboard targeted attack, and PoC of MDR services without a incident wont help you understand much how the provider operates in a real-world scenario. Start asking for references and use MITRE ATT&CK Evaluations for Security Service Providers.

If you want to perform this evaluation prior to selecting the vendor, the best is to do a PoC. From experience, you can check by your own (team) if what's been promised can be delivered, and we discovered that one system was not able to deliver half of what sales indicated it could do. If you already have the service, you can do these test by running tests of your own, I'd consider a penetration testing (or pentest) exercise using a grey-box approach, not notifying the vendor about the test. You should expect escalations within a couple of hours as tests begin.

Track the Numbers: Catch rate: Are they stopping threats before impact? True positives vs. false alarms? Response time: How fast do they act? Aim for low MTTR (Mean Time to Respond). Resolution rate: Solving problems, not escalating them? Hear the Buzz: Happy customers? Check satisfaction surveys, testimonials, and industry awards. Real-world results? Dive into case studies of similar organizations helped. Independent opinions? Seek reviews from security experts and publications. Remember: Go beyond the headline: Ask for detailed reports and explanations. Talk is key: Schedule regular meetings to discuss performance and concerns. Compare & contrast: Benchmark against competitors or industry standards.

Aligning Managed Detection and Response (MDR) with your IT strategy is essential to ensure a seamless integration and maximize the benefits for your organization. 1. Assess your IT infrastructure 2. Define your IT strategy and objectives 3. Evaluate integration capabilities 4. Plan for IT staff involvement 5. Establish metrics and reporting By aligning MDR with your IT strategy, you can ensure that the service seamlessly integrates with your existing infrastructure, supports your business objectives, and enhances your overall security posture. This alignment will maximize the value and effectiveness of the MDR service for your organization.

Some ways to make this align smooth is to eval some key metrics that will help you on the most important time-to-value results like: - Number of employees/endpoints - Anual salary of your security analysts - Percent of alerts or incidents triaged - Industry risk level Also think about some benefits that might implicit like: - Threat Hunting Capabilities - Risk Reduction - Platform Consolidation - Cost of Business Disruption With a strong, well-documented business case in hand, you will equipped to win over even the most ardent MDR holdouts and naysayers at your organization

To maximise the benefits of Managed Detection and Response (MDR), it's crucial to align it with your IT strategy. This alignment ensures that MDR not only fits seamlessly into your existing infrastructure but also complements your business objectives. Consider how MDR will integrate with your systems and processes, and its impact on your IT team's roles and responsibilities. Plan for the management and monitoring of MDR services, and establish clear metrics for measuring and reporting their outcomes and impact. Such strategic integration of MDR into your IT framework not only enhances your cybersecurity posture but also supports your overall business operations, driving growth and efficiency.

Use ROI calculators tools - A Business Value Assessment (BVA) can help you understand the value MDR services while tailoring it for your specific environment and budget. Also consider a breach prevention warranty to stand behind your MDR services

Consider a MDR solution that has capability to integrate not just EDRs and NDRs of their own solutions, but other log sources and correlate those. Similarly to a SIEM, an MDR (or in this case a MxDR - Managed Extended Detect and Response) will capture traffic from other devices, correlate and trigger automated actions to contain or remediate. In some cases, the SOC team might reach out to confirm the incident before taking action. Considering the cost of a SIEM and to maintain a SOC, a MDR/MxDR might be a great advantage for mid to small size organizations

● I would go for the scalability of the MDR service to accommodate my organization's growth and evolving security needs. ● Look out for transparency in reporting and communication. ● And also consider Choosing an MDR provider that views the relationship as a partnership rather than just a vendor-client dynamic.

é importante considerar a escalabilidade da solução para se adequar ao crescimento da empresa. Escolha fornecedores que priorizem a comunicação eficiente e ofereçam treinamento contínuo para a equipe interna, maximizando o aproveitamento dos recursos disponíveis. Avalie a flexibilidade do modelo de pagamento, optando por opções que se alinhem ao orçamento e permitam uma gestão mais eficaz dos custos. Além disso, busque feedback de clientes existentes para garantir a eficácia e a confiabilidade dos serviços MDR oferecidos pelo provedor escolhido.

Speaking to the technician known as "The IT Person" wearing several hats for a small business. Read on. Traditionally, it was difficult for to outsource security services like these, much less allow your information to leave the premises. There were IP concerns, privacy concerns, etc. The reality is much different. Think of these services as a helping hand that lifts a massive burden off your shoulders. I have first-hand knowledge of several very, very large multibillion-dollar companies gladly doing this for the additional help. There are 40 companies listed in Gartner's 2023 Market Guide for Managed Detection and Response Services. It's OK to get help. And you should.

Take into account scalability - your organization's expansion will naturally lead to evolving security requirements. It's crucial to select an MDR provider capable of adapting their services to match your organization's growth seamlessly, ensuring that the quality of security remains high without necessitating considerable extra investments.

When procuring a MDR services, the focus is the services, it should be tooling agnostic. Alerts itself tells nothing, a series of events paints a story. Having a service in which human curates and look into a timeframe of events, providing actionable analysis is key to reduce noise. It pays well to have one of their engineers sits within the company to create “contextualisation” from the company’s itself to tune out noise and false positive.