What is MDR?
Managed Detection and Response (MDR) is a cybersecurity service that combines technology and human expertise to perform threat hunting, monitoring, and response. The primary benefit of MDR is its ability to quickly identify and limit the impact of threats without requiring additional personnel.
MDR remotely monitors, detects, and responds to threats detected within your organization. To do this, the service provider utilizes an endpoint detection and response (EDR) tool and provides the necessary visibility into security events at the endpoint. Once visibility is established, telemetry data from endpoints is collected at the central console, where threat intelligence data and advanced analytics are used to rapidly detect and respond to suspicious events.
What are the Main Characteristics of the Services Offered by MDR?
The most basic characteristic of the services offered by MDR is to perform detailed detection of cyber attacks that cannot be detected and prevented by conventional cybersecurity solutions and respond tothese attacks at the source. MDR utilizes software equipped with special capabilities called EDR to operate advanced detection and response processes at the endpoints.
Within the scope of the MDR service, cyber threat intelligence related to cyber attacks against the relevant organization or other domestic and foreign organizations in the same sector is broadly defined and used in all processes. In this step, many commercial and non-commercial cyber threat intelligence sources are utilized.
Regardless of the SOC processes operated by the organization, the technologies mentioned above, which increase visibility at the endpoint and network layer are monitored and operated on a 24x7 basis by a dedicated team providing MDR service.If the organization already has an outsourced SOC service, MDR and SOC service providers can work in coordination and feed each other with data flow. However, MDR plays the most critical role in the detection of cyber incidents and providing rapid and accurate responses. The processes defined in the organization are reviewed and reorganized specifically for this issue.
Due to internet flaws of traditional security monitoring approaches and their inadequacy in incident response, the MDR service is critical to detect and respond to cyber attacks on the corporate network via the fastest and most accurate way. For this reason, it is being used by more and more companies and businesses each day.
What Does MDR Do?
Cybersecurity monitoring and management services offered under the SOC aim to detect and prevent cyber attacks using traditional security tools and known cyber attack signatures (at the endpoint, gateway level, or log collection center). SOCs that monitor and manage organizations' cybersecurity infrastructures are critical in preventing known cyber attacks. However, many organizations recognize that today's cyber attacks are so advanced that the technology and processes used in the classical SOC approach are inadequate to detect and respond to these advanced cyber attacks. The MDR service increases organizations' resilience against advanced cyber attacks by introducing human-centric technologies and services. Below is a comparison of SOC and MDR, taking into account the main steps of the incident response process.
| SOC | MDR | |
|---|---|---|
|
DETECTION |
Traditional SOCs use security products that are already in place. This often results in organizations having low visibility at both the endpoint and network layers, which can cause alarms received by the SOC to require a great deal of verification, to have their content disconnected from other related events, and to be indecisive in determining what can be done next. | MDRs deploy technologies within the organization that increase visibility both at the endpoint and network layer, allowing for all the details of a cyber incident to be obtained. This allows cyber attacks detected by MDRs to have a very high accuracy rate, providing detailed information about what happened before and after the incident, and enabling organizations to take immediate action to prevent the attack. In this way, organizations gain significant resistance against both known and unknown cyber threats. |
|
VALIDATION |
The biggest problem faced by SOC analysts is the need for detailed verification of all events flagged as cyber attacks by the technologies used by the relevant SOC and generating an alert in this context. It is well-known that all SOCs deal with a high number of false positive alarms and even incorporate many technologies into their security infrastructure to minimize the number of these alarms. Even in this case, the biggest challenge for a SOC analyst is determining whether an incoming alarm is true. One of the most fundamental problems for SOCs is not knowing whether the relevant warning message belongs to a real cyber attack or not, and if the attack is real, what happened before and after the event, especially in cases where the alarms detected are away from the center of the action. | One of the most fundamental features that distinguishes MDR analysts from SOC analysts is the technologies they use. MDR analysts have access to detailed trace records that can verify a cyber attack on the components where the attack occurs on the internal network and alerts generated based on behavioral models of similar attacks. As a result, MDR analysts can perform real-time cyber event detection and take quick actions on detected cyber attacks. Given that cyber attackers aim to reach their targets in a very short time, the rapid verification and action-taking capabilities of MDR analysts are vital. |
|
DETAILED |
At the core of the processes operated by SOCs is the collection of records from multiple sources in a centralized Security Information and Event Management (SIEM) and the identification and verification of these records. In particular, the centralized collection of a large number of records from many different systems requires the correlation of these records. The first condition for successful correlation is to collect the right records using relevant technologies. In most cases, many SOC processes are incomplete, and a successful incident investigation cannot be realized due to the fact that relevant technologies do not contain sufficient detail in the records, and these technologies require additional processes for detailing those records. | Through to the detailed records provided by the technologies used by MDRs and the processes they operate, the root cause of a cyber attack can be identified very quickly. The rapid identification of the root cause plays a key role in both the swift prevention of the cyber attack and the actions to be taken to prevent similar cyber attacks in the future. |
|
PREVENTION |
The processes to prevent cyber attacks detected by SOCs often depend on actions to be taken by third partieswhich can slow down the response time and allow the cyber attack to advance further. | The most important feature of the technologies used by MDRs is that they have advanced response capabilities in order to prevent detected cyber attacks in the fastest way possible. MDRs can respond toa cyber-attack without the need for the support of any third party and, when necessary, isolate the attacked component over the network, collect digital traces of the relevant cyber attack and quickly search for similar attack traces on all other system components monitored by MDRs to reveal the extent to which the cyber attack has spread. |
|
PROACTIVE CYBER HUNTING AND THREAT HUNTING |
Many technologies used in SOC infrastructures are signature-based and the success of preventing a cyber attack depends on whether the signatures related to the attack exist in the used technologies. However, the fact that the signatures of almost all advanced cyber attacks encountered today are either unknown or the attackers use the operating systems' own tools while carrying out the cyber attack makes it impossible to detect these attacks using signature-based systems. | All of the toolkits used by MDRs aim to provide full visibility into systemsrecording all of the tools and methods used by attackers in detail on the systems. MDR analysts conduct detailed examination of these records and perform threat hunting processes to detect cyber attacks that have not been detected by the technologies currently in use. |
EDR Platforms
Through to the EDR technologies used within the scope of MDR service, records of all operations performed on an operating system basis are collected and sent to the central server through an agent installed on all servers and clients. In this way, records of all activities on the computer, such as applications run, files opened, network addresses connected, etc., are kept on a central server, and cyber incident detection can be done very quickly with the help of cyber threat intelligence resources activated on this server.
This method provides excellent results, especially in detecting cyber attacks indicated by certain behavioral patterns and revealing the root causes of cyber attacks. Another feature of these platforms is their ability to respond to an attack. This way, computers or servers that have suffered a cyber attack can be completely isolated from the network, and applications can be run on these systems using the EDR platform, or files required for a detailed analysis of the cyber attack can be collected from endpoints.
As ADEO, we use technologies developed by leading manufacturers in the MDR service we offer. We ensure that our customers benefit from our MDR service in the best possible way, through to the visibility gained after deploying the appropriate EDR technology, which is selected entirely based on the needs of our customers.
