Managed Detection and Response (MDR) is a managed cybersecurity service that detects intrusions, malware, and malicious activity in your network and assists in responding quickly to eliminate and mitigate those threats. MDR typically combines a technology solution with outsourced security analysts that extend your technologies and team.
No. Managed Security Service Providers (MSSPs) monitor network security controls and may send alerts when anomalies are identified. MSSPs typically do not investigate the anomalies to eliminate false positives, nor do they respond to real threats. This means that abnormalities in network usage are forwarded to your IT personnel who must then dig through the data to determine if there is a real threat and what to do about it.
Kind of… Firewalls and other preventive forms of cybersecurity are very important and effective at preventing basic cyberattacks. However, over the past decade it has become clear that preventive cybersecurity technologies are not enough to secure an organization’s network. Further, they are yet another source of alerts, log messages, and events that contribute to the “alert fatigue” being universally suffered today. Recent major hacks such as the Target Hack of 2013, the Yahoo Hack of Dec. 2016 (1 of 2 that year) and the Anthem Hack of 2015 demonstrate how easily cybercriminals can breach a firewall and steal millions of credit cards numbers, medical files and other forms of PII/PHI.
Artificial intelligence as applied to security problems is nascent. Automating intelligence using computing has potential, but that potential won’t be met for some time AND there’s a growing arms race with criminals that weaponize AI to defeat AI. Today, and for the foreseeable future, the only reliable analysts are human.
With that said, artificial intelligence can be an incredible force multiplier to human expertise. For example, Critical Informatics’ monitoring platform, Critical Insight, uses advanced analytics to sift through millions of network events and identifies suspicious activity for human investigation. Our analysts then conduct an investigation and use replayable packet capture to confirm whether or not a security incident has occurred. If confirmed, our Security Operations Center (SOC) issues an Incident Action Plan, and works with your team or service provider to eradicate the compromise before any actual loss occurs. This response includes both the preservation of evidence and full recovery monitoring.