What is MDR?
Managed detection and response, or MDR, can help organizations fill critical cybersecurity gaps related to expertise, technologies and monitoring support. MDR vendors specialize in employing teams of skilled threat hunters and advanced endpoint detection tools that can be outsourced to other organizations who lack the budget, skills or time to shield themselves.
MDR represents a powerful capability in the fight against ransomware. For a variety of reasons — the pandemic, geopolitical tensions, a mass increase in non-traditional endpoints, and vulnerabilities stemming from rapid cloud migration — ransomware attacks have skyrocketed in the last two years, conjuring doubts and fears among even the most stalwart defenders.
Here are 5 use cases for how MDR can help protect organizations from ransomware attacks.
5 ways that MDR can fight ransomware
#1: Customer access to diverse security expertise
What it is: MDR vendors employ an all-star team of threat hunters, incident responders, and data analysts that would make your average CISO blush. With the ability to attract top talent and the battle-tested experience of processing significantly greater volume and variety of threats than the typical organization will ever see, MDR experts use their encyclopedic knowledge of ransomware attack patterns to anticipate and disrupt threats before they take root.
How it works: The cybersecurity skills shortage continues to leave budget-strapped organizations vulnerable to data breaches. Even companies that do have in-house experts can find themselves overwhelmed by a constant barrage of alerts, contributing to security fatigue and burnout over time. But with MDR, organizations can add expertise without adding to the headcount, tapping into a community of skilled cyber veterans who know how to parse through false positives and separate real threats from the noise.
#2: Active threat intelligence
What it is: Good MDR vendors strive to make their services as transparent as possible. They do this by relaying threat intelligence on an active basis to the customer, providing weekly and monthly reports of network activity and periodically sharing insights into security investigations or alerts meriting customer attention.
How it works: The MDR vendor can provide customers access to a dashboard where they can view real-time alerts, scheduled reporting, and other intelligence that MDR threat hunters have collected in their investigations. The vendor can also conduct routine account health scans to inform customers of basic settings and configurations of endpoints in the network.
#3: XDR and telemetry capabilities
What it is: MDR vendors combine extended detection and response tools, or XDR, with robust telemetries to gain continuous visibility and automated analysis of an organization’s entire information environment – including endpoints, cloud assets, network data, user identities and so on. Context is crucial to identifying suspicious behavior, and MDR vendors harness the full range of contextual data by leveraging third-party telemetry to investigate threats that escaped detection of basic tool sets.
How it works: In addition to monitoring and securing endpoints, MDR personnel will look at an organization’s business tools and applications – like email, expense and budgeting software, cloud workloads, identities, network logs, and other telemetries – to make precise judgements about potential threats or vulnerabilities, and recommending measures to resolve them. An added advantage is that if MDR detects a vulnerability in one customer’s environment, they can then fix that vulnerability within every other customer’s environment where it is present.
#4: Root cause analysis
What it is: Root cause analysis entails a deep-dive investigation into the actors and events responsible for creating the conditions that led to an attack or unexpected security incident. With the aid of a MDR vendor employing threat hunting personnel, organizations can benefit from root cause analysis to better understand lingering vulnerabilities and the steps needed to address them.
How it works: Despite plugging several known vulnerabilities, an organization continues to weather attempted ransomware attacks on its network. The organization calls on MDR personnel to conduct root cause analysis, which reveals that a DNS cache poisoning attack is the real enabler for the continued ransomware attempts. MDR threat hunters then prescribe instructions to the organization for how they can rapidly fix this vulnerability to make future attacks less likely.
#5: 24/7 monitoring and speed to response
What it is: The cyber community likes to joke that CISOs don’t sleep, but the truth is unfortunately not far off. In many cases, SOC personnel simply lack the resources and manpower to provide the kind of vigilance needed to fend off more sophisticated ransomware attacks. MDR vendors tend to carry a much larger geographic footprint, employing multiple SOC teams around the world and at all hours of the day.
How it works: Many attacks happen at night or over the weekend when criminals suspect the majority of the workforce is at home. Even if suspicious activity is flagged and an alert is generated, it could easily be lost in a multitude of other lookalike noise. Conversely, MDR personnel in charge of monitoring a customer’s network around the clock will have the resources to immediately thwart an attack before data or services are compromised.
