SlideShare a Scribd company logo

Critical Capabilities for MDR Services - What to Know Before You Buy

•Download as PPTX, PDF•
•
Fidelis Cybersecurity
Fidelis Cybersecurity

24/7 coverage and skills shortages for post breach detection and response are driving the need for Managed Detection and Response (MDR) Services. Analysts are predicting 15X growth for MDR services over the next few years as security leaders shift their focus from prevention to detection knowing attacks are evading existing defenses, often without malware by using macros and scripts. Managed services often use MDR marketing messages and this sometimes results in their security monitoring services not meeting expectations. Buyers must learn what to look for in an MDR solution to avoid falling into this trap.

Technology
1 of 25
Critical Capabilities for Managed Detection & Response (MDR) Services Know Before You Buy
© Fidelis Cybersecurity Agenda & Speakers • Introductions • How MDR Evolved • Critical Capabilities • MDR vs MSS • Best Practices Tom Clare Product/Technical Marketing Analyst Relations Fidelis Cybersecurity Mike Stewart Vice President Security Consulting Services Fidelis Cybersecurity 2
© Fidelis Cybersecurity How Did MDR Evolve? MSSPs… • Focused on security monitoring • Ignored customer needs for response Security Teams… • Invested in EDR tools • Lacked skills to extract value • Short supply of skilled resources MDR Requires… • Network and endpoint visibility • Detection beyond regular expressions • 24/7 pre-approved responses 3
© Fidelis Cybersecurity Why MDR? 15X Growth by 2020 • Lack of internal skills and expertise • Invest beyond security prevention • Address threat detection and response • 24/7 coverage requires 8-12 FTEs Mid-Sized Enterprises Extra-Large Enterprises 4
© Fidelis Cybersecurity MDR Critical Capabilities • Managed EDR is the most visible • Broader MDR services include:  Network Traffic Analysis (NTA)  Endpoint Monitoring (EDR)  Deception Technologies  Advanced Analytics / Threat Intelligence  Lightweight Incident Validation & Response  Expertise and Experience  Analyst Communications • Full Incident Response (IR) retainers are an option for large incidents 5
© Fidelis Cybersecurity ‘Response’ is Defining MDR Services • Customers desire lightweight response services with MDR • Disrupt and contain threats until IT resources are back in office  Blocking network activity via DNS requests and TCP resets  Isolating a process or a host from the network using an endpoint agent  Integrating with a customer's network access control (NAC) tool  Changing firewall rules via APIs, watchlists and rule updates  Locking and suspending user accounts 6
© Fidelis Cybersecurity MDR Curated Technology Stacks Endpoint Detection & Response (EDR) Network Traffic Analysis (NTA) - Direct - Internal - Cloud - Email - Web Deception Sandboxing METADATA ML Anomaly Detection Cross-Session Analysis Multi-faceted Analysis Content & Context Real-time & Retrospective Threat Intelligence Threat Detection Query, Pivot and Hunt 7
© Fidelis Cybersecurity Data Options NetFlows - Source/Destination - Transport/Service - Date/Time/Duration - Not Enough Data - No Content/Context SIEMs/Logs - Unstructured Logs - Normalize/Correlate - Activity & Timelines - Compliance/Audits - Slow to Query/Hunt - Rarely Detect Threats Metadata - Applications/Content - Custom Tagging - Indexed, Ready to Use - Threat Detection/Hunting - Data Loss & Theft - Cross-Session Analysis - 90% of Data, 20% of Cost Packet Captures (PCAPs) - Raw Packet Data - Encoded, Unassembled - Forensic Evidence - Expensive to Store - Cannot Apply Threat Intel. - Unable to Query 8
© Fidelis Cybersecurity MDR Pricing • Full MDR Services average $100/endpoint Full security stack, metadata, detection and response services, analyst interaction • Light MDR Services as low as $10/endpoint Email alerts, threat detection service, cloud-based, short time window (e.g. 7-days) $100/ep$10/ep 9
© Fidelis Cybersecurity MDR vs MSS Managed Detection & Response versus Managed Security Services 10
© Fidelis Cybersecurity Converging Markets Basic MSS Basic MDR Advanced MDR/MSS 11
© Fidelis Cybersecurity Characteristics • Security technology management • Compliance monitoring & reporting • Technology agnostic threat monitoring • Other managed services • Managed EDR, NTA, etc. • Managed threat hunting • Incident response services • Turnkey technology stack • Basic incident response • Threat containment 12 Basic MSS Basic MDR Advanced MDR/MSS
© Fidelis Cybersecurity MDR vs MSS Comparison Characteristic MDR MSS Deployment Time Simple, Days or Weeks Complex, Infrastructure, Months Data Sources Curated Technology Stack Customer Determined Remote Management Their Stack Only Most Common Security Controls Interface Analyst (Voice, Email) Email and Portal Incident Response Remote Lightweight Included, On-site IR via Retainer Via Retainer (MDR, IR) Containment Tech. Stack via Scripts/ APIs or Customer Security Controls Full Management of Security Controls Compliance Reporting Very Rarely Yes SLAs Rarely Yes 13
© Fidelis Cybersecurity Buyer Beware • MSSPs adopting MDR marketing should be met with healthy skepticism • Many MSSPs provide security event monitoring, basic threat detection, and alerting services • Security event monitoring services are not meeting expectations, also negative experiences • Validate turnkey technology stack and threat hunting skills of MSSPs • Often managed EDR and basic threat detection services • EDR alone good at response, not as much for detection 14
© Fidelis Cybersecurity Competitive Playing Field The competitive playing field for MDR compromises of the following: • MSSPs and consultancies broadening current portfolios with specialized offerings • Product vendors wrapping services around software to facilitate adoption • Niche start-ups focused on delivering MDR, and only MDR • Failed MSSPs switching to MDR as the most troubling option 15
© Fidelis Cybersecurity Fidelis MDR Service 16
© Fidelis Cybersecurity 24x7 Managed Detection and Response (MDR) Let Us Be Your Threat Hunting and Data Leakage Mitigation Team 17 Deep Visibility and Automated Detection and Response across your Network, Endpoints, Cloud and Enterprise IoT Devices • Full service solution focused on detection, response and remediation - managed and monitored by security experts  Discover and Classify Network Assets  Enforce Network Detection and Response (NTA)  Data Leakage Prevention (DLP)  Endpoint Detection and Response (EDR)  Deception to identify existing intruders or insider threats • Verifies and enforces your security policies and compliance requirements to ensure the highest standards
© Fidelis Cybersecurity Fidelis Professional Services 18 Incident Response • Retainers • Subject Matter Experts Customer Success • Security Program Review • IR Readiness Assessment • SOC Assessment Product • Implementations • Training • Cloud Delivery/Subscription A team of highly experienced security assessment and IR professionals who have helped some of the largest organizations investigate and respond to breaches in over 4,000 engagements
© Fidelis Cybersecurity • Responded to large security cases in commercial and government sectors • Instrumental in building large Government and Commercial security operations centers • Critical roles in the indictment and conviction of multiple organized international cyber criminals • Key members of the security team on average, have over 18 years of incident response experience 19 SECURITY EXPERTISE PROVEN PROCESS ADVANCED TECHNOLOGY Our security professionals have decades of experience assisting organizations of all sizes prepare and respond to security incidents Full IR Lifecycle Advanced Technology Security Expertise Proven Process Fidelis Services: Incident Response Experience Earned on the Front Lines
© Fidelis Cybersecurity Full Incident Response Lifecycle 20 Initial Response Investigation & Containment RemediationExpulsion • Triage • Scope • SITREP • Actions Taken • Planned Actions • Capabilities • Evidence • Forensics • Malware RE • IOCs • Monitoring • Taxonomy and Timelines • 72 hour Plan • Monitoring • Validation • Tracking • Restore • Report • Roadmap • SME Support • Training • Processes • Policy Fidelis Services: Full Incident Response Lifecycle
© Fidelis Cybersecurity Fidelis Services: Preparation 1.Need to follow a Security Standard accounts for all enterprise Networks, Systems, and Data (not just regulatory) 2.Need full data accountability and risk (Data Characterization) 3.Know your vulnerabilities A. Red Team B. Pentest C. Vulnerability Management 4.Prearrange 3rd Party IR help A. Outside Counsel B. Forensics C. IR Support D. Law Enforcement E. Help Desk for customer support F. Cyber Insurance 21
© Fidelis Cybersecurity Fidelis Services: Detection 1.Need full enterprise visibility across the network and endpoints for situational awareness 2.Need lateral visibility 3.Security Policy that supports enterprise wide response Authority 4.Have a Continuity of Operations Plan (COOP) 22
© Fidelis Cybersecurity Fidelis Services: Response 1.Need an exercised IR plan A. Communications Plan B. Ensure your IR plan covers regulatory requirements C. War room plan D. 3rd party integration E. IR tracking software and repository 2.Decide on your response based on capabilities A. Immediate B. Delayed 3.Don’t stomp on evidence A. Collect evidence before remediation B. Don’t cut off attackers without external advice 4.Know when to call in experts and counsel for privilege 23
© Fidelis Cybersecurity Selecting MDR Services • Advanced Technology • Expert Partner • Processes and Threat Hunting • Constantly Monitor Security Stack for the Next Smoking Gun • Validated Alerts • Critical Remediation Authority 24
Questions?

Recommended

Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Raffael Marty
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
Muhammad Sahputra
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
Priyanka Aash
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 

Recommended

Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Raffael Marty
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
Muhammad Sahputra
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
Priyanka Aash
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
Priyanka Aash
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
Prachi Mishra
 
Soc and siem and threat hunting
Soc and siem and threat huntingSoc and siem and threat hunting
Soc and siem and threat hunting
Vikas Jain
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERA
Erik Van Buggenhout
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
Jorge Orchilles
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
ReZa AdineH
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
Deepak Kumar (D3)
 
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP'sAlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault
 
Dragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations Center
Dragos, Inc.
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
Splunk
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSE
Jorge Orchilles
 
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Edureka!
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
Michael Nickle
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
Hunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systemsHunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systems
Fidelis Cybersecurity
 
Splunk Phantom SOAR Roundtable
Splunk Phantom SOAR RoundtableSplunk Phantom SOAR Roundtable
Splunk Phantom SOAR Roundtable
Splunk
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Security Operation Center - Design & Build
Security Operation Center - Design & BuildSecurity Operation Center - Design & Build
Security Operation Center - Design & Build
Sameer Paradia
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
Jonathan Sinclair
 
Starting your Career in Information Security
Starting your Career in Information SecurityStarting your Career in Information Security
Starting your Career in Information Security
Ahmed Sayed-
 
Cyber Security Needs and Challenges
Cyber Security Needs and ChallengesCyber Security Needs and Challenges
Cyber Security Needs and Challenges
Happiest Minds Technologies
 

More Related Content

What's hot

Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
Priyanka Aash
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
Prachi Mishra
 
Soc and siem and threat hunting
Soc and siem and threat huntingSoc and siem and threat hunting
Soc and siem and threat hunting
Vikas Jain
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERA
Erik Van Buggenhout
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
Jorge Orchilles
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
ReZa AdineH
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
Deepak Kumar (D3)
 
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP'sAlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault
 
Dragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations Center
Dragos, Inc.
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
Splunk
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSE
Jorge Orchilles
 
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Edureka!
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
Michael Nickle
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
Hunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systemsHunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systems
Fidelis Cybersecurity
 
Splunk Phantom SOAR Roundtable
Splunk Phantom SOAR RoundtableSplunk Phantom SOAR Roundtable
Splunk Phantom SOAR Roundtable
Splunk
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Security Operation Center - Design & Build
Security Operation Center - Design & BuildSecurity Operation Center - Design & Build
Security Operation Center - Design & Build
Sameer Paradia
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
Jonathan Sinclair
 

What's hot (20)

Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Soc and siem and threat hunting
Soc and siem and threat huntingSoc and siem and threat hunting
Soc and siem and threat hunting
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERA
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
 
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP'sAlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
 
Dragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations Center
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSE
 
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
Cybersecurity Frameworks | NIST Cybersecurity Framework | Cybersecurity Certi...
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
 
Hunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systemsHunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systems
 
Splunk Phantom SOAR Roundtable
Splunk Phantom SOAR RoundtableSplunk Phantom SOAR Roundtable
Splunk Phantom SOAR Roundtable
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
 
Security Operation Center - Design & Build
Security Operation Center - Design & BuildSecurity Operation Center - Design & Build
Security Operation Center - Design & Build
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
 

Similar to Critical Capabilities for MDR Services - What to Know Before You Buy

Starting your Career in Information Security
Starting your Career in Information SecurityStarting your Career in Information Security
Starting your Career in Information Security
Ahmed Sayed-
 
Cyber Security Needs and Challenges
Cyber Security Needs and ChallengesCyber Security Needs and Challenges
Cyber Security Needs and Challenges
Happiest Minds Technologies
 
Mergers and Acquisition Security - Areas of Interest
Mergers and Acquisition Security - Areas of InterestMergers and Acquisition Security - Areas of Interest
Mergers and Acquisition Security - Areas of InterestMatthew Rosenquist
 
"Navigate the MDR Marketplace Like a Pro!"
"Navigate the MDR Marketplace Like a Pro!" "Navigate the MDR Marketplace Like a Pro!"
"Navigate the MDR Marketplace Like a Pro!"
Advanced Technology Consulting (ATC)
 
Detecon Cyber Security Radar
Detecon Cyber Security RadarDetecon Cyber Security Radar
Detecon Cyber Security Radar
Daniel Steinfeld
 
Cyber Security in the market place: HP CTO Day
Cyber Security in the market place: HP CTO DayCyber Security in the market place: HP CTO Day
Cyber Security in the market place: HP CTO Day
Symantec
 
Managed Security Operations Centre Alternative - Managed Security Service
Managed Security Operations Centre Alternative - Managed Security Service Managed Security Operations Centre Alternative - Managed Security Service
Managed Security Operations Centre Alternative - Managed Security Service
Netpluz Asia Pte Ltd
 
Web Application Security: Beyond PEN Testing
Web Application Security: Beyond PEN TestingWeb Application Security: Beyond PEN Testing
Web Application Security: Beyond PEN Testing
Robert Grupe, CSSLP CISSP PE PMP
 
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
North Texas Chapter of the ISSA
 
A Buyers Guide to Investing in Endpoint Detection and Response for Enterprise...
A Buyers Guide to Investing in Endpoint Detection and Response for Enterprise...A Buyers Guide to Investing in Endpoint Detection and Response for Enterprise...
A Buyers Guide to Investing in Endpoint Detection and Response for Enterprise...
Kaspersky
 
GRCAlert Capabilities Deck - 2018
GRCAlert Capabilities Deck - 2018GRCAlert Capabilities Deck - 2018
GRCAlert Capabilities Deck - 2018
Richard Marti - Principal
 
OpenText Cyber Resilience Program
OpenText Cyber Resilience ProgramOpenText Cyber Resilience Program
OpenText Cyber Resilience Program
Marc St-Pierre
 
MCGlobalTech Consulting Service Presentation
MCGlobalTech Consulting Service PresentationMCGlobalTech Consulting Service Presentation
MCGlobalTech Consulting Service Presentation
William McBorrough
 
Today's Breach Reality, The IR Imperative, And What You Can Do About It
Today's Breach Reality, The IR Imperative, And What You Can Do About ItToday's Breach Reality, The IR Imperative, And What You Can Do About It
Today's Breach Reality, The IR Imperative, And What You Can Do About It
Resilient Systems
 
Ooredoo%20Security%20Managed%20Services
Ooredoo%20Security%20Managed%20ServicesOoredoo%20Security%20Managed%20Services
Ooredoo%20Security%20Managed%20ServicesMuhammad Mudassar
 
Managing security threats in today’s enterprise
Managing security threats in today’s enterpriseManaging security threats in today’s enterprise
Managing security threats in today’s enterprise
Quick Heal Technologies Ltd.
 
Outpost24 webinar - The new CISO imperative: connecting technical vulnerabili...
Outpost24 webinar - The new CISO imperative: connecting technical vulnerabili...Outpost24 webinar - The new CISO imperative: connecting technical vulnerabili...
Outpost24 webinar - The new CISO imperative: connecting technical vulnerabili...
Outpost24
 
Protecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomwareProtecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomware
Cloudera, Inc.
 
IBM Security Strategy
IBM Security StrategyIBM Security Strategy
IBM Security Strategy
Camilo Fandiño Gómez
 

Similar to Critical Capabilities for MDR Services - What to Know Before You Buy (20)

Starting your Career in Information Security
Starting your Career in Information SecurityStarting your Career in Information Security
Starting your Career in Information Security
 
Cyber Security Needs and Challenges
Cyber Security Needs and ChallengesCyber Security Needs and Challenges
Cyber Security Needs and Challenges
 
Secure Iowa Oct 2016
Secure Iowa Oct 2016Secure Iowa Oct 2016
Secure Iowa Oct 2016
 
Mergers and Acquisition Security - Areas of Interest
Mergers and Acquisition Security - Areas of InterestMergers and Acquisition Security - Areas of Interest
Mergers and Acquisition Security - Areas of Interest
 
"Navigate the MDR Marketplace Like a Pro!"
"Navigate the MDR Marketplace Like a Pro!" "Navigate the MDR Marketplace Like a Pro!"
"Navigate the MDR Marketplace Like a Pro!"
 
Detecon Cyber Security Radar
Detecon Cyber Security RadarDetecon Cyber Security Radar
Detecon Cyber Security Radar
 
Cyber Security in the market place: HP CTO Day
Cyber Security in the market place: HP CTO DayCyber Security in the market place: HP CTO Day
Cyber Security in the market place: HP CTO Day
 
Managed Security Operations Centre Alternative - Managed Security Service
Managed Security Operations Centre Alternative - Managed Security Service Managed Security Operations Centre Alternative - Managed Security Service
Managed Security Operations Centre Alternative - Managed Security Service
 
Web Application Security: Beyond PEN Testing
Web Application Security: Beyond PEN TestingWeb Application Security: Beyond PEN Testing
Web Application Security: Beyond PEN Testing
 
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
 
A Buyers Guide to Investing in Endpoint Detection and Response for Enterprise...
A Buyers Guide to Investing in Endpoint Detection and Response for Enterprise...A Buyers Guide to Investing in Endpoint Detection and Response for Enterprise...
A Buyers Guide to Investing in Endpoint Detection and Response for Enterprise...
 
GRCAlert Capabilities Deck - 2018
GRCAlert Capabilities Deck - 2018GRCAlert Capabilities Deck - 2018
GRCAlert Capabilities Deck - 2018
 
OpenText Cyber Resilience Program
OpenText Cyber Resilience ProgramOpenText Cyber Resilience Program
OpenText Cyber Resilience Program
 
MCGlobalTech Consulting Service Presentation
MCGlobalTech Consulting Service PresentationMCGlobalTech Consulting Service Presentation
MCGlobalTech Consulting Service Presentation
 
Today's Breach Reality, The IR Imperative, And What You Can Do About It
Today's Breach Reality, The IR Imperative, And What You Can Do About ItToday's Breach Reality, The IR Imperative, And What You Can Do About It
Today's Breach Reality, The IR Imperative, And What You Can Do About It
 
Ooredoo%20Security%20Managed%20Services
Ooredoo%20Security%20Managed%20ServicesOoredoo%20Security%20Managed%20Services
Ooredoo%20Security%20Managed%20Services
 
Managing security threats in today’s enterprise
Managing security threats in today’s enterpriseManaging security threats in today’s enterprise
Managing security threats in today’s enterprise
 
Outpost24 webinar - The new CISO imperative: connecting technical vulnerabili...
Outpost24 webinar - The new CISO imperative: connecting technical vulnerabili...Outpost24 webinar - The new CISO imperative: connecting technical vulnerabili...
Outpost24 webinar - The new CISO imperative: connecting technical vulnerabili...
 
Protecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomwareProtecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomware
 
IBM Security Strategy
IBM Security StrategyIBM Security Strategy
IBM Security Strategy
 

More from Fidelis Cybersecurity

Putting Cyber Attackers on the Defensive
Putting Cyber Attackers on the DefensivePutting Cyber Attackers on the Defensive
Putting Cyber Attackers on the Defensive
Fidelis Cybersecurity
 
Threat intelligence Primary Tradecraft and Research
Threat intelligence Primary Tradecraft and ResearchThreat intelligence Primary Tradecraft and Research
Threat intelligence Primary Tradecraft and Research
Fidelis Cybersecurity
 
Extend Network Visibility and Secure Applications and Data in Azure
Extend Network Visibility and Secure Applications and Data in AzureExtend Network Visibility and Secure Applications and Data in Azure
Extend Network Visibility and Secure Applications and Data in Azure
Fidelis Cybersecurity
 
Insider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
Insider Threats Part 2: Preventing Data Exfiltration with Fidelis ElevateInsider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
Insider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
Fidelis Cybersecurity
 
Game Changing Cyber Defensive Strategies for 2019
Game Changing Cyber Defensive Strategies for 2019Game Changing Cyber Defensive Strategies for 2019
Game Changing Cyber Defensive Strategies for 2019
Fidelis Cybersecurity
 
Part 1: Identifying Insider Threats with Fidelis EDR Technology
Part 1: Identifying Insider Threats with Fidelis EDR Technology Part 1: Identifying Insider Threats with Fidelis EDR Technology
Part 1: Identifying Insider Threats with Fidelis EDR Technology
Fidelis Cybersecurity
 
Extending Your Network Cloud Security to AWS
Extending Your Network Cloud Security to AWSExtending Your Network Cloud Security to AWS
Extending Your Network Cloud Security to AWS
Fidelis Cybersecurity
 
The State of Threat Detection 2019
The State of Threat Detection 2019The State of Threat Detection 2019
The State of Threat Detection 2019
Fidelis Cybersecurity
 
You can't detect what you can't see illuminating the entire kill chain
You can't detect what you can't see illuminating the entire kill chainYou can't detect what you can't see illuminating the entire kill chain
You can't detect what you can't see illuminating the entire kill chain
Fidelis Cybersecurity
 
Secure Your Data with Fidelis Network® for DLP
Secure Your Data with Fidelis Network® for DLPSecure Your Data with Fidelis Network® for DLP
Secure Your Data with Fidelis Network® for DLP
Fidelis Cybersecurity
 
Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration
Fidelis Cybersecurity
 
Capture the Flag Exercise Using Active Deception Defense
Capture the Flag Exercise Using Active Deception DefenseCapture the Flag Exercise Using Active Deception Defense
Capture the Flag Exercise Using Active Deception Defense
Fidelis Cybersecurity
 
Fidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception SolutionFidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception Solution
Fidelis Cybersecurity
 
Cybersecurity Operations: Examining the State of the SOC
Cybersecurity Operations: Examining the State of the SOCCybersecurity Operations: Examining the State of the SOC
Cybersecurity Operations: Examining the State of the SOC
Fidelis Cybersecurity
 
Applying intelligent deception to detect sophisticated cyber attacks
Applying intelligent deception to detect sophisticated cyber attacksApplying intelligent deception to detect sophisticated cyber attacks
Applying intelligent deception to detect sophisticated cyber attacks
Fidelis Cybersecurity
 

More from Fidelis Cybersecurity (15)

Putting Cyber Attackers on the Defensive
Putting Cyber Attackers on the DefensivePutting Cyber Attackers on the Defensive
Putting Cyber Attackers on the Defensive
 
Threat intelligence Primary Tradecraft and Research
Threat intelligence Primary Tradecraft and ResearchThreat intelligence Primary Tradecraft and Research
Threat intelligence Primary Tradecraft and Research
 
Extend Network Visibility and Secure Applications and Data in Azure
Extend Network Visibility and Secure Applications and Data in AzureExtend Network Visibility and Secure Applications and Data in Azure
Extend Network Visibility and Secure Applications and Data in Azure
 
Insider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
Insider Threats Part 2: Preventing Data Exfiltration with Fidelis ElevateInsider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
Insider Threats Part 2: Preventing Data Exfiltration with Fidelis Elevate
 
Game Changing Cyber Defensive Strategies for 2019
Game Changing Cyber Defensive Strategies for 2019Game Changing Cyber Defensive Strategies for 2019
Game Changing Cyber Defensive Strategies for 2019
 
Part 1: Identifying Insider Threats with Fidelis EDR Technology
Part 1: Identifying Insider Threats with Fidelis EDR Technology Part 1: Identifying Insider Threats with Fidelis EDR Technology
Part 1: Identifying Insider Threats with Fidelis EDR Technology
 
Extending Your Network Cloud Security to AWS
Extending Your Network Cloud Security to AWSExtending Your Network Cloud Security to AWS
Extending Your Network Cloud Security to AWS
 
The State of Threat Detection 2019
The State of Threat Detection 2019The State of Threat Detection 2019
The State of Threat Detection 2019
 
You can't detect what you can't see illuminating the entire kill chain
You can't detect what you can't see illuminating the entire kill chainYou can't detect what you can't see illuminating the entire kill chain
You can't detect what you can't see illuminating the entire kill chain
 
Secure Your Data with Fidelis Network® for DLP
Secure Your Data with Fidelis Network® for DLPSecure Your Data with Fidelis Network® for DLP
Secure Your Data with Fidelis Network® for DLP
 
Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration Fidelis Endpoint® - Live Demonstration
Fidelis Endpoint® - Live Demonstration
 
Capture the Flag Exercise Using Active Deception Defense
Capture the Flag Exercise Using Active Deception DefenseCapture the Flag Exercise Using Active Deception Defense
Capture the Flag Exercise Using Active Deception Defense
 
Fidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception SolutionFidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception Solution
 
Cybersecurity Operations: Examining the State of the SOC
Cybersecurity Operations: Examining the State of the SOCCybersecurity Operations: Examining the State of the SOC
Cybersecurity Operations: Examining the State of the SOC
 
Applying intelligent deception to detect sophisticated cyber attacks
Applying intelligent deception to detect sophisticated cyber attacksApplying intelligent deception to detect sophisticated cyber attacks
Applying intelligent deception to detect sophisticated cyber attacks
 

Recently uploaded

Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
Prayukth K V
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
Cheryl Hung
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
Paul Groth
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
Product School
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Product School
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
DianaGray10
 
Knowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and backKnowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and back
Elena Simperl
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 

Recently uploaded (20)

Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
 
Knowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and backKnowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and back
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 

Critical Capabilities for MDR Services - What to Know Before You Buy

  • 1. Critical Capabilities for Managed Detection & Response (MDR) Services Know Before You Buy
  • 2. © Fidelis Cybersecurity Agenda & Speakers • Introductions • How MDR Evolved • Critical Capabilities • MDR vs MSS • Best Practices Tom Clare Product/Technical Marketing Analyst Relations Fidelis Cybersecurity Mike Stewart Vice President Security Consulting Services Fidelis Cybersecurity 2
  • 3. © Fidelis Cybersecurity How Did MDR Evolve? MSSPs… • Focused on security monitoring • Ignored customer needs for response Security Teams… • Invested in EDR tools • Lacked skills to extract value • Short supply of skilled resources MDR Requires… • Network and endpoint visibility • Detection beyond regular expressions • 24/7 pre-approved responses 3
  • 4. © Fidelis Cybersecurity Why MDR? 15X Growth by 2020 • Lack of internal skills and expertise • Invest beyond security prevention • Address threat detection and response • 24/7 coverage requires 8-12 FTEs Mid-Sized Enterprises Extra-Large Enterprises 4
  • 5. © Fidelis Cybersecurity MDR Critical Capabilities • Managed EDR is the most visible • Broader MDR services include:  Network Traffic Analysis (NTA)  Endpoint Monitoring (EDR)  Deception Technologies  Advanced Analytics / Threat Intelligence  Lightweight Incident Validation & Response  Expertise and Experience  Analyst Communications • Full Incident Response (IR) retainers are an option for large incidents 5
  • 6. © Fidelis Cybersecurity ‘Response’ is Defining MDR Services • Customers desire lightweight response services with MDR • Disrupt and contain threats until IT resources are back in office  Blocking network activity via DNS requests and TCP resets  Isolating a process or a host from the network using an endpoint agent  Integrating with a customer's network access control (NAC) tool  Changing firewall rules via APIs, watchlists and rule updates  Locking and suspending user accounts 6
  • 7. © Fidelis Cybersecurity MDR Curated Technology Stacks Endpoint Detection & Response (EDR) Network Traffic Analysis (NTA) - Direct - Internal - Cloud - Email - Web Deception Sandboxing METADATA ML Anomaly Detection Cross-Session Analysis Multi-faceted Analysis Content & Context Real-time & Retrospective Threat Intelligence Threat Detection Query, Pivot and Hunt 7
  • 8. © Fidelis Cybersecurity Data Options NetFlows - Source/Destination - Transport/Service - Date/Time/Duration - Not Enough Data - No Content/Context SIEMs/Logs - Unstructured Logs - Normalize/Correlate - Activity & Timelines - Compliance/Audits - Slow to Query/Hunt - Rarely Detect Threats Metadata - Applications/Content - Custom Tagging - Indexed, Ready to Use - Threat Detection/Hunting - Data Loss & Theft - Cross-Session Analysis - 90% of Data, 20% of Cost Packet Captures (PCAPs) - Raw Packet Data - Encoded, Unassembled - Forensic Evidence - Expensive to Store - Cannot Apply Threat Intel. - Unable to Query 8
  • 9. © Fidelis Cybersecurity MDR Pricing • Full MDR Services average $100/endpoint Full security stack, metadata, detection and response services, analyst interaction • Light MDR Services as low as $10/endpoint Email alerts, threat detection service, cloud-based, short time window (e.g. 7-days) $100/ep$10/ep 9
  • 10. © Fidelis Cybersecurity MDR vs MSS Managed Detection & Response versus Managed Security Services 10
  • 11. © Fidelis Cybersecurity Converging Markets Basic MSS Basic MDR Advanced MDR/MSS 11
  • 12. © Fidelis Cybersecurity Characteristics • Security technology management • Compliance monitoring & reporting • Technology agnostic threat monitoring • Other managed services • Managed EDR, NTA, etc. • Managed threat hunting • Incident response services • Turnkey technology stack • Basic incident response • Threat containment 12 Basic MSS Basic MDR Advanced MDR/MSS
  • 13. © Fidelis Cybersecurity MDR vs MSS Comparison Characteristic MDR MSS Deployment Time Simple, Days or Weeks Complex, Infrastructure, Months Data Sources Curated Technology Stack Customer Determined Remote Management Their Stack Only Most Common Security Controls Interface Analyst (Voice, Email) Email and Portal Incident Response Remote Lightweight Included, On-site IR via Retainer Via Retainer (MDR, IR) Containment Tech. Stack via Scripts/ APIs or Customer Security Controls Full Management of Security Controls Compliance Reporting Very Rarely Yes SLAs Rarely Yes 13
  • 14. © Fidelis Cybersecurity Buyer Beware • MSSPs adopting MDR marketing should be met with healthy skepticism • Many MSSPs provide security event monitoring, basic threat detection, and alerting services • Security event monitoring services are not meeting expectations, also negative experiences • Validate turnkey technology stack and threat hunting skills of MSSPs • Often managed EDR and basic threat detection services • EDR alone good at response, not as much for detection 14
  • 15. © Fidelis Cybersecurity Competitive Playing Field The competitive playing field for MDR compromises of the following: • MSSPs and consultancies broadening current portfolios with specialized offerings • Product vendors wrapping services around software to facilitate adoption • Niche start-ups focused on delivering MDR, and only MDR • Failed MSSPs switching to MDR as the most troubling option 15
  • 17. © Fidelis Cybersecurity 24x7 Managed Detection and Response (MDR) Let Us Be Your Threat Hunting and Data Leakage Mitigation Team 17 Deep Visibility and Automated Detection and Response across your Network, Endpoints, Cloud and Enterprise IoT Devices • Full service solution focused on detection, response and remediation - managed and monitored by security experts  Discover and Classify Network Assets  Enforce Network Detection and Response (NTA)  Data Leakage Prevention (DLP)  Endpoint Detection and Response (EDR)  Deception to identify existing intruders or insider threats • Verifies and enforces your security policies and compliance requirements to ensure the highest standards
  • 18. © Fidelis Cybersecurity Fidelis Professional Services 18 Incident Response • Retainers • Subject Matter Experts Customer Success • Security Program Review • IR Readiness Assessment • SOC Assessment Product • Implementations • Training • Cloud Delivery/Subscription A team of highly experienced security assessment and IR professionals who have helped some of the largest organizations investigate and respond to breaches in over 4,000 engagements
  • 19. © Fidelis Cybersecurity • Responded to large security cases in commercial and government sectors • Instrumental in building large Government and Commercial security operations centers • Critical roles in the indictment and conviction of multiple organized international cyber criminals • Key members of the security team on average, have over 18 years of incident response experience 19 SECURITY EXPERTISE PROVEN PROCESS ADVANCED TECHNOLOGY Our security professionals have decades of experience assisting organizations of all sizes prepare and respond to security incidents Full IR Lifecycle Advanced Technology Security Expertise Proven Process Fidelis Services: Incident Response Experience Earned on the Front Lines
  • 20. © Fidelis Cybersecurity Full Incident Response Lifecycle 20 Initial Response Investigation & Containment RemediationExpulsion • Triage • Scope • SITREP • Actions Taken • Planned Actions • Capabilities • Evidence • Forensics • Malware RE • IOCs • Monitoring • Taxonomy and Timelines • 72 hour Plan • Monitoring • Validation • Tracking • Restore • Report • Roadmap • SME Support • Training • Processes • Policy Fidelis Services: Full Incident Response Lifecycle
  • 21. © Fidelis Cybersecurity Fidelis Services: Preparation 1.Need to follow a Security Standard accounts for all enterprise Networks, Systems, and Data (not just regulatory) 2.Need full data accountability and risk (Data Characterization) 3.Know your vulnerabilities A. Red Team B. Pentest C. Vulnerability Management 4.Prearrange 3rd Party IR help A. Outside Counsel B. Forensics C. IR Support D. Law Enforcement E. Help Desk for customer support F. Cyber Insurance 21
  • 22. © Fidelis Cybersecurity Fidelis Services: Detection 1.Need full enterprise visibility across the network and endpoints for situational awareness 2.Need lateral visibility 3.Security Policy that supports enterprise wide response Authority 4.Have a Continuity of Operations Plan (COOP) 22
  • 23. © Fidelis Cybersecurity Fidelis Services: Response 1.Need an exercised IR plan A. Communications Plan B. Ensure your IR plan covers regulatory requirements C. War room plan D. 3rd party integration E. IR tracking software and repository 2.Decide on your response based on capabilities A. Immediate B. Delayed 3.Don’t stomp on evidence A. Collect evidence before remediation B. Don’t cut off attackers without external advice 4.Know when to call in experts and counsel for privilege 23
  • 24. © Fidelis Cybersecurity Selecting MDR Services • Advanced Technology • Expert Partner • Processes and Threat Hunting • Constantly Monitor Security Stack for the Next Smoking Gun • Validated Alerts • Critical Remediation Authority 24

Editor's Notes

  1. Critical Capabilities for MDR Services – Public Presentation Fidelis Cybersecurity, Inc.
  2. While we have many customers who rely on our products, many do not have the teams or skillsets to leverage the full value of our detection and response capabilities, so we also offer a 24x7 MDR service with our IR and SOC experts running our platform. You only see alerts that are critical to your business. We can hunt for threats before they reach critical mass and we can eradicate threats from your environment. All of this allows you to focus on your primary business.
  3. The Fidelis Security Consulting Services team is comprised of industry-leading forensic experts, experienced network security engineers, and dedicated malware reverse engineering specialists who use their deep understanding of malware tactics, techniques, and the advanced threat landscape to stop exploitation by attackers. Our security consulting team combines experience and expertise to respond to advanced malware attacks, insider theft of IP, and coordinated attacks across a multitude of government and commercial sector clients.
  4. Here we discuss the phases of a breach and how we support counsel What are the 3 or 4 basic questions….how did they get in, what did they take/see, how many, are they still here? Program Managers & Architect assigned to each engagement Facilitate Communications between counsel and client, handling privilege Effective coordination with IT and Security team of client, and use of their tools Solid acquisition of evidence and chain of custody (logs, images, Columbia Facility); Monitoring capabilities during and after the breach, through the incident lifecycle. Scale resources up or down as needed, handle remote breaches; SOW is focused; People are former DoD/Law Enforcement, respect confidentiality (Sony and Target reputation damage resulting from leaks)