What Is Managed Detection & Response (MDR) and How It Has Protected Our Business

Managed Detection and Response (MDR) is a cybersecurity professional service that dedicates a 24/7 team of security specialists, utilizing innovative threat detection and analytics tools to monitor and evaluate the integrity of your endpoints (i.e. workstations, laptops, and servers). Your MDR team can leverage their individual security expertise with behavior analytics (specific to your company and global data) to determine the legitimacy of a threat and respond appropriately. 

Managed Detection & Response (MDR) Overview

Benefits of Managed Detection & Response (MDR)

MDR represents the shift to bring enterprise-level cybersecurity expertise and protection to small and mid-size businesses at a cost that makes sense for their business. Managed Detection and Response (MDR) will provide: 

• 24/7 Human Analysis – Specialized team of cybersecurity experts monitoring and evaluating data from your endpoints.
• Incident Review – Correlate “events” from your individual endpoints into broader “incidents” that can be investigated to uncover more sophisticated attacks. 
• Automated Threat Containment – Pauses high-risk activities, or behavior that is unusual for your operations. 
• Specialist-First Review – Enables swift action to prevent compromise from most incidents, you will only hear about what is important 
• Advanced Security Tools – Next-Generation Antivirus (NGAV) and Endpoint Detection and Response (EDR) are the tools used by your MDR team to keep your business safe, these tools can: 
  • Learn how your business operates so that it can recognize unusual behavior 
  • Automatically stop malicious processes from running 
  • Correlate events to understand how a piece of malware entered your environment and everything it did once it got in 
  • Perform a targeted roll back to restore endpoint to a state prior to the attack 

How MDR Has Protected Aldridge

MDR is a crucial component in an organization’s overall IT security solution. We know this because we have first-hand experience using it to protect our business from a zero-day attack. A zero-day means that the attack is so new that it is either completely unknown or that there has not been enough time to patch antivirus tools to recognize the attack. Here is how MDR kept our business safe: 

1. An attacker exploited a vulnerability in one of our internet-facing applications 
2. Our internet-facing application was then used as a launch pad to attempt a compromise on one of our servers and force it to launch a malicious process 
3. Our detection toolset recognized the suspicious behavior, paused the process, and sent it to our MDR team to review 
4. Our MDR team validated that it was a legitimate attack and conducted a thorough investigation of our environment for any other signs of damage or malicious activity 
5. The MDR team found that the threat was contained to just one specific server 
6. Our internal network team was looped in by our MDR team, who then rolled back the affected server to before the zero-day exploit was first discovered 

In days past, a zero-day attack would have been almost impossible to defend against because legacy security tools are mostly reactive. But because of EDR’s behavior-based flagging, and the quick response by our MDR team, we were able to fend off the zero-day attack without any data loss, compromise, or interruption to our operations.  

As a Managed Services Provider (MSP), we must take cybersecurity seriously. Cybercriminals routinely target MSPs because if they can compromise a MSP, they gain access to that MSP’s clients. We rely on modern security tools and services like MDR to keep our organization and our clients safe.  

Aldridge’s MDR Service

We believe that Managed Detection and Response (MDR) is so important that we have included it in our baseline IT Outsourcing service. We are always evaluating new security tools and services and working to make them approachable and affordable for smaller businesses.