Every day we read about news articles where security threats have evaded traditional security models, or how a cyberattack has once again compromised security and the back-ups which businesses rely on to protect their data, their brand, and their bottom line.  The cost of these attacks in 2021 came to approximately $3.5 Billion in downtime just to students across US Schools and Colleges.  These attacks keep ramping up, the sophistication has increased drastically, cybercriminals continue to target medical facilities, schools, and our government IT organizations, especially local municipalities and cities across the country.  

With the growth of Security Operations Centers (SOC), Security Information and Event Monitoring/Management (SIEM), and Endpoint Detection and Response (EDR) technologies, why are we still seeing all of these attacks?  Every one of these organizations has endpoint security, network security, firewalls, gateways, user training and awareness programs. So again...why are reading about successful attacks?

Not enough Resources, Too many Alerts

Well, part of that is 81% of IT professionals say 20% of their cloud security alerts are false positives, while 43% say 40% of their overall alerts are false positives.  When your analysts are spending over 1/5th of their time dismissing or threat hunting false positives, they aren't handling real cybersecurity threats.  And when companies are struggling to handle the burden of more and more sophisticated attacks with less resources, every second counts.

It takes time to maintain existing technologies, make sure patches are up to date, and continue to monitor for daily threat notifications - let alone spend time on threats that are simply false positives.  And what about threats that occur outside of normal business hours?  Or even outside of your organization?  An increasing number of attacks is occurring because of weaknesses in your vendor's technologies that will lead to vulnerabilities in your security architecture. 

Automation isn't nearly enough, and if your inhouse resources aren't enough, and you can't trust your vendor on what to do...what can you do? Well, the answer is simple, Managed Detection and Response (MDR).

Managed Detection and Response (MDR)

Comprised of 3 key categories, MDR is the following:

• Managed - controlled by real people, fully qualified and experienced security analysts who know what they're doing.  Not just relying on AI.
• Detection - Strong threat detection and monitoring for those advanced threats we're seeing out of the more modern and sophisticated attacks.  More than just seeing the malware or the aftermath, but looking for indicators of compromise (IoC) or even anomalous activities that lead to a Data Breach.
• Response - This needs to be an action!  A response that kills the malicious process or locks down or isolates a compromised system.  Whichever option, it needs to be something more than another alert that gets lost in your SIEM.  You need actionable responses where threats are stopped in real time.

It should be obvious the value of a security plan that offers all of the above, and that's one of the reasons London Security has partnered with Blackpoint Cyber to provide it.  We are hosting a webinar June 29th, 1 PM EST to talk more about the value of an MDR - and the added value of that form of security in today's threat landscape.

Join us next week to talk about the kinds of threats London Security and Blackpoint have been seeing across the various industries.  Let us show you how we respond and react during a live attack demo.  Talk is cheap, let us show you what an effective MDR Solution looks like.