For medium-sized companies there is no such thing as 100% security against IT attacks. There will always be vulnerabilities like unpatched software, leaked passwords, or shadow IT that resourceful cyberpunks can use to infiltrate corporate networks. And as long as the attackers are human, they must be opposed by competent flesh-and-blood defenders. These experts are also within reach of medium-sized companies via external MDR (Managed Discovery as well as Reaction) services and Safety Procedure Facility (SOC) religious woman. They offer not only safety technologies, but also knowledge, experience and instinct.
Cyber attacks are becoming increasingly complex. More and more medium-sized companies have long since been targeted by criminals: Keyword Advanced Persistent Threats (APT). to adequately protect yourself against the increasingly complex attacks, it is no longer enough to build higher digital defense walls. For example, it is important to actively close security gaps and look for attackers who are already in the network unnoticed. Smaller companies in particular with limited technological resources and a lack of human resources can hardly prevent such an intrusion, let alone combat it.
Many companies lack the necessary spending plan to employ a group of IT security experts who are qualified to deal with this risk situation. And even if the financial means for your own SOC (Protection Procedure Facility) and the corresponding individual are available, the necessary specialists are difficult to find. The shortage of skilled workers in this area means that even large companies find it very difficult to set up a competent group and keep it in the long term. More and more organizations are therefore using external services as part of managed detection and response (MDR) services. Depending on the agreed scope of service, an SOC is part of such an MDR. This opportunity to bring outside expertise in-house is no longer utopian, even for medium-sized companies.
External help also available for medium-sized companies
What added value do companies receive if they use an external SOC as part of an MDR? The specialists in a safety and security procedure facility rely on information from a wide variety of sources in their work for these customers: Firstly, this includes data that an endpoint detection and response (EDR) solution collects in the company, secondly data aggregated in a Safety Info and also Occasion Monitoring (SIEM) or threat information from the telemetry of other endpoints are interpreted with machine learning, and thirdly information from other sources. Fed with this, they specifically recognize abnormal behavior, such as a fileless attack, and prevent greater damage as soon as an attack is successful. With their help, companies can also clean up their own network more quickly. They also advise their customers to continuously improve the defense.
Various teams of experts are available to the customer via an external SOC. The first point of contact is the Safety Account Supervisor, an interface between the customer and the entire team of experts. Emergency room controls the overall defense, evaluates all information based on knowledge of the company networks and, if necessary, starts additional research. His advice to customers is based on the work of other specialists, who create individual risk profiles and create up-to-date security alerts. The experts also take into account the industry-specific IT risk situation.
Photo: Bitdefender Modern EDR solutions provide visibility into the security posture at endpoints — providing an important foundation for the human analyst.
Sustainable security against IT attacks
The longer and better the teams of experts know the customer, the better they can protect their IT. The starting point is the detailed inventory of the customer’s IT and its digital processes at the beginning of the cooperation with an SOC. Here it is not only about the respective risk situation, but also about drawing a picture of the customer’s normal IT operation in as much detail as possible, distinguishing normal behavior from deviating behavior.
A continuously effective IT security service is based on four pillars:
Avoidance: Basic defense technologies filter out known malware and suspicious activities in advance. This gives security analysts time to focus on unknown threats and custom designed APT campaigns that go undetected by the devices. The experts also keep an eye on whether the employees are adhering to their company’s safety guidelines.
Discovery: Technologies for protection of endpoints (such as XEDR) help mitigate, while the expert teams actively search for new attacks that are specifically targeting the customer, their technology and industry. Above all, they check processes that deviate from the known behavior.
Coverage: It is important to report, especially with a view to the documentation requirements set by the European General Data Protection Regulation. Since it is digestive tract to know that customers are not cut off from the information and can also tune in themselves: they can log into the systems of the MDR service and thus see the same information as the external experts. In addition, past activities can be traced and forensic conclusions can be drawn from them.
Conclusion: Added value through human experts
Even the dangerous targeted cyber attacks are planned and carried out by humans. And as long as the attackers are flesh and blood, humans play a crucial role in the defense. Because: They act differently than machines. Artificial intelligence and machine learning help to detect attacks more quickly — for example, by detecting anomalies in user behavior. However, in order to use all available information and to recognize the often veiled intentions of the attackers, one needs trained and experienced analysts.
Organizations that don’t have the necessary spending plan to set up their own safety procedure facility– or want to support their existing SOC with experienced security experts– can rely on MDR services, pass away such an expert team and the human added value. Not only increase your IT security significantly, but also add a decisive factor to your toolbox of technological defense solutions: the support of competent security analysts.
Author: Daniel Clayton, VP of Global Solutions, Bitdefender.
NachrichtenJetRead MoreSicherheit, against, are, attacks, better, companies, medium-sized, Nachrichten, protected, this, way,