Cyber Defined! MDR, XDR, EDR, NDR
Melden
23. Mar 2023•0 gefällt mir•62 Aufrufe
1 gefällt mir
Sei der Erste, dem dies gefällt
Mehr anzeigen
Aufrufe
Aufrufe insgesamt
0
Auf Slideshare
0
Aus Einbettungen
0
Anzahl der Einbettungen
0
Check these out next
Cyber Defined! MDR, XDR, EDR, NDR
23. Mar 2023•0 gefällt mir•62 Aufrufe
1 gefällt mir
Sei der Erste, dem dies gefällt
Mehr anzeigen
Aufrufe
Aufrufe insgesamt
0
Auf Slideshare
0
Aus Einbettungen
0
Anzahl der Einbettungen
0
Melden
Technologie
Cyber Defined! MDR, XDR, EDR, NDR Mike Sci - eSentire Cybersecurity is a big data problem. Learn how to be an educated consumer of MDR (Managed Detection and Response) and understand what is XDR, EDR, and NDR and why it matters! In addition, Mike will share a methodology for evaluating and defining MDR solutions to separate fact from fiction in a rapidly growing security segment.
Recomendados
"Navigate the MDR Marketplace Like a Pro!"Advanced Technology Consulting (ATC)
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
Critical Capabilities for MDR Services - What to Know Before You BuyFidelis Cybersecurity
The Business Benefits of Threat Intelligence WebinarThreatConnect
Our New York Specialisms SummerColes
Detecon Cyber Security RadarDaniel Steinfeld
Cyber Defined! MDR, XDR, EDR, NDR
- Demystifying MDR Mike Sci, Senior Solutions Architect Cyber Security Professional MDR Expert Michael.Sci@esentire.com
- eSentire CONFIDENTIAL 2 Cyber Defined! Cyber Security Risk- Who are the adversaries? Cyber Security – The BIG data problem Defining the MDR Marketplace- MDR,XDR,EDR,NDR The eSentire approach
- 01 Who are the adversaries? Privileged and Confidential 3 Who are the adversaries?
- Privileged and Confidential 4 The Unusual Suspects
- eSentire CONFIDENTIAL 5 Cybersecurity is a massive data analysis problem • You need a robust solution that can analyze massive amounts of data for hidden threats. • Our cloud-native MDR platform ingests data, turns it into insights and accelerates indicators of concern to our elite threat hunters who identify attacks in seconds and contain them in minutes before they disrupt your business.
- How to manage the Tsunami of data eSentire CONFIDENTIAL 6 Multi-signal ingestion. Cloud-delivered architecture. Serverless Compute Network Isolation Ingestion gateway Signal normalization Secure, reliable, and scalable API for data capture Translate raw signals to common event model Investigation, response, and customer notification Investigation platform Single pane of glass Enrichments and recommendations Orchestration Normalized signals are enriched and exit with automated response or recommendations Virtual Private Cloud Threat Intel Service Asset Context Service Global Learnings Service ML Model Service Virtual Private Cloud DNS Routing Secure API Gateway Data Streaming Data Streaming Network Isolation Investigation Store Servicenow Open Source SOAR SOC Dashboard Virtual Desktop M A C H I N E H U M A N LOG NETWORK CLOUD ENDPOINT Signal Sources
- eSentire CONFIDENTIAL 7 Defining the MDR marketplace 1
- MDR emerges. Clever marketing follows. eSentire CONFIDENTIAL 8 Reality: Retainer for incident response Reality: Client-side response team required Reality: Little or no tactical containment Managed Detection and RESPONSE Marketing verbiage distorts what really means to the customer Reality: Requires add-ons for full functionality Reality: High analyst to customer ratio Reality: Unproven marketplace solutions F U L L V I S I B I L I T Y M D R
- Leveling the playing field eSentire CONFIDENTIAL 9 VISIBILITY SIGNAL FIDELITY RESPONSE DETECTION • Visibility • Fidelity • Detection Capability • Response
- Visibility | Fidelity | Detection eSentire CONFIDENTIAL 10 Full Visibility Regardless of Deployment Model VISIBILITY SIGNAL FIDELITY RESPONSE DETECTION Single Telemetry Source Multiple Telemetry Sources (Endpoint + Network) Medium Level (e.g., Full telemetry in some, limited in others) High Level (e.g., Full endpoint, PCAP, Log, Vulnerability, etc.) Low Level (e.g., Log, NetFlow) • Known • Customized TI • Active + Proactive Threat Hunting • Advanced Behavioral • Advanced Machine Learning • Known • Customized Threat Intelligence • Active Threat Hunting • Limited ML • Limited Behavioral • Known • Commodity Threat Intelligence
- Response eSentire CONFIDENTIAL 11 Full Visibility Regardless of Deployment Model VISIBILITY SIGNAL FIDELITY RESPONSE DETECTION Single Telemetry Source Multiple Telemetry Sources (Endpoint + Network) Medium Level (e.g., Full telemetry in some, limited in others) High Level (e.g., Full endpoint, PCAP, Log, Vulnerability, etc.) Low Level (e.g., Log, NetFlow) • Known • Customized TI • Active + Proactive Threat Hunting • Advanced Behavioral • Advanced Machine Learning • Known • Customized Threat Intelligence • Active Threat Hunting • Limited ML • Limited Behavioral • Known • Commodity Threat Intelligence • Full IR Lifecycle Support • Managed Remote Threat Containment • Validation • Full Forensics • Know Threat Automation • Limited IR Lifecyle Support • Validation • Limited Forensics • Know Threat Automation • Non-vetted Alert Forwarding • Limited Forensics
- eSentire MDR vs. Other Industry Models eSentire CONFIDENTIAL 12 EDr Single Telemetry • Singular telemetry • Investigation/threat vetting • Client-side containment • Endpoint forensics • Lack of correlation with other signals MDr Multi-Telemetry • Higher telemetry • Investigation/threat confirmation • Client-side containment • Advanced detection capabilities • Forensics • Limited correlation with other signals SIEM Managed • Limited visibility beyond logs • Limited signal fidelity • Limited forensic and correlation capabilities • Higher incidence of false positives • Limited IR Lifecycle coverage Visibility Signal Fidelity Detection Capabilities Response • Complete visibility across attack surface • Ability to correlate multiple signals • Limited false positives • Full IR Lifecycle support MDR Full Telemetry
- Spotting red flags eSentire CONFIDENTIAL 13 F I N A N C I A L S T R E N G T H • Is the company public or private? • Who are the company’s backers/investors, and what are their track records? • Is the company profitable? • What is the company’s commitment to – and investment in – research and development? • How much of the company’s revenue is attributable to MDR? • For how long will the company remain financially viable without additional investment? C O M PA N Y P R O F I L E • What was the company’s original mission? • How has the company evolved over time? • What is the company’s core competency? • Is the company a marker leader or a follower? • What is the leaderships team’s background? • What markets does the company serve? P E O P L E & S E R V I C E D E L I V E R Y • From where does the company provide the service? • Does the company have different levels of analysis? • Does the company have specific response personnel? • Does the company have dedicated threat intelligence analysts and researchers? • For what positions has the company hired in the past? • For what positions is the company currently hiring? • Where are the new positions based? I N N O VAT I O N • Does the company hold granted patents and intellectual property? • What is the company’s history of service and product releases? • Does the service and product release history indicate reactive response to cyberlandscape developments or proactive anticipation of emerging shifts? • What are the background, specializations and skillsets of the company’s development and engineering team? (LinkedIn is a useful resource in this regard). • For what percentage of the total employee base do development and engineering account? D E M O N S T R AT I O N O F D E L I V E R Y & R E V I E W S • What do employees say about the company? (Glassdoor is a useful resources in this regard.) • What do peer review sites such as Gartner Peer Insights, SpiceWorks, G2Crowd, etc. reveal about the company? • What do seaches on subreddits receal for experiences working with or at the company? • Does the company have case studies? • Is the company clear about what they do and how they will deliver? • Does the company have customer references and statements attesting to delivery? • What are the company’s client satisfaction scores, NPS and retention rates?
- Operational Leadership Service Capability Talent Expertise Threat Intelligence Value Demonstrated Culture / Experience What to Expect From Your Cybersecurity Partner The Authority in Managed Detection and Response The World’s Most Complete Threat Response eSentire’s Cyber Resilience Team The Power Of eSentire’s Threat Response Unit Insight Portal, Executive Dashboard, Resilience Score An Attack On You Is An Attack On Us 1 2 3 4 5 6 eSentire CONFIDENTIAL 14
- eSentire CONFIDENTIAL 15 Our approach- Cyber Resilance 1
- eSentire CONFIDENTIAL 16
- ` When Everything Is On The Line, There Is No Time Like Now… eSentire CONFIDENTIAL 17 Our cybersecurity services portfolio is designed to stop breaches, simplify security and minimize your business risk. We provide 24/7 threat protection that is proactive, personalized and cost effective. B U I L D R E S I L I E N C E . P R E V E N T D I S R U P T I O N . Service portfolio that supports how we help organizations Anticipate, Withstand, and Recover from cyber attacks. Detect, investigate, disrupt, contain cyber attacks. Understand, prepare, predict cyber threats. Manage and prioritize cyber risk. Return to standard operation. Threat eradication, crime scene reconstruction, investigations that can bear scrutiny in court of law. A N T I C I PAT E W I T H S TA N D R E C O V E R A D A P T/ E V O LV E
- Gain Confidence, Control & Expertise eSentire CONFIDENTIAL 18 Our cybersecurity services portfolio is designed to stop breaches, simplify security and minimize business risk. We provide around-the-clock threat protection that is proactive, personalized and cost effective. Exposure Management Strategic services including Managed Vulnerability Assessments, vCISO and Managed Phishing & Security Awareness Training to identify gaps, build defensive strategies, operationalize risk mitigation and continuously advance your security program. Managed Detection & Response We deliver Response + Remediation you can trust. By combining our cutting-edge XDR platform, 24/7 SOC support, around the clock threat hunting and security operations leadership, we hunt and stop known & unknown threats before they disrupt your business. PREVENT THREATS BECOMING BUSINESS DISRUPTING EVENTS Digital Forensics & Incident Response Battle-tested Incident Commander level expertise, crime scene reconstruction and digital forensics investigations that can bear scrutiny in a court of law. The world’s fastest threat suppression guarantee with a 4-hour SLA available with our IR Retainer. BE READY WITH THE WORLD’S FASTEST THREAT SUPPRESSION TAKE CONTROL AS WE MANAGE & PRIORITIZE CYBER RISK A D A P T / E V O L V E | Cyber Risk Advisor Model, 24/7 Insight Portal Access, Resilience Roadmap and more A N T I C I P A T E W I T H S T A N D R E C O V E R
- Seattle Waterloo Cork London New York SOC SOC Virginia Forensics Lab The Authority In Managed Detection And Response eSentire CONFIDENTIAL 19 Mission-Driven To Build Your Resilience and Prevent Your Business Ever Being Disrupted. 5M+ new medical records Protected annually Disrupting Threats To Keep Healthcare OperationsLive Critical Protection World’s Largest Meat Processing Company Ensuring No Disruption to the Global Food Supply Chain Protecting US$6.5T AUM More than the top 20 US banks combined Two Decades of Battling Persistent Fin Serv Threats Secures the largest municipally owned utility Protecting 30+ Energy/Utility Providers Including the Largest US Municipally-Owned Utility with 4M+ Residents 2 Security Operations Centers 24/7 Threat Hunting and Support Open XDR Platform with Automated Disruptions 24/7 SOC Protection Cyber Resilience Team Deep Investigation and Actual Threat Response Threat Intelligence Operationalized by TRU Rapid Time to Value – 15 Min Mean Time to Contain Over 500 customers In the critical infrastructure sectors recognized by CISA Securing systems deemed vital to US Security, Economy, Public Health & Safety Founded in 2001 Customers: 2000+ Countries: 80+ Employees: 630+
- eSentire Full Signal MDR Summary 20 C O V E R A G E F O R E N S I C C A P T U R E North/South (ingress, egress) Full packet capture and traffic metadata East/West (internal, lateral) Endpoint telemetry Contextual awareness 12-month archival (adjustable) IaaS and SaaS environments Cloud provider logs and real- time telemetry Vulnerabilities and policies LOG NETWORK CLOUD ENDPOINT Managed Vulnerability Service Operational Risk Proprietary Technology C L I E N T T O O L S R E S P O N S E Network traffic blocking Terminate malicious processes Endpoint isolation Remediate cloud misconfigurations Runbooks Operational Awareness Microsoft Office 365 Email Security Platform Microsoft 365 Defender Email Threat Prevention
- How eSentire MDR Works eSentire CONFIDENTIAL 21 On-Premises, In The Cloud, Hybrid? We’re all-in to protect you with enterprise grade technology, 24/7 expertise and decades of security operations leadership. S I G N A L S Network Endpoint Log Cloud Identity Vulnerability Multi-Signal Ingest Access investigation analysis, critical KPIs and reporting I N S I G H T P O R T A L eSentire experts hunt, contain and respond to attackers. 2 4 / 7 S O C Daily Escalations 700 Daily Threat Containments 400 Mean Time to Contain 15min R E S P O N S E E S E N T I R E S E C U R I T Y N E T W O R K E F F E C T S - B U I L D R E S I L I E N C E 200+ IOCs/IPs added daily Defenses hardened Community intelligence activated E S E N T I R E T H R E A T R E S P O N S E U N I T ( T R U ) Original Research & Threat Tracking Proactive hunting and sweeps Novel Detection + ML Models E S E N T I R E X D R P L AT F O R M S E C O N D S T O R E S P O N D | M I N U T E S T O C O N T A I N Daily Human-led SOC Investigations 6000 Daily Signals Ingested 20.5M Daily Automated XDR Platform Disruptions 3M E N R I C H Cloud-native platform Data normalized Enrichment: depuplication, geolookup, asset lookup, IP match, customer context Raw telemetry ingested Correlated Automated disruptions Analyst Experience Prioritizes: Single pane of glass for analysis/search Templated investigation guide Grouped investigation type Outlined escalation path ML model suggested action as part of QA Manual containment expertise Tiered support system
- “Everybody has a plan, until they get punched in the face” - “Iron” Mike Tyson
- ©2014 AKAMAI | FASTER FORWARDTM Thank you! Questions? Mike Sci Sr. Solutions Architect | Cyber Security Professional | Public Speaker | MDR Expert Michael.Sci@esentire.com
Hinweis der Redaktion
- My name is Mike, Sci and I’m a SR. Channel Solutions engineer, based in Atlanta GA My first exposure to cybersecurity was back in 2010 working for a major CDN company where we offered WAF in the cloud. I then started working in the managed security space, selling platform management, SIEM and other security services. While working in this space I found customers did not have the staff or expertise needed to understand and respond to the flood alerts coming in from their MSP. This was back in 2016 when I read "Gartner's guide to managed detection and response” Reading this guide I realized that MDR was solving for a need that was not being addressed by traditional MSSPs. The need was for embedded, Realtime incident response, not just alerting and guidance, which left the burden on the customer to do the forensic analysis, determine the severity of the incident and ultimately respond to the threat themselves, in a timely manor. This brought me to working for the the originator of MDR, eSentire, where I could confidently sell a solution that would ensure they would not have a business impacting event. I started working as an SE supporting direct sales then Moved into a channel SE role.
- Today I’m going to cover three key areas to show you how cyber security is really a big data problem. Give you some insight on the MDR marketplace and give you the highlight real on our approach here at eSentire. I’m going to pack a lot in over the next 30 minutes, so fasten your seat belt. Will save some time at the end for questions and I’m always available anytime after this webinar.
- There has been an evolution of cyber adversaries
- The insider-Most difficult Suspect to detect and counteract, disgruntled employee, a commercial spy- Inside castle walls enables him to bypass security controls, Access to passwords, USB drive, steel data, install malware Getaway- Too young for jail, if caught slap on the wrist, Basic hacker, curious, impress peers Hactivist- Pick a cause, political, religious, any social cause, Targets adversaries with data theft, reputational damage / defacement of sites and social media, Can also be smoke screen for other activities, threat actors Nation State Actor- License to Hack- TACTICS AND TECHNICQUES are STATE OF THE ART IN CYBER ATTACKS. Sophisticated, cover their tracks- (Mimicked or stolen by other suspects) The professional – Work 9 to 5, built a shadow career supportin cyber crime. May run a botnet, be part of an organized crime group, sell cyber tools. Have extensive criminal contacts The Mule- Casual criminal, opportunist, Final Link in the Cyber crime chain, Turns internet based activities into hard, cold cash!! Stolen credit cards, bitcoin transfers…….
- Now were confronting and trying to manage a massive data analysis problem (What do we do with all the data?) Having cloud, on-premise and hybrid environments has increased the noise that customers needs to sort through. It has also increased the attack surface the the burden on all organizations, especially S&B companies who don’t have funding or resources required to protect them. You not only need full spectrum visibility, but you need to be able to make sense of the data You may ask, How do we do that?
- At esentire we leveraging a our Atlas cloud native platform To solve this massive data analysis problem You need to start with pulling in the relevant security data sources or signals from network, endpoint, log, cloud. these signals are ingested into a common gateway. Next, they are sent to a data stream where they are normalized into standardized data via defined schemas. This data is enriched with geo data, WHOIS data, and other enrichment data such as our Threat Intelligence, Machine Learning, Global Learning Service and Asset Context Service. Rules are applied to enriched events and they exit with automated response or recommendations. meaningful events are made available to our Security Operations Centers via the SOC dashboard. The SOC Dashboard includes event details, investigation tools and response capabilities that our threat hunters can use to disrupt and contain a threats. Lets take a look at a typical customer
- So let’s dig into, Defining the MDR marketplace
- As MDR has become the latest cyber security buzz word, it has created confusion in the marketplace. There have been a lot of so called MDR competitors join the race in the past 3 to 4 years In 2016, Gartner released the first official market guide for managed, detection and response services (just before I joined esentire) They cited 14 organizations as MDR vendors. Just three years later, Gartner’s 2019 edition list over 200 providers in the MDR market space. While many analyst firms have released reports or guides that include broad category definitions of MDR, there is still a lack of clear attributes for measurement. Since there is no singular definition established for MDR, I'm going to provide you a methodology for evaluating not only MDR providers, but can also be used in evaluating capabilities of MSSP’s and other security solutions
- On The previous slide I presented some subjective considerations, now as promised, I’m going provide you that methodology for evaluating MDR providers. This radar chart combines the four technical criteria for evaluating providers. Visibility, Detection, Signal Fidelity and Response. These criteria correspond to the primary purpose of MDR: minimizing threat actor dwell time. these criteria captures the capabilities of the MDR segment.
- Starting with Visibility, from applications to infrastructure, on–premises, in the cloud or in both. What was once a clearly defined defensive perimeter is now a shifting blend of mobile users and cloud workloads. As a result, you need visibility into multiple telemetry sources. MDR Providers typically rely on telemetry from multiple sources: endpoints, network, log data, cloud or vulnerabilities. Base level MDR starts with Single telemetry, moves to Multiple telemetry and finally Full telemetry or as we call it full spectrum visibility Next, we have Signal Fidelity. Log data provides broad level visibility, but is limited in depth, whereas full packet capture from the network provides deep fidelity but is limited in breadth of scope. Importantly, each has strengths and weaknesses when applied to the investigative process. Looking at the third axis, we consider Detection capabilities. This may include threat hunting techniques, machine learning, automation, customized threat intelligence, behavioral, and perhaps known and unknowns. But it's the capability to find signals in the noise that separates advanced technologies.
- Back to the fourth axis, Response, Time to detect, respond and contain is critical……….. Looking at the three categories of response: Tier one, non vetted alert forwarding with limited forensics. Tier two, threat validation, limited forensics, known threat automation and limited IR lifecycle support. Tier three, threat validation, full forensics, known threat automation, managed remote tactical containment and full IR lifecycle support. At eSentire we are considered tier 3 and are with you until the threat is eliminated! ---- Keep in mind......You have seconds and minutes to detect and respond, not hours and days we call this Micro Incident response or embedded real time response I'm sure most people on this call are familiar with incident response retainers? Ask yourself........How long does it take to initiate an IR retainer and then respond to a potentially business impacting event ? What would be the benefit to embedded real time incident response?
- This radar chart combines the four technical criteria (Visibility, Detection, Signal Fidelity and Response) for evaluating MDR and MSP providers. These criteria correspond to the primary purpose of MDR: minimizing threat actor dwell time. You can use this chart to see how the competitors stack up against these criteria. Talk to slide: MD r R..... Some questions you can ask yourself, What is a good enough solution? Are you a first- or second-generation buyers? Meaning have you learned what your true needs are from your first or even second experience with a security provider? ====== SOC-as-a-Service or Managed SIEM is a category of MDR Provider commonly characterized by MSSPs that are evolving services from alert-driven to more comprehensive coverage across the IR lifecycle. Capitalizing on the breadth of log visibility, SOC-as-a-service or Managed SIEM providers offer a cost-effective option to organizations that are looking to outsource expertise but have limited budgets. Endpoint Detection and Response and MDR are used interchangeably by many managed endpoint detection and response providers. Edr, or in this case, ED, little ‘r’ is a subset of the MDR market, providing expertise focused solely on endpoint. As a category, ED little ’r’ providers offer advanced detection capabilities for endpoint threats. However, the majority of the IR lifecycle, including containment is the client's responsibility. ED little ’r’ vendors are a viable option for organizations looking for endpoint monitoring and detection and that have in-house resources to correlate data from other single sources to confirm, triage and contain threats in a timely manner. MD little ’r’ multiple telemetry, represents the majority of the MDR market today. Vendors in this space leverage multiple telemetry sources but fall short of full stack visibility across on-premises and cloud environments. Typical combinations seen in this category, are endpoint and log together, most commonly. Or endpoint and network, or network and log. Vendors in this space typically utilize machine learning and behavioral analysis software to process large amounts of data to look for unknown threats. Coverage of the IR lifecycle is limited, and incident response retainers are typically available for clients in the event of an incident that cannot be handled in house. MD big ‘R’ full telemetry represents the MDR industry's most complete offerings. Full visibility across on premises and cloud environments, coupled with integrated machine learning and behavioral analysis, feeds threat hunters with vital information that facilitates near real time threat detection and containment. Additionally, SLA’s strictly outline potential threat actor dwell time, limiting client-side requirements for IR lifecycle coverage. Importantly, organizations looking to outsource to MD big ‘R’’ full telemetry providers must have complete trust in the providers capabilities to deliver on SLA’s.
- With over 200 “MDR” providers now being tracked in the marketplace, background differ vastly from one provider to another. MSSP’s have evolved their offerings, by adding an Italian menu of add on’s to try to compete in the MDR space (Do you want Canoli’s and expresso with the chick parm?) And Software providers have added a managed component, while consultants have added technology stacks to compete with pure play MDR providers, such as eSentire this slide represents potential red flags for organizations looking for an MDR provider. ====== Things you should consider are: company profile, financial strength, history or track record of innovation, service delivery, innovation and demonstration of delivery I suggest reading Gartner guide to managed detection and response or eSentire managed detection and response definitive guide. We can provide these to you.
- We’ve been doing this for over 20 years and created the category of MDR We have the world’s most targeted base with over 65% deemed critical infrastructure by CISA – critical to economic health, stability & vitality Proud of our industry recognitions but none more so than being named the G2 MDR leader and scoring 96% on Gartner Peer Insights bc that comes from your industry peers
- and I’ll leave you today with a quote from iron Mike Tyson………. Everybody has a plan until they get punched in the face. Most companies think they have a plan and a security service they can rely on, until they have that business impacting event. Boxers surround themselves by experts to train and protect them from their opponents. The same is true for cyber security, you need to have an expert team with a true MDR service behind you, to make sure you are prepared for the next fight to dodge, block and respond to your adversaries in real time. Thank you!
- My name is Mike, Sci and I’m a SR. Channel Solutions engineer, based in Atlanta GA My first exposure to cybersecurity was back in 2010 working for a major CDN company where we offered WAF in the cloud. I then started working in the managed security space, selling platform management, SIEM and other security services. While working in this space I found customers did not have the staff or expertise needed to understand and respond to the flood alerts coming in from their MSP. This was back in 2016 when I read "Gartner's guide to managed detection and response” Reading this guide I realized that MDR was solving for a need that was not being addressed by traditional MSSPs. The need was for embedded, Realtime incident response, not just alerting and guidance, which left the burden on the customer to do the forensic analysis, determine the severity of the incident and ultimately respond to the threat themselves, in a timely manor. This brought me to working for the the originator of MDR, eSentire, where I could confidently sell a solution that would ensure they would not have a business impacting event. I started working as an SE supporting direct sales then Moved into a channel SE role.