How a Managed Detection and Response (MDR) Provider Helps Organisations Anticipate Cyber Threats

Prevention beats cure, the old saying goes. The difficulty is that an organisation cannot prevent a problem it has not spotted. Cybersecurity has become a constant subject of discussion over the last few years, as the technology grows more sophisticated and the people attacking it grow bolder. Keeping a company safe from cyber threats matters to its stakeholders, and it matters just as much to the customers it has and the ones it hopes to win.

What Operation Malaysia showed

Malaysia learnt this in 2011, when the hacktivist collective Anonymous launched Operation Malaysia against 91 websites, 51 of them belonging to the government. The online vigilantes had warned beforehand that they would hit the government's official portal as payback for the blocking of Wikileaks, the site that sets out to expose governments and companies by publishing leaked secret documents. Most of the Malaysian sites in the firing line were knocked over by distributed denial of service attacks driven by botnets. Several, though, were actually broken into and defaced. Most were back online within 24 hours, but the financial and intelligence losses, which were never disclosed, pushed Malaysia towards becoming one of the most cyber-protected countries today.

A breach can do serious damage to how an organisation is seen and how far it is trusted. Data breaches reach the headlines so often that customers have good reason to be careful about which companies they deal with. Operation Malaysia is a reminder of how far things can go: that incident grew until national classified sovereignty was breached. With threats like these all around, the question every organisation faces is how it can show customers that their data is safe in its hands.

What an MDR service actually does

Having any real chance against an attack takes surveillance around the clock, and dependable managed detection and response (MDR) capability looks like the way to get it. MDR is a service bought in from outside that covers cybersecurity from end to end and acts on threats the moment they are found. Its job is to give an organisation the tools and the expertise to locate attacks and stop them as they happen.

Much of that work runs on logs. Log entries hold a great deal of information that helps reveal problems and patterns, and by watching them an MDR provider can pick out suspicious activity that may point to an attack on an organisation's systems. It can also record how equipment, systems or users normally behave, so that departures from that baseline stand out for investigation. Use cases, easy access from a console and a visual dashboard all make those anomalies quicker to see.

In practice the MDR provider analyses and investigates what it finds, reports on it, and helps stop the same kind of attack from happening again. The result for the organisation is a faster response to attacks, which keeps costs down and, above all, protects the trust its customers place in it.

Why building it in-house is out of reach for many

Think about what creating this capability from scratch would involve. An organisation would need an incident response programme and a security and incident response team, which could include security engineers, analysts, SOC managers, threat hunters, researchers and data scientists. It would also need a communications plan and procedures for escalation and notification, among other things. Only then could it run the core parts of MDR: threat intelligence, threat hunting, security monitoring at every hour of the day, incident analysis and incident response in real time. The bill for all of this could easily pass USD $1 Million a year.

Plenty of organisations simply lack the resources to build and keep a dedicated team that can fight off attacks and see them coming. That does not leave them without options. As-a-Service models have spread across many areas of technology, and MDR is one of them: a way to find active threats anywhere in an organisation and then act to remove them. Relying on an MDR provider means handing cybersecurity to outside specialists who watch for threats and analyse them, both reactively and proactively, on a subscription basis.

Bluesify's cyber threat centre

One such provider is Bluesify, whose 24x7 Cyber Security Operations Centre in Malaysia the company describes as the country's most advanced cyber threat centre. The centre provides XDR, 24/7 MDR and response automation for the organisations it serves. Its services also cover advanced threat intelligence in real time, continuous cybersecurity monitoring and incident response, cybersecurity consulting, security advisory work and vulnerability management.

According to Bluesify, the centre addresses 12 critical capabilities, with Gartner given as the reference, and uses continuous monitoring and analytics to prevent, detect, respond to and predict incoming attacks. The aim is to let a client see threats coming before they land, protecting both customer data and the organisation's reputation. The company sums up its approach in the diagram below.

The range of cyber threats has grown at a startling and worrying rate, especially since the pandemic. Defenders and attackers keep trading places in a game of cat and mouse, yet the statistics show that criminals are consistently several steps in front. Precautions can no longer be treated as optional extras. They deserve serious attention before an organisation suffers something worse than a financial blow, and the case made here is for a proactive stance against attacks.