Latest / CYBR.Signal / MDR is Not a Service

Transcript

MDR is Not a Service · CYBR.Signal

• 0:05
  SPEAKER_00: And hello everybody, happy Cyber Sunday.
• 0:07
  SPEAKER_00: My name is Michael Farnum.
• 0:09
  SPEAKER_00: Hope you're doing well.
• 0:10
  SPEAKER_00: I want to talk today about managed detection and response, and specifically for MDR for vendors, how to look at them when you're deciding to choose or you're looking at choosing one or maybe changing one, but generally just choosing one in general.
• 0:28
  SPEAKER_00: So if you've kind of come to the decision that hey, my security operations center either doesn't exist or I need help, I need some somebody to take over some stuff for me, maybe give me around the follow the sun coverage or just some nighttime coverage, whatever that is.
• 0:46
  SPEAKER_00: When you're looking at that, what I see some decision makers or the mistake I see some of them make is trying to treat an MDR uh when they look at them from the outside, kind of the marketing, they end up sometimes treating them a little bit like a product company instead of a service company.
• 1:07
  SPEAKER_00: And it's not necessarily their own fault.
• 1:11
  SPEAKER_00: The the way I see a lot of MDRs market themselves is almost a non in a non-traditional marketing way for a services company.
• 1:21
  SPEAKER_00: They want to show you a package type of a deal where you get a lot of stuff in one place, which is kind of how product companies tend to market.
• 1:31
  SPEAKER_00: And it's not right or wrong.
• 1:32
  SPEAKER_00: I mean, what they're doing is not they're not being incorrect in how they're servicing the customer.
• 1:40
  SPEAKER_00: Uh, they are, in a lot of ways, offering things and packages that offer you efficiencies, that kind of stuff from a managed perspective.
• 1:47
  SPEAKER_00: And a lot of them have products within their suite.
• 1:51
  SPEAKER_00: Some of them have their own endpoint agents, some of them have their own threat intel, so on and so forth.
• 1:57
  SPEAKER_00: So some of them have like the breach and attack simulation type.
• 2:02
  SPEAKER_00: Um, a lot of them have their own SIM, they have analytics, so UEBA, there's a lot of product built into MDR and a lot of these vendors that that have the MDR vendors that have it.
• 2:15
  SPEAKER_00: And what it leads you to believe is that you're getting all of this stuff or you're getting a product.
• 2:20
  SPEAKER_00: It's it's almost like a platform, where is ultimately what you're getting is a service.
• 2:26
  SPEAKER_00: There's a lot of times there's threat hunting service in there, there's the ability to manage your sim.
• 2:33
  SPEAKER_00: Some of them offer that.
• 2:35
  SPEAKER_00: Uh, there's the uh there's different service abilities.
• 2:38
  SPEAKER_00: I mean, they're literally giving you uh service or access to analysts, which is a service.
• 2:45
  SPEAKER_00: So I see that mistake happen where you look at this and you go, oh, this is I don't even know if a lot of decision makers are consciously thinking this.
• 2:54
  SPEAKER_00: They're just looking at it and getting marketed to as a serve or as a product versus a service, and there is a lot of product in a lot of those offerings, so it's there's that temptation and maybe that subconsciousness where you you look at it at a as a product versus a service.
• 3:12
  SPEAKER_00: So that can cause confusion.
• 3:13
  SPEAKER_00: And when you start looking at that and you treat it like a product versus a service, I've seen customers get genuinely surprised when you can't really do a proof of concept of an MDR, not a not a full-blown MDR.
• 3:27
  SPEAKER_00: Like if you if they have pieces where they man you they manage certain things for you, you can absolutely POC those, or a lot of times you can.
• 3:35
  SPEAKER_00: But it's really difficult to POC a full-blown MDR.
• 3:39
  SPEAKER_00: It's not impossible, but it's difficult.
• 3:40
  SPEAKER_00: And a lot of MDRs that I know don't even offer that as a possibility.
• 3:45
  SPEAKER_00: They just you just have to go through and look and see if it looks like it's good.
• 3:49
  SPEAKER_00: Go do an RFP or something like that.
• 3:52
  SPEAKER_00: So I say all of this with kind of a cautionary tell.
• 3:56
  SPEAKER_00: As you're looking at an MDR, make sure if you're looking, if you if you want them to supply you all of those things from a product perspective, if you don't have your own endpoint already or you don't care about switching, you're fine with switching.
• 4:10
  SPEAKER_00: If you want them to supply threat intel for you, if you want them to supply the SIM, the UEBA, the uh breach and a tax, if you want if they have all of that and you want them to provide that for you, it's completely fine.
• 4:22
  SPEAKER_00: You just have to realize that if you're buying that full bore thing, then most of what you're going to be looking for with the threat hunting and the analysts doing the look at all of the you know indicators of compromise and that kind of stuff, all of that stuff is a service.
• 4:38
  SPEAKER_00: And the more, even if they're automating a lot of that stuff, you still have to look at this as a service and you have to treat it as a service company versus just a product company, no matter how it's getting marketed to you.
• 4:51
  SPEAKER_00: And you have to think about all of the SLAs that are gonna be involved and the SLOs, you have to think about how you're gonna gel with those analysts, how they're gonna cover you.
• 5:02
  SPEAKER_00: Those are things you have to worry about, and you you can't go at this as a product sale versus a service sale.
• 5:08
  SPEAKER_00: It just gonna fail you if you do it that way, and especially if you're trying to do a proof of concept and you realize, hey, how am I really differentiating this MDR vendor from this one?
• 5:19
  SPEAKER_00: Because on the outside, a lot of them look exactly the same and they make all the same claims, and it can be hard to do that.
• 5:25
  SPEAKER_00: So you really have to dig under the covers and do your due diligence.
• 5:28
  SPEAKER_00: So, anyway, if you have any comments or questions about that, please let me know.
• 5:34
  SPEAKER_00: Uh finding the right MDR if you're going that route is not easy.
• 5:38
  SPEAKER_00: A lot of considerations.
• 5:40
  SPEAKER_00: Don't look at it as just a product company, even if they have their own products.
• 5:44
  SPEAKER_00: Make sure you look at it as a service company, too, and all the considerations that go there.
• 5:48
  SPEAKER_00: So, anyway, see you next time.
• 5:49
  SPEAKER_00: Thanks.