Month: September 2020

Few organizations have the resources in house to effectively manage their security programs while proactively defending against new and emerging threats.

As a result, organizations are looking to managed detection and response (MDR) services to run their security operations programs.

However, the security services marketplace is relatively new it’s and filled with false claims and confusing jargon.

Our MDR Buyers Guide is available as a PDF or in audio format and provides clarity by walking you through the key considerations when choosing an MDR service. It also enables you to see how MDR providers stack up against one another.

Evaluating MDR providers: 12 questions to ask

When evaluating an MDR provider, we recommending asking the following:

1. How many customers does the MDR service have?

The current customer count will give you an idea of how many other organizations trust the service provider, and how well-versed they are at responding to suspicious activity.

2. What is the scope of the service? Is threat response included?

Most vendors focus on threat identification and notification, leaving response and remediation to the customer. Effective MDR services go far beyond this. Ask for clarity on what is offered.

3. Is the service 24/7/365? If an issue arises at 2AM on a Sunday, who will respond?

Ensure the MDR service truly monitors your environment and is able to respond any time, day or night.

4. Which technologies does the service utilize? Are they included in the price?

Ask if the technology used by the operators is included in the price of the service or if you must purchase your own tools separately.

5. Is the service being provided proactive or reactive?

MDR is a proactive discipline. Ensure you’re not being offered digital forensics and incident response services, typically used to deal with an existing crisis.

6. How will you interact with the MDR team?

Is there direct call-in support? Can you communicate via email? Speak directly with SOC analysts, or through an intermediary?

7. What is the security operations threat detection and response (TDR) methodology?

MDR providers should have a well-defined TDR methodology. If not, they’ll likely struggle to scale as their business grows and will be more likely to miss important indicators of suspicious activity.

8. How fast is the service?

In security, seconds matter. MDR providers should be able to estimate the average times to detect, respond, and resolve.

9. What types of remediation actions can the MDR operators take? Can they take active response for you?

Find out what happens when the service detects suspicious activity. Many will simply monitor and notify you. They should be able to act on your behalf and provide response.

10. Is threat hunting lead-driven (responding to alerts), lead-less (looking for new indicators of attack without alerts), or both?

Some vendors refer to automated alert generation as threat hunting (it’s not). Understand if the MDR operators will proactively hunt to detect adversaries in your environment regardless of whether or not they’ve detected a strong indicator of activity or compromise.

11. What data sources are used to provide visibility? Is the service just “managed EDR”?

While endpoint data is critical for a security operation program, some MDR providers don’t have any additional visibility beyond the endpoint. These are not true MDR providers but rather “managed EDR” services.

12. Does the MDR provider have access to threat intelligence and threat researchers?

MDR providers should have a level of expertise that goes beyond what most organizations can build independently: skilled security analysts, access to proprietary threat intelligence, and collaboration with threat researchers when something novel is detected.

These questions and a comprehensive vendor comparison are covered in our MDR Buyers Guide – available as a PDF or in audio format.

Give your organization the best protection with Sophos Managed Threat Response (MTR)

Sophos MTR provides 24/7 threat hunting, detection, and response capabilities delivered by an expert team as a fully-managed service. Beyond simply notifying you of attacks or suspicious behaviors, the Sophos MTR team takes targeted actions on your behalf to neutralize even the most sophisticated and complex threats.

The Sophos MTR team of threat hunters and response experts:

• Proactively hunt for and validate potential threats and incidents
• Use all available information to determine the scope and severity of threats
• Apply the appropriate business context for valid threats
• Initiate actions to remotely disrupt, contain, and neutralize threats
• Provide actionable advice for addressing the root cause of recurring incidents

Visit Sophos.com/MTR today to learn more.

DOWNLOAD: ‘MDR Buyers Guide’ full report ►

Sophos XG Firewall has joined the robust and growing Nutanix ecosystem that is enabling global enterprises to converge and virtualize their IT infrastructure.

XG Firewall is now Nutanix AHV and Nutanix Flow ready to provide protection for networked applications and traffic in Nutanix virtualized environments. XG Firewall delivers the same kind of easy deployment, management and performance that Nutanix AHV is known for.

Nutanix is the industry leader in hyperconverged infrastructure (HCI) that makes the underlying datacenter and cloud infrastructure invisible, abstracting and elevating it to enable businesses to focus on their applications and services. The Nutanix AHV hypervisor converges private, public, and distributed clouds, bringing simplicity and agility to infrastructure management.

XG Firewall v18 with the new Xstream Architecture running on Nutanix AHV provides deeper visibility into applications, network activity, and threats – able to stop even previously unseen attacks.

Nutanix Flow is a software defined network policy engine built into AHV that provides easy and granular policy-driven application micro-segmentation.

XG Firewall has been validated to provide two modes of operation within Nutanix AHV infrastructure:

1. XG firewall can provide standard NGFW protection on Nutanix AHV similar to any other physical, virtual, cloud, or hybrid network.
2. In addition, non-IP bridge mode in XG can be used within the network as part of Nutanix Flow’s micro-segmentation to transparently redirect VM traffic through a virtual XG Firewall running in bridge mode on every AHV host to protect east-west traffic.

XG Firewall can protect traffic entering and leaving the Nutanix AHV infrastructure while also securing traffic moving within the Nutanix Flow software defined network, taking advantage of the granular redirection capabilities of Nutanix Flow micro-segmentation that ensures security protection policies are optimized for individual applications.

XG Firewall’s full suite of protection capabilities will help secure Nutanix applications and network traffic flows, including TLS inspection, intrusion prevention, application control, web protection and filtering, and zero-day threat protection with sandboxing and threat intelligence.

Visit Sophos.com/Firewall to learn more about XG Firewall products.