Cybersecurity
The first 24 hours of a cyber incident: what to do, and what not to
Decisions made in the first hours of an incident decide how much is lost, how long recovery takes and whether you can later explain what happened.
Cybersecurity
Eight questions to ask before you choose a managed detection and response provider
Every MDR proposal promises 24/7 monitoring. The differences that matter are in what is monitored, who is watching and what they are allowed to do at 3 a.m.
Managed detection and response, or MDR, gives organisations without a full security operations centre a team that watches their systems and acts on threats. Proposals tend to look alike. These questions help separate them.
1. What telemetry will you collect?
Endpoint data alone misses attacks on identity, email and cloud services. Ask which sources are included in the price: endpoints, identity providers, email, firewalls, cloud control planes, critical applications. Ask what happens to coverage for systems that cannot run an agent.
2. Who is watching, and where?
Ask how many analysts are on shift overnight and at weekends, how experienced they are, and whether the night shift can escalate to a senior engineer immediately.
3. What can you do without asking us?
Detection without response just produces alerts at 3 a.m. Agree in advance which actions the provider may take on its own, such as isolating a laptop, disabling an account or blocking a domain, and which require a call first.
4. How do you define your times?
Mean time to detect and mean time to respond mean nothing until both sides agree when the clock starts and stops. Ask for definitions and for the figures from the last few months, not targets.
5. What do you detect, and how do you prove it?
Ask how detection rules map to the MITRE ATT&CK framework, how often they are updated, and whether the provider will run tests against your environment to show detections firing.
6. Do you hunt?
Good providers look proactively for signs of compromise that no rule has caught, using threat intelligence relevant to your sector and region. Ask how often, and what you receive afterwards.
7. Where do our logs live?
Find out where logs are stored, for how long, who can access them, and whether that meets your data protection and regulatory obligations.
8. How do we leave?
Ask what happens to your data, detection content and agents at the end of the contract. A provider confident in its service will answer this clearly.
Our MDR service covers endpoints, identity, email, cloud and network, with analysts in the region, agreed response authority and logs kept where our clients need them.
