This post was originally published on July 12, 2022, on ChannelBuzz.
The cybersecurity industry loves its acronyms. From AV to the long list of “DR” solutions and everything in between, MSPs need a glossary to keep track of all the cybersecurity solutions being pitched.
MSPs that offer managed security for their clients know that AV and a firewall won’t stop a serious cyber threat. In order to keep their clients safe from modern threats and to differentiate their security services, MSPs need more advanced and comprehensive security technologies.
However, with new acronyms popping up all the time, it’s tough to know which tools to add, replace, or remove from your cybersecurity tech stack.
In this blog, we’ll cover four key cybersecurity solutions—SIEM, EDR, MDR, and XDR—the pros and cons of each, and our advice for choosing the right technology.
Security information and event management (SIEM) solutions
Security information and event management (SIEM) solutions collect, process, and compile security-related data from multiple sources into a single dashboard.
SIEMs deploy agents to pull data from systems, applications, devices, and even other security tools such as firewalls. Then, it processes that data and stores it in a central location to streamline threat detection, investigation, and response activities.
MSPs can create “rules” that help the SIEM software identify suspicious activity—such as multiple failed log-in attempts or other irregular user activity—that may indicate an attack. The SIEM can also generate alerts to notify the MSP of a potential incident.
What are the benefits of a SIEM?
SIEMs act as a unified storage database, collecting logs and putting them together in one easy-to-access place. This consolidation reduces the need to manage separate portals, such as one for each tool used, saving MSPs a significant amount of time and effort.
In theory, having all that data available in one location would simplify the threat detection and analysis process. But because SIEMs focus more on compiling data than distilling it down, the volume of data can easily spiral out of control fast.
It’s expensive to configure, maintain, and oversee a SIEM, especially compared to other cybersecurity solutions on the market. SIEMs collect a lot of data and generate a lot of alerts, often requiring an entire team to help it run. MSPs that don’t have the people with the right skills to manage the system could miss real threats, putting their clients at greater risk of an attack.
Endpoint detection and response (EDR)
An endpoint detection and response (EDR) solution protects endpoints that connect to a network. Originally, EDR was the “next generation” of traditional endpoint protection (EPP), a signature-based form of threat detection.
Signature-based tools identify known threats by querying a database, comparing endpoint data to previously reported threat activity, and taking action if a match is found.
EDR often includes signature-based detection but takes it a step further with a greater focus on active monitoring. This enables EDR solutions to detect and identify unknown threats, such as advanced persistent threats (APTs).
What are the benefits of EDR?
EDR gives MSPs more insight into what’s happening on their clients’ endpoints, allowing them to resolve threats quickly. What’s more, since 70% of all breaches start with endpoints, EDR offers significant protection.
Because EDR reviews a broad set of security data, it can detect threats that EPP platforms might miss. EDR can integrate with other cybersecurity solutions, like a SIEM, to deliver more comprehensive protection.
However, EDR solutions’ narrow focus on endpoint telemetry can negatively influence threat detection. Abnormal endpoint activity paints an incomplete picture—if 70% of breaches start with endpoints, that means about 30% of attacks would go undetected. EDRs alone cannot detect threats to a client’s network or cloud-based services.
Often MSPs add more tools to cover other components of the threat surface, but with each tool producing its own alerts, staff can overwhelm quickly.
Extended detection and response (XDR)
Looking at a company’s infrastructure through a single lens doesn’t provide the full coverage needed for strong security. As we’ve seen, EDRs only address one part of the threat surface and can leave a business significantly exposed.
XDR attempts to solve these limitations by stitching together multiple pieces of technology to detect and respond to threats across endpoints, networks, and cloud services. This expansive view offers better protection, especially in the face of today’s hybrid work environments, organizations with complex IT infrastructures, and increasingly sophisticated cyberattacks.
What are the benefits of XDR?
XDR solutions recognize that endpoint security alone is not enough to protect businesses from cyber threats. Indicators of compromise (IoC) aren’t restricted to the endpoint; abnormal traffic on the network and anomalous cloud activity can indicate trouble as well.
Because of its broad approach, XDR offers:
- Improved detection and response: by focusing on the entire threat surface, XDR can help MSPs identify and address threats targeting many areas of a client’s IT infrastructure.
- Centralized user interface: XDR solutions centralize threat data in a single dashboard, often making it easier for MSPs to prioritize their time and efforts.
- Lower total cost of ownership: XDR solutions can simplify security toolsets, often replacing one or many tools at the same time, which helps MSPs increase their revenue and margins.
- Automated analytics: having a solution that identifies, triages, and prioritizes cyber threats is a huge benefit for MSPs already stretched thin with other responsibilities.
However, your existing security solutions can be difficult to integrate with the XDR platform. If the tools were not designed to work together—which in many cases they’re not—you may be missing the data or visibility needed to investigate a security incident. That’s also assuming your team has the deep expertise required to operate XDR, including how to correlate different data sources and how to know if any information is missing.
Additionally, this pieced-together approach typically demands greater CPU usage and processing power, posing a whole other challenge for smaller MSPs that may have limited resources.
Managed detection and response (MDR)
As we’ve seen, many cybersecurity tools generate significant amounts of information that a team needs to parse through. Reviewing telemetry data requires cybersecurity expertise that is hard to find. Even then, it’s a time-consuming and tedious process.
This is the challenge managed detection and response solutions seek to address.
As its name suggests, MDR is less a specific technology and more a managed service. MDR combines cybersecurity software with human expertise to identify, analyze, and address security incidents, often among a long list of other services.
MDR eliminates the need for MSPs to find and hire qualified experts to run the managed security service by putting detection and response responsibilities in the hands of a cybersecurity vendor.
Often, MDR simply adds the “managed” aspect to traditional detection and response activities. Other times, the MDR provider combines other security tools, such as a DNS firewall, network sensors, or cloud monitoring, that MSPs may also want to offer their clients.
What are the benefits of MDR?
One of the biggest benefits of choosing an MDR solution is that it gives valuable hours back to staff, allowing MSPs to focus on strategic initiatives that support business goals and growth.
In most cases, adding MDR to your cybersecurity stack takes up significantly less time and budget than building an in-house security team.
Working with the right MDR provider means MSPs no longer need to worry about:
- Threat analysis: MDR providers analyze security events and weed out false positives.
- Alert triage: the vendor’s cybersecurity team triages alerts which helps MSPs prioritize their efforts by focusing on the most critical issues first.
- Vulnerability management: MDR providers can proactively address vulnerabilities to minimize the risk and likelihood of an attack on your clients.
- Remediation: some MDR providers can help MSPs repair, restore, and remediate their client’s infrastructure after an incident.
One important thing to remember is that not all MDR solutions are the same. Not every provider offers an end-to-end defence. Some MDR solutions focus solely on the endpoint and do not account for network or cloud-based threats.
To choose the right MDR, start by looking at the completeness of the solution. What data is collected, endpoint-only or more? What technologies exist under the hood? Then, look at those who manage it. Who’s behind these technologies? Who developed these tools; who operates them? Can you get someone on the phone if you have concerns or questions?
Of course, you’ll also need to ask the basics. How easy is the solution to deploy? What does it cost?
In the end, determining what best meets your customers’ needs and your own can help you find the right fit.
What MSPs should look for in their cybersecurity solution
The growing number of solutions in the cybersecurity market (and expanding threat surfaces) has forced MSPs to adopt disparate tools. Once you think you have the latest “DR” in your collection, a new one comes along.
Continuously adding tools—while also trying not to raise prices and upset customers—squeezes MSP margins. Most new tools require new people with new skills to run them, which leads to added expenses.
The result? MSPs are left with multiple dashboards, many alerts, and mounting stress. Even after configuring and integrating all the tools, you’ll still leave gaps as most tools aren’t designed to work together.
Trying to differentiate between SIEM, EDR, XDR, and MDR is hard, and MSPs in search of a cybersecurity solution to offer their clients struggle to understand how the various acronyms compare. MSPs that want the best of threat detection and response technology in a package sized and priced for the SME market should consider a hybrid MDR solution.
Hybrid MDR offers advanced protection for endpoints, networks, and cloud workloads, so even MSPs with price-sensitive clients can protect them with a complete cybersecurity solution.
Field Effect makes adding hybrid MDR to your security service easy. When you partner with us, you get the industry’s most sophisticated threat detection and response technology, an entire team of the world’s best security analysts at your fingertips, and all the tools you need to successfully market, sell, and deliver cybersecurity.
Learn how partnering with Field Effect simplifies security, reduces costs, and increases profits by visiting our Partner Program page.
