By Oliver Spence, CEO, CybaVerse
According to a recent report from insurance firm Hiscox, 38 percent of UK organisations have a suffered cyber attack in the last year.
The figure is not hugely surprising. Cyber crime is widely recognised as the number one threat to business today. However, what is concerning is that the rate of attacks is surging even despite organisations increasing their spending on defences.
According to the same study, firms are spending significant money to ward off the threat of hacks, with the average UK firm spending £44,294 on resilience measures.
This raises an important question, why when organisations are boosting their investments in cyber defences are business crippling attacks continuing to surge?
The UK’s outsourced security market
UK organisations spend heavily on outsourced cyber security.
Government analysis recently revealed that the cyber services market, which includes MSSPs, is now worth approximately £8.4 billion annually.
The figure highlights that many organisations in the UK are outsourcing their security, ensuring it is managed by experts.
This is also not surprising.
Cyber security is a full-time, 24/7 position and most organisations don’t have the resources to manage it internally.
However, even despite this migration to managed services, it doesn’t explain why operationally impacting attacks continue to increase?
Could it highlight that traditional managed security models are often too focused on identifying threats, rather than helping organisations actually remove the weaknesses that allow threats to succeed?
Managed Detection and Response
One of the most common activities for organisations to outsource is their security operations.
Organisations will rely on experts to monitor their digital assets for malicious activity, ensuring incidents are stopped and contained before they escalate into full scale attacks.
However, one of the key issues with Managed Detection and Response is that it only focuses on containment, not remediation.
Security analysts will continually triage alerts coming into the SOC, investigating them to identify malicious activity. If malicious activity occurs, they will then work to understand the incident, investigate it and contain it.
However, this model only contains the incident, it doesn’t remediate the cause behind it.
Take the exploitation of an unpatched vulnerability. A SOC may detect the malicious activity, isolate the affected device, remove malicious files and restore the environment to its previous state.
The incident has been contained, but has the problem actually been remediated? Not if the vulnerability remains unpatched.
The same applies if an attacker gained access because of a misconfiguration, weak Microsoft 365 control or another security gap. Restoring the environment to the state it was in before the attack simply restores the weakness too.
This is where we need to make a much clearer distinction between containment and remediation.
Containment stops the immediate threat. Remediation addresses the weakness that allowed it to happen in the first place.
Without the final step, organisations risk operating in permanent firefighting mode. The flames are extinguished, but nobody is addressing what keeps starting the fires.
Introducing MDR+R
When organisations are selecting an MDR provider, they first must understand the genuine improvements to security being offered.
Simply acting on incidents is not enough. The partner must also make tangible improvements to the overall security of the business.
One of the best ways to achieve this is by partnering with providers that don’t just respond to threats, but also take actions to remediate the root cause of incidents.
These providers don’t simply triage alerts and contain incidents, they work to understand how an attack happened and then provide support to organisations to remediate the issue at its very root.
The overall goal is to close the loop on incidents, not leave them open to be exploited again.
The three-year test
This brings us to a question every organisation outsourcing its security should ask.
If you have been working with a SOC provider for three years, are you more secure today than you were when the relationship started?
Your attack surface may have expanded. Threat activity may have increased. Attackers may have become more sophisticated. These factors obviously won’t be within your SOC provider’s control, but there should still be tangible evidence that security is improving.
Known weaknesses should be getting closed. Previously identified attack paths should be disappearing. Misconfigurations should be addressed. Vulnerabilities should be remediated. The number of exploitable gaps sitting within the environment should be reducing.
If, after three years, and significant investment, the same security gaps remain open, organisations have every right to ask what they are paying for.
Containment keeps an organisation running. Remediation makes it more secure.
Organisations must demand both.
