In this blog

  1. Introduction
  2. What’s a SIEM solution?
  3. What is a SOC?
  4. What’s MDR?
  5. Why does your business need one?
  6. Key takeaways
Photo of Oliver Pinson-Roxburgh

Oliver Pinson-Roxburgh

CEO and Co-Founder

28th March 2023

Introduction

Businesses are constantly under attack, with hackers continually identifying new vulnerabilities to exploit. Most of the time, businesses are unaware that they are being attacked until it’s too late. Research has shown that the internet is constantly being scanned for systems that have been misconfigured or have known vulnerabilities to exploit. Therefore, it’s crucial for businesses to be aware of cybercriminal activity, reducing exposure time, and preventing attacks before they cause irreparable damage. However, this is easier said than done, and can often be expensive and time consuming. Two thirds of organizations will increase their cybersecurity spend over 2023, so it's important to first understand what solutions will provide the most value before investing the time and budget.

One solution to help businesses improve visibility over their digital landscape and provide a proactive approach to stopping cyber threats is to invest in a managed SIEM (Security Information and Event Management), managed SOC (Security Operations Centre), or MDR (Managed Detection and Response) solution. In this blog, we explore what they are, what makes them different, and how they can bring value to your business.

What’s a SIEM solution?

SIEM is a tool that helps businesses keep track of what is happening in their IT environments. This is done by collecting logs and other data from servers, endpoints, cloud systems and other devices to provide real-time alerts for suspicious activity in an environment. These alerts can then be used to take remedial actions before threats turn into breaches.

A SIEM solution does a lot of the hard work to highlight security issues, however SIEM is just the technology – it needs security analysts (usually as part of a SOC team) to configure, investigate and review the alerts in order to properly highlight threats.

There are three core things a SIEM tool does:

  1. SIEM is key to maintaining compliance and highlighting bad security practices. For example, using of end-of-life software, using single-factor authentication methods for account access, and poor password management. Information security standards such as PCI DSS require businesses to keep a log of the activity in their environment and to regularly review the data to detect early signs of an attack. In addition, log data should be stored for incident response purposes for a minimum of 1 year. The intent of this part of the standard is so that if businesses were breached (and consequently need to follow an incident response process), a record of log data exists that enables a proper investigation to take place.
  2. A SIEM tool highlights Indicators of Attack (IOAs). IOAs show a hacker's intentions and the techniques used to accomplish their goal. An example of an IOA would be a user account attempting multiple logins within a short space of time and from various geographic locations. This could be an indicator that a user’s credentials have been stolen and a threat actor is trying to access their account. You should identify IOAs so that you address the problems before a breach. Many businesses do not proactively look for IOAs, so are unaware that they have been breached.
  3. A SIEM solution also highlights Indicators of Compromise (IOCs). These are more severe than IOAs as it is digital evidence that indicates a cyberattack has been successful. Information gathered from an attack is then used to develop or improve tools that will detect similar attacks in the future. One of the most common IOCs are unusual outbound network traffic. High volumes or anomalies in outbound network traffic patterns are key indicators to security experts that suspicious activity is taking place within the network.
Defense.com SOC

What is a SOC?

A Security Operations Centre (SOC) combines people, processes and technology. In a SOC team you will find a group of analysts monitoring the output of tools like endpoint protection software, firewalls, switches and other products and services, all integrated by a SIEM solution. The role of the SOC is to proactively detect and highlight cyberattacks to businesses to ensure they mitigate the risk before they experience a breach again. The SOC team will notify customers or colleagues of the threat, help triage the incident and provide remediation advice.

A managed SOC service typically involves outsourcing your SOC team to a third party, who will operate and maintain your existing SIEM deployment. This is becoming much less common in the market, as this type of solution requires the vendor to already have a working knowledge of your particular SIEM solution and how it has been deployed. The challenge is that these vendors will often only be able to integrate with and add value to particular SIEM technologies, which may not match with your existing deployment.

As SIEM tools rely on security experts monitoring the alerts it generates, businesses often prefer to choose a managed SIEM service instead. This is where a vendor will deploy their own SIEM technology and combine it with their own SOC team to detect cyber threats 24/7 on your behalf. As many businesses don’t have the experience or budget to build and manage a SOC in-house, outsourcing is the more affordable and valuable option, delivering greater ROI and security coverage.

It's important to note that a managed SIEM solution detects threats, raises alerts and provides remediation advice. This type of service doesn’t typically respond to threats or remediate issues on your behalf. There’s another acronym for that, and it’s called MDR!

What’s MDR?

MDR stands for Managed Detection and Response and combines technology and human expertise to detect and respond to advanced threats through mitigation and containment. The purpose of an MDR service is to detect cyber threats and respond to them before they become breaches. If a breach does occur, an MDR service will help contain the threat whilst allowing more time for security analysts to investigate and minimise the business impact.

At its core, MDR services deliver holistic end-to-end management of cyber threats. This is a new approach as it adds the ‘response’ element that traditional SIEM tools lack. MDR combines the best of SIEM and SOC to protect your business in real-time and reduce the time it takes to detect and respond to threats. It’s estimated that by 2025, half of organizations will be using MDR services because of this.

MDR uses a SIEM as one of its core technologies, but it takes this to the next level, as it’s not just about correlating log events but about enriching that data and combining results from many different sources, and providing much needed mitigation and containment out of the box.

The key differentiator between an MDR solution and a managed SIEM service is that MDR also helps to respond to security events, in addition to detecting and investigating them. For example, if a SOC analyst has enough data to suggest that an endpoint has been compromised, with an MDR solution they can take action and isolate the device from the rest of the network to contain the threat. In a managed SIEM service, this action would typically need to be taken by your own team.

Why does your business need one?

We’ve talked before about how outsourcing a SOC is almost always the right option compared to building one in-house. But should you get your own SIEM or choose a managed service? Picking the right solution for you is important as every business differs in its requirements and resources.

SIEM is good for businesses that:

  • Have an experienced team that know how to setup, tune and operate the SIEM
  • Have enough resources and knowledge to interpret logs and action intelligence independently
  • Already have technology that can quickly mitigate cyber threats or block attacks
  • Have the time to conduct daily reviews
  • Have a well-defined incident response process and know how to triage incidents
  • Have a team that can conduct threat monitoring and incident response 24/7, or have an on-call process with well configured automated alerting
  • Understand how their business could be targeted by cybercriminals and how a SIEM solution would help to speed up the incident response process by detecting suspicious activity

Outsourced services like managed SIEM are good for businesses that:

  • Don’t have a well-functioning SIEM or the time to maintain a SIEM
  • Don’t have existing solutions that can mitigate threats, or a strong security strategy
  • Don’t have the time, resource or expertise to threat hunt and look to identify whether you have already been breached or are under an attack
  • Don’t have the time to regularly review logs to meet security best practice and compliance mandates
  • Don’t have a team to cover 24/7 threat monitoring requirements
  • Require extra support to triage incidents
  • Lack expertise to contain a breach
  • Do not have the budget to build or maintain a SIEM or SOC in-house

MDR takes this one step further and help businesses proactively respond to threats and assist with incident response where required.

Key takeaways

Implementing an MDR, SOC or SIEM solution gives your business a much better chance at keeping your networks secure and preventing breaches.

To summarise, here’s why businesses may need an MDR, managed SIEM or SOC solution:

  • To help organizations that don’t have in-house threat detection and response capabilities
  • Businesses that don’t have access to security experts, therefore putting the business, its data and its employees at risk of cyberattacks and data breaches
  • Many organizations will not have the budgets to build or maintain a SIEM, SOC or MDR service in-house and therefore require managed service providers to deliver trusted and experienced cyber security solutions
Photo of Oliver Pinson-Roxburgh

Oliver Pinson-Roxburgh

CEO and Co-Founder

Share this article

Start securing your business today with our managed SIEM service.

Related resources