{"id":44384,"date":"2023-03-29T11:36:41","date_gmt":"2023-03-29T10:36:41","guid":{"rendered":"https:\/\/www.n-able.com\/?p=44384"},"modified":"2023-03-29T11:36:41","modified_gmt":"2023-03-29T10:36:41","slug":"why-is-edr-important-a-business-case-for-msps","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/fr\/blog\/why-is-edr-important-a-business-case-for-msps","title":{"rendered":"Why is EDR Important? A Business Case for MSPs"},"content":{"rendered":"

The security industry may not have been making a lot of noise about Endpoint Detection and Response (EDR) for long, but it\u2019s not actually a new technology. Despite having been around now for roughly 10 years, it\u2019s only recently that EDR has really come to the fore. This has been driven by the fact that traditional antivirus struggles to cope<\/span><\/a> with the increasing sophistication of modern malware, and is certainly unfit to handle new types of cyber threats. <\/span><\/p>\n

Why Do MSPs Need EDR?<\/span><\/h2>\n

Today, for many organizations, EDR is increasingly being seen as a critical line of defense in a company\u2019s security posture, and in some areas even mandatory. This is due to a few key factors in the marketplace, including:<\/span><\/p>\n

1. Compliance adherence and regulatory requirements<\/span><\/h3>\n

MSPs and their customers are facing an increasingly tight regulatory landscape, and many of those regulations are requiring (either directly or by implication) the use of EDR. Although GDPR<\/span><\/a> doesn\u2019t go as far as to mandate the use of EDR, the ability to have such visibility is crucial to ensure protection of PII and setting systems and procedures in place to minimize the risk of a breach.<\/span><\/p>\n

Equally the recent NIS2 Directive<\/span><\/a> doesn\u2019t mandate it. However, with its amended incident reporting requirements\u2014including initial notification within 24 hours of becoming aware of certain incidents or cyber threats\u2014companies that don\u2019t deploy EDR will struggle to get visibility over active threats in their environments. On top of this, companies without EDR may also find collecting the necessary details to properly report the incident is more complex and delay the process, putting them at risk of complying with the directive requirements. In the US, however, CISA\u2019s Executive Order on Improving the Nation\u2019s Cybersecurity<\/span><\/a> does actually stipulate a mandatory requirement for EDR solutions to be implemented.<\/span><\/p>\n

2. Cyber Insurance<\/span><\/h3>\n

Cyber insurance is a growing focus<\/a><\/span> of attention for businesses, and for MSPs this extends to helping their customers not only manage the application process, but also to rolling out the systems and infrastructure to ensure they can comply with any specific insurance requirements. Increasingly, insurers are looking for EDR deployment as it offers them a guarantee around risk reduction control for the insured business.<\/span><\/p>\n

3. Supply chain security requirements<\/span><\/h3>\n

Over the past few years, we\u2019ve seen a growing number of supply chain attacks, so this is yet another key area of focus for businesses. If your organization\u00a0supplies services to another organization, or your organization uses the services of other businesses, to continue to operate securely, then you need to have full visibility over your infrastructure and be able to spot and mitigate issues quickly. This helps ensure they don\u2019t populate across other companies\u2019 networks and products. Traditional AV won\u2019t give you this<\/span><\/a>, so EDR is one of the natural core requirements in a good defense-in-depth strategy.<\/span><\/p>\n

It\u2019s more than just check-boxing<\/span><\/h2>\n

When it comes to thinking about the role and importance of EDR, I like to use the analogy of a castle; although it has high walls, it has loads of entry points, including those coming from within (insider threats). Yet it would be unusable from a functional point of view, to have a castle with no doors, windows, or bridges, and where no one would be allowed to enter or leave. Unfortunately, for many organizations this is what happens if they don\u2019t get the balance right between security, functionality, and business requirements.<\/span><\/p>\n

Of course, it is also not possible to have every window, door, and person within the boundaries of a castle monitored by a soldier 24\/7\/365. And the same is true for businesses. This is why the security industry collectively, has evolved from the notion of assume breach and detect all attacks (when it\u2019s not possible to prevent them), to being able to predict attacks as they are either in process or where and when they might occur. This means working towards mitigation, or reduction of surface attack, and ultimately being able to resist attacks and effectively, and efficiently, recover from them (the principle of Cyber Resilience). This is essentially what EDR is about.<\/span><\/p>\n

However, monitoring and predicting threats 247\/7\/365 is a complex process, and one that can be hugely costly to build an infrastructure to support\u2014not just in terms of technology but also in terms of hiring the security analysts required to run it.<\/span><\/p>\n

This is where Managed Detection and Response (MDR) can really support businesses.<\/span><\/p>\n

How does MDR take security to the next level?<\/span><\/h2>\n

There are two simple scenarios where MDR really helps organizations take their security to the next level.<\/span>\u00a0<\/span><\/p>\n

1. Providing a fully fledged Security Operations Center (SOC) on tap<\/span><\/h3>\n

The reality is that the vast majority of organizations won\u2019t have the resources (financial and human) to fully staff a mature SOC, that will be able to maintain and operate their full security stack (including EDR) 24\/7\/365.<\/span><\/p>\n

Thanks to the cloud and economies of scale, MDR, like many other \u201cmanaged\u201d services, allows MSPs to outsource their security operations<\/span><\/a> to a third-party security specialist. This way, MDR becomes a highly cost-effective service that can be crucial for organizations looking to secure their businesses and be compliant with whatever their business requires.<\/span><\/p>\n

2. Scaling your team\u2019s ability<\/span><\/h3>\n

Even if an organization has a fully staffed and mature SOC, their focus will ultimately be narrower, as there will always be a need to align, on a daily-basis, to the business needs (new or existing ones).<\/span><\/p>\n

By using an MDR service those teams can \u201cscale\u201d further, without putting pressure on budget, training, retention, etc. This allows them to focus on what matters most for them, whether that\u2019s business process improvements, infrastructure improvements, maintenance processes efficiency, or playbooks.<\/span><\/p>\n

A good example here is how the MDR provider can focus on triage and initial investigation, before handing over a curated set of recommendations\u00a0to the customer. <\/span><\/p>\n

How does MDR help MSPs tackle emerging threats?<\/span><\/h2>\n

\u00a0<\/span>Overall MDR provides benefits that even smaller SOCs would struggle to achieve, including:<\/span><\/p>\n