In focus: MDR for finance

Financial institutions beware: Ransomware-as-a-service is the next-level evolution of ransomware. RaaS utilizes the skills of more than one attacker – and these threat actors are getting paid to wreck your organization’s infrastructure. 

Using the RaaS business model, skilled operators provide affiliates pay-to-play access to readymade ransomware kits on the dark web. That means that affiliates lacking the technical chops can more easily acquire a kit and then redeploy that malware on whichever victims they please (for a fee, of course).

Managed detection and response (MDR) is the counterweight to RaaS: Paid experts who analyze your digital environment for the purpose of protection. 

In a MDR partnership, a cybersecurity vendor serves as an extension of the customer’s security operations center (SOC), dedicating professional threat hunters and advanced technologies toward investigating threats and vulnerabilities lurking in a customer’s attack surface. 

These benefits could substantially help security teams working in financial services who feel under-resourced and overwhelmed by the ransomware scourge.

Ransomware attacks on the financial sector

Ransomware actors have stepped up their game, using RaaS kits to get past the banking sector’s digital vaults. 

According to a 2022 survey fielded by cybersecurity vendor Sophos:

Other types of breaches and cyberattacks hitting the industry, which paint a similarly grim picture: 

These conditions make it exceedingly difficult for financial organizations to operate productively and securely. In an effort to reverse these trends, some companies have begun subscribing to the MDR model. Here are some reasons why.

MDR for financial services

Here’s why financial organizations are using MDR to combat ransomware and RaaS.

1: Access to diverse security expertise

The cybersecurity skills shortage continues to leave budget-strapped organizations vulnerable to data breaches. Even companies that do have in-house experts can find themselves overwhelmed by a constant barrage of alerts, contributing to security fatigue and burnout over time. But with MDR, organizations can add expertise without adding to the headcount, tapping into a community of skilled cyber veterans who know how to parse through false positives and separate real threats from the noise.  

2: Active threat intelligence

MDR vendors relay threat intelligence on an ongoing basis to the customer, providing weekly and monthly reports of network activity and periodically sharing insights into security investigations or alerts meriting customer attention. The MDR vendor can provide customers access to a dashboard where they can view real-time alerts, scheduled reporting, and other intelligence that threat hunters have collected in their investigations. The vendor can also conduct routine account health scans to inform customers of basic settings and configurations of endpoints in the network.

3: XDR and telemetry capabilities

MDR vendors combine extended detection and response tools, or XDR, with robust telemetries to gain continuous visibility and automated analysis of an organization’s entire information environment – including endpoints, cloud assets, network data, user identities and so on. Context is crucial to identifying suspicious behavior, and MDR vendors harness the full range of contextual data by leveraging third-party telemetry to investigate threats that escaped detection of basic tool sets. An added advantage is that if MDR detects a vulnerability in one customer’s environment, they can then fix that vulnerability within every other customer’s environment where it is present.

4: MDR providers have the expertise to integrate and understand third-party tools

Ransomware attacks and tools are evolving, and financial services have responded by acquiring a larger portfolio of third-party security tools. However, sometimes these tools resist being easily integrated with one another, which can reduce efficiency of how organizations respond to ransomware. MDR providers can assist organizations with integrating third party tools, even if those tools don’t belong to the MDR vendor. 

5: 24/7 monitoring and speed to response

MDR vendors tend to carry a much larger geographic footprint, employing multiple SOC teams around the world and at all hours of the day. Many attacks happen at night or over the weekend when criminals suspect the majority of the workforce is at home. Even if suspicious activity is flagged and an alert is generated, it could easily be lost in a multitude of other lookalike noise. But MDR personnel in charge of monitoring a customer’s network around the clock will have the resources to immediately thwart an attack before data or services are compromised.