The Untold History of Managed Detection and Response

Eldon Sprickerhoff

This blog is an excerpt from a series on MDR, written by eSentire's founder. Leacam have partnered with eSentire to provide a unique Security First Support Service.

Managed Detection and Response (MDR) didn’t get a traditional naming ceremony; instead, the term was etched forever into the cybersecurity landscape (and security budgets) when Gartner published its first annual Market Guide to Managed Detection and Response in May 2016. And just last month, Gartner released the fifth edition of this guide.

However, at eSentire, managed detection and response functionally existed well before 2016 … we just called it something different. As eSentire’s founder, I’m proud that our company is known today as the creator and world leader of MDR. And, as MDR celebrates its fifth official industry “birthday,” this series takes a look at the past, present and future of the category as it becomes the service of choice within the cybersecurity industry.

Security-as-a-service

In the late 1990s and at the turn of the millennium, the beginnings of eSentire took shape. I was working in New York managing security for clients in the financial services sector. Typically, this entailed installing, configuring and managing firewalls, performing vulnerability assessments and penetration testing and similar activities.

After the terrorist attacks of 9/11, I came home to Ontario—just as the global recession was getting into full-swing. Information security (infosec) was all I knew, so I set up shop in November 2001, joined by a business partner and my wife, Carole. We called the company eSentire, from the Latin root for “Sentry,” and used the “lowercase e” because that was practically required by law in those days if you worked in technology.

We quickly realized we could achieve our goals—helping customers harden their security posture to prevent breaches—more effectively if we could see their actual network traffic, so we began delivering to our customers a hand-built, customized piece of equipment to give us those insights.

Sometimes, during the course of assessing and configuring a customer’s defenses, we would have the fortunate timing of actually seeing threat actors attempt an attack. And so we would immediately alert.

It didn’t take long before customers started asking us to leave the little network device installed, as part of their defense layers. Who were we to argue with them?! We started charging a service fee and all of a sudden we were providing security analysis as an ongoing managed service, in addition to our up-front consulting.

We needed a name for what we were doing and the two that we used most often were “Collaborative Threat Management” and “Embedded Incident Response.” (Today, I’m quick to concede that neither is as catchy or as accurate and precise as MDR.)

Filling a visibility gap

I often get asked what made us different or what gap were we trying to fill all those years ago? Was it that we were providing security-as-a-service at a time when most companies were sourcing, installing and managing solutions on their own? While the service aspect contributed to our success, in my view the major point of value was that we were filling a visibility gap—and we filled that gap in a couple of ways.

First, 20 years ago people were aggregating and looking at logs, it was like managed SIEM. But for what we were trying to do—provide real-time defense against very motivated attackers—logs were so high up, and the information they provided was so coarse, that they were at best supplemental.

What we needed more was that visibility into and analysis of network traffic. So we built up modules to do just that. Then, as instrumentation and telemetry from endpoint devices improved, we gained even more insights.

By consuming and analyzing information from multiple sources—network and endpoints, supplemented by logs—we gained a much more precise, accurate and actionable picture of the threats against our clients, which meant we could provide them with much better visibility into these threats than they had ever before experienced.

But we went further.

I’ll illustrate with an example.

I remember we had a client, who had a standalone IDS (intrusion detection system) in place. And one Christmas there was an exploit where your machines could get infected just by opening a JPEG. Needless to say, this exploit proved popular with attackers; security companies scrambled to respond and pretty soon there were something like 50 signatures. Unfortunately, these signatures also caused lots of false positives—not quite every single time someone opened a JPEG, but not too far off.

The IT person managing this IDS at our client told me, “I get all of these alerts and I don’t know what to do with them. I don’t mind getting a real alert, but the false positives are killing me.”

And because the IDS didn’t capture any traffic beyond the single packet that matched the signature, he was unable to dig in. Our little network device provided an answer by letting him look deeper into the full packet flow of the conversation to distinguish between the accurate alerts that needed an immediate response and those that were just someone opening up a Christmas card.

From alerts to action

Another thing we realized was that it didn’t do much good just to overwhelm someone with alerts. If they don’t have the resources or expertise to analyze the alerts and (when needed) to take action, then what’s the point?

So we evolved our model beyond what other security service providers were doing. Where managed security service providers (MSSPs) would wait for the customer to say, “I’d like you to look into ‘Alert X,’” we actually proactively performed investigations using high-fidelity data we had collected ... and we took action on behalf of our clients to defend them against attacks as those attacks unfolded.

Then we would send them a report that said, “Here’s what we did and here’s why we did it,” which we supported with the telemetry we had gathered and the analysis we had performed.

Needless to say, this new model proved popular and it separated us from the managed security service providers (MSSPs).

We knew that what we were doing was different, but we were really just a handful of infosec nerds working to protect our clients—we didn’t realize at the time that we were leading a cybersecurity revolution.