Managed Detection
and Response (MDR)
Discover, prevent and recover from cyber threats faster. Let the TPx Managed Services team help your business apply the tools and resources required for a better cyber security program.
Discover, prevent, and recover from cyber threats faster.
Managed Detection and Response (MDR) is a service that combines technology with human analysis in order to detect and respond to cybersecurity threats faster saving businesses time and money with remediation.
Why TPx Managed Detection and Response?
Identify More Threats
Antivirus solutions miss an average of 60% of attacks. TPx Managed Detection and Response services significantly increases the number and type of attacks that are detected and stopped.
Reduce Attack Dwell Time
The average time to identify and contain a breach (its dwell time or “lifecycle”) is 280 days, according to a 2020 Cost of a Data Breach study. The lifecycle of a breach factors heavily into the overall cost. Managed Detection and Response reduces this time exponentially which limits the impact of any attacks.
Decreased Downtime
A Ponemon Institute report says downtime can cost an SMB $8,000 to $74,000 per hour.
Proactively Mitigate Attacks
Use a proactive approach to more quickly mitigate attacks so they can’t spread across your network and cause additional damage.
Leading Technology
Best-in-class detection and response technology delivers powerful visibility, detection, alerting, and mitigation of cyberattacks.
Advanced Threat Hunting
Dedicated Security Operations Center staff works 24/7 to quickly identify advanced threats that evade existing security solutions and provides expert analysis on attack details and mitigation activity.
Fully Managed
Having the right software is not enough. You also need the right team to deliver a turnkey solution that leaves you free to run your business.
24/7/365 Monitoring
Cybercriminals aren't Monday through Friday, nine-to-fivers. Our security experts are at your disposal 24/7/365, monitoring your environment for risk and threats, so you can focus on your business.
At TPx, we specialize in providing IT management and security services that provide customers with multiple opportunities to prevent and recover from cyberattacks like ransomware.
Firewall Managed Detection and Response
- Stopping the attack
- Identify what assets may have been affected
- Collect all relevant evidence for civil, criminal, or regulatory proceedings
- Remove the source of the breach
- Recommend or implement operational improvements to prevent similar breaches in the future
Upon remediation or isolation of threat and ticket closure, customer will be provided an incident response report based on NIST guidelines:
- Status of the incident
- A summary of the incident
- Indicators related to the incident
- Actions taken by all incident handlers
- Chain of custody, if applicable
- Impact assessments related to the incident
- Contact information for involved parties
- A list of evidence gathered during the incident investigation
- Comments from incident handlers
- Next steps to be taken, if applicable
- Alerts from system logs
- Executed malware from logs that are classified into threat or malware categories
- Host and source-based threats specifically around detected virus, spyware, and trojan activity
- Botnet traffic
- Various allowed IPS triggers
- General hardware errors
Endpoint Managed Detection and Response
TPx leverages best-in-class Endpoint Detection and Response Technology (EDR) that detects malware on-disk and suspicious behavior in the OS, and it is the only solution that detects advanced threats in physical memory. Using patented Digital DNA (DDNA) technology and advanced machine learning, the EDR platform TPx uses detects, prioritizes, and mitigates threats faster and more efficiently than competitive solutions. Combining this best-in-breed software with our experienced security analysts, TPx is able to deliver a truly superior Managed Detection and Response service to our customers. Our seasoned experts monitor customers’ environments 24x7x365 and perform advanced threat hunting and incident response.
If a threat is found, the system can instantly take automated action to mitigate it. Examples include quarantining compromised systems, killing processes, and deleting malicious files. These automated mitigation actions can eliminate many threats on their own, reducing costs, minimizing damage, and allowing security personnel to focus on high priority threats and those that require additional threat hunting and advanced mitigation activity.
Many advanced threats cannot be eliminated using software alone. They require additional threat hunting and mitigation from expert security resources. TPx’s MDR solution includes a team of specialized security analysts that are available 24x7x365 to perform these advance threat hunting and mitigation services. This service includes an industry leading 15 minute detection-to-mitigation response time. Individual incident reports are emailed after each event so customers can understand what happened, what system(s) were compromised, what action was taken, and what additional recovery steps are recommended.
Each month, customers receive a comprehensive report and a weekly low level events report.
Cutting through the ‘noise’ (eliminating false positives and false negatives) is an important part of any MDR solution. At TPx, our team of experts customizes it to the unique requirements of each customer. By doing so we can maximize efficacy and efficiency, and eliminate the noise that many other MDR solutions produce. This allows our security experts to focus their advanced threat hunting and mitigation efforts on the events that really matter to deliver faster, more efficient, and reliable results.
Threats identified by the EDR software can range in severity. As such, it is very important to ensure that security personnel can easily identify the most damaging threats and focus their attention on eliminating them. Doing so further enhances the cost-efficiency, reliability, and speed of our service.
Superior Protection vs. Next Generation Antivirus (NGAV) Alone
Next Generation Antivirus (NGAV) protection, while a necessary and very important piece of the puzzle, is not enough to deliver proper protection anymore. Today’s security landscape sees cyber-attacks growing exponentially and increasing in complexity. Next Gen AV will never be able to keep up and provide 100% efficacy. Our predictive Endpoint Detection and Response (EDR) software helps deliver on what NGAV cannot, by providing a more comprehensive approach to threat detection. For example, a new zero-day attack may be able to successfully evade NGAV detection, but EDR can prevent it by identifying and correlating different processes and behaviors happening on systems or the network that are indicators of compromise. Some of these include:
Often legitimate processes can be hijacked by cybercriminals. For example, running a Powershell Script on a device may normally be a perfectly legitimate event, one that raises no alarms in your antivirus program. Our EDR software can detect a compromised Powershell script that has malicious intent when executed, and block it.
By exploiting a vulnerability inside of an operating system, software application, or hardware implementation (a bug, design flaw, misconfiguration, outdated software version, etc.), a malicious actor can gain elevated access to the network or device resources. Gaining such elevated access is not something that is identified as a problem by most endpoint security software, but it can enable the attacker to take specific action to further compromise an environment. Our EDR software and threat detection services can identify these issues to further enhance protection of your environment.
System control is the use of tactics, techniques, and protocols by a malicious actor to gain access to the entire information system (server, workstation, network device, etc.). This type of complete system control is often the most dangerous type of attack and can allow attackers to steal data, spread malware, disrupt web services and more.
Malicious actors often gain access and move between devices and applications inside of a network to attain higher levels of privileges, credentials, or access. NGAV solutions do not detect this behavior as malicious, whereas our EDR software will recognize such behavior, block it, and alert our security analysts who can perform additional advanced threat hunting and mitigation.
Persistence refers to the use of tactics, techniques, and protocols to decrease the likelihood of removal of a malicious actor from an infected or compromised network over an extended period. These techniques are used to conduct “Advanced Persistent Threats (APT)” which gives an attacker time to gather more information, identify and exploit other vulnerabilities, and steal data over a prolonged period. Quickly identifying APTs reduces dwell time and is an important benefit of our service.
