MDR is not a technology, but a service

Thank you very much Olaf. My name is Marc Höffler, I am the founder of IT Booster. We are a small IT and service company from Speyer in the Rhineland-Palatinate, Zurich and Mannheim region. We specialize in accompanying customers on their digital journey with cloud and security services and making them more secure.

Gladly. In simple terms, EDR (Endpoint Detection and Response) increases the visibility of potential threats in the network, with a strong focus on endpoint protection. MDR (Managed Detection and Response) combines different data sources and provides more visibility, for example from network or IT traffic data. MDR is not a technology, but a service. The MDR partner therefore has more visibility of everything that happens in the customer network and can better detect and respond to security incidents.

Yes, in principle the X is arbitrary. It depends on which partner you work with and which technology you use. Usually it's APIs. You can integrate email security providers, network data, firewalls and even cloud data such as Microsoft 365 logins. In the best case scenario, third-party cloud providers such as HubSpot or Salesforce can also be integrated.

Yes, I think so. There are APIs that enable quick integration. You can also use these interfaces to see whether a backup solution has been compromised, provided it is technically connected.

There are two parts to this. A customer who is still at an antivirus level needs to be picked up early and educated about what EDR and MDR mean. We no longer talk to customers about EDR, but in most cases about MDR. MDR offers the functions of an EDR, but combined with a managed service that enables more comprehensive support and immediate response.

That depends on the customer. We can offer the entire spectrum, from support and operation to specialized security consulting. We have customers for whom we are the security service provider and others for whom we also look after the infrastructure. In both cases, we are always the security partner.

A lot of work. We clarify with the customer whether we can take action in an emergency without consultation and which systems we can access. There are legal aspects to consider and legal contracts that need to be concluded in advance. We also simulate various scenarios internally in order to be prepared.

The dialog is extremely important. There is a price range for our service, but unplanned events must be invoiced separately. We discuss with the customer when additional costs will be incurred and what measures are required. In an emergency, a response team can be called in, the costs of which can quickly run into the five-figure range depending on the duration and the endpoints affected.

It depends on the customer. Protecting identities is a key issue. A sensible email gateway already takes a lot of work off your hands. You have to decide for the customer which attack vectors are most relevant and budget for the appropriate measures.

Standardization is the key. We are building a standardized portfolio and setting basic criteria such as API integration. All products must be able to feed into our data lake. We also have an in-house development for report generation. In the office, we use three dashboards for operations and security.

That is the critical point. We have classic alert chains and use stable technologies such as SMS to receive important alerts outside the office.

Our focus is on active vulnerability management and penetration testing. We want to continuously harden our customers' infrastructure and improve it on a best-practice basis. In the worst-case scenario, we rely on our MDR service or the Rapid Response Team.

Be courageous and take on the role of advisor. Seek dialog with your customers and clearly highlight the value-added services. Start with smaller projects and continuously expand your knowledge. It is important that you feel comfortable in your field and gain the trust of your customers.

Thank you, Olaf. It was a pleasure.