Managed Detection and Response (MDR)

BARİKAT Managed Detection and Response (MDR) is a fully managed service that monitors security indicators and metrics of the organization's systems 24/7 to provide notification, prevention, and reporting services in compliance with the predetermined service level in the event of a security breach or before the breach occurs.

The aim of MDR is to detect and analyze security incidents that arise or show signs of occurring, trigger the incident response process asap if necessary.

MDR service forms the basis of a sustainable and reliable monitoring infrastructure. With this service, fast and effective intervention is provided for any security breaches that may occur or have occurred, enabling measures to be taken to prevent similar cases.

Scope of MDR

Barikat Managed Detection and Response (MDR) Service offers organizations comprehensive protection against cyber threats.

1. Analysis
Barikat MDR service primarily determines the organization's Current Situation Analysis and monitoring process, asset, and risk analysis. Then, with the Scope Determination process, the inventory, services, and products to be monitored for security are decided together with the organization.

2. Installation
It is ensured that products and technologies are installed and configured in accordance with the security design determined by the organization. The rules, correlations, and response* systems of the installed systems are tested and make sure that all configurations are ready before starting the monitoring service. *(For monitoring services provided with the response service, the response actions for technologies will be provided are also determined according to the needs of the institution.)

3. 24/7 Monitoring
After the analysis and installation of the 24/7 monitoring and notification service, continuous security monitoring of the determined organization network and inventory is provided. In this way, threats are intervened by providing instant detection during a possible cyber breach. Notification and reporting are made within the SLA periods specified in the scope of service.

4. Continuous Recovery
Necessary improvements and recovery are made in the monitoring infrastructures according to the event or signs of the event. Thus, the damage that can be caused by cyber threats is minimized and the recurrence of risks is prevented.

Within the scope of MDR service;

The scope and framework are determined for the current situation analysis and data collection,
A methodology is created for creating a supply chain inventory for the organization,
The organization's structure and supply chain system are examined,
Risks arising from the supplier service are analyzed.

Benefits of MDR Service

Faster Threat Detection: MDR services constantly monitor your network to capture the moment cyber-attacks occur. In this way, threats are detected and intervened faster.
Quick Response: MDR services respond quickly and effectively to cyber-attacks. Thus, the spread of attacks is prevented, and possible damages are minimized.
Business Continuity: MDR services respond quickly to minimize the effects of cyber-attacks. This helps maintain business continuity.
Better Productivity: MDR services relieve your cybersecurity team. In this way, your team can increase work efficiency by focusing on more strategic tasks.
Cost Savings: MDR services reduce the software, hardware and personnel costs required for cybersecurity. In this way, organizations can get better service at less cost to manage their cyber security risks.

Other Additional Services

Incident Response
Incident Response is a service provided in the event of a cyber-attack that directly or indirectly targets the services provided by organizations and other components (workstations, databases, etc.) that may affect the continuity of these services. With this service, it is necessary to determine the root cause of a cyber incident, to determine the actions to be taken to minimize the damage to the service activities, to determine the actions that will restore the normal functionality of the said workstations as soon as possible, to create the awareness and process needed to prevent similar incidents from recurring. is provided.

Red Team Services
The Red Team Service can be aimed at all or some of the issues listed below, using scenarios such as those that real attackers might implement:

Determining SOME/SGOM detection capabilities,
Determining whether the attacks are detected correctly,
Determining how long the attacks are detected,
Determining SOME/SGOM incident response capabilities,
Determining how long it takes to intervene in the incident,
Determining the time taken to take the incident under control,
Determining whether the incident response is done in a healthy way,
Identification of human/process/technology-related vulnerabilities in organizations,
Identification of vulnerabilities in the business processes of organizations,
System, security, infrastructure, OT, IoT etc. used in organizations. detecting weaknesses in technology and products,
Identification of vulnerabilities arising from the lack of information security awareness of the personnel working within the organization, the lack of compliance with security principles such as separation of duties, minimum authority,
Determining the information security awareness of users, personnel, stakeholders, suppliers and third parties,
Holistic determination of SOME/SGOM functions such as security product management, incident response, continuous security monitoring.

Security Operations (SECOPS)
Security Operations is a service that allows organizations to remotely manage security products within the determined scope, control the periodic maintenance, updates, configurations and backups of products, and tries to prevent operational errors. With this service, it is ensured that security products work efficiently, and performance-related problems are recognized in advance and precautions are taken. Thus, it is to ensure that operations can be carried out safely.

Cyber Threat Intelligence (CTI)
Cyber Threat Intelligence allows security teams to create strategic, operational, and tactical intelligence data and reports specific to the sector and geographical location of the organizations that are created. CTI data is shared bidirectionally with MDR teams, enabling faster detection and prevention of organizational threats.
By Cyber Threat Intelligence Service;

Identifying the organization's cyber threats and ensuring that intelligence data is presented at the Strategic, Operational and Tactical level,
Simplifying and presenting information about current cyber threats to organizations,
Information about current vulnerabilities and attacks is simplified and presented to organizations.

Threat Hunting
Threat Hunting provides analysis of the networks, systems, and servers of the organizations, and ensures that advanced malicious activities, the existence, or effects of which continue, are detected and forwarded to the Incident Response team, if any. In the first step of the Threat Hunting Service, the systems of the organizations are analyzed and according to the results of this analysis, it is aimed to identify the vulnerabilities and possible threats in the systems. The service ensures that threats are detected by investigating possible threats and indicators and signs of threats.

Who Can Receive MDR Service?

An organization that relies on external sources for production of goods or services
All public institutions that are obligated to comply with regulations.
Any organization that wishes to increase their cybersecurity maturity level and does not have a security team.