Laserfiche WebLink
01/12/2021 12.E.1. <br />isManaged Detection & Response <br />• As previously noted, it is possible to automate the EDR system response to many, <br />but not all, of the alerts generated by end points <br />• To ensure that all alerts are responded to appropriately the EDR system must be <br />actively monitored <br />• IRC IT staff considered three options for monitoring the EDR system. <br />1. Monitor the EDR system with IRC IT Staff <br />2. Managed Detection and Response (MDR) through a professional services supplier <br />3. MDR & prepaid cyber Incident Response (IR) through a professional services supplier <br />• The options above are presented in order of risk reduction with option #1 <br />carrying the most risk and option #3 the least <br />• They are ordered in a good, better, best format <br />1/12/2021 12.E.1. <br />W�+c <br />K MDR Options <br />• Option #1- using the IRC IT staff to monitor the EDR system is the option that <br />carries the most residual risk as the IRC IT staff is not staffed to provide 24 x 7 <br />monitoring support and does not specialize in cyber incident detection and <br />response <br />• Option #2 - using an MDR service through a supplier reduces this risk by providing <br />24 x 7 monitoring and response provided by cyber security professionals that <br />perform this function daily and as such are intimately familiar with current and <br />evolving cyber -attack techniques <br />• Option #3 - using an MDR supplier to perform monitoring & detection and <br />prepaying for cyber incident response (IR) support has the added benefit of <br />having a cyber incident response team available to support immediately upon <br />detection of a cyber breach rather than having to contract that support after <br />detection. <br />• Cyber incident mitigation is a time critical activity and having IR support already in place <br />provides the most risk reduction to the County. <br />1/12/2021 12.E.1. <br />�� ' 4 <br />