What We Do
How we do it
Resources
SECURITY ADVISORIES
May 11, 2022
CVE-2022-26923 - Active Directory Domain Services Elevation of Privilege Vulnerability
THE THREAT Microsoft has disclosed a new vulnerability impacting Active Directory Certificate Services (ADCS) tracked as CVE-2022-26923 (Active Directory Domain Services Elevation of Privilege Vulnerability). If exploited successfully, an authenticated attacker can escalate privileges in environments where ADCS is running on the domain. eSentire is aware of technical details and tooling [2] for…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1200+ organizations in 75+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
May 17, 2022
Cybersecurity Leader eSentire Continues Its Commitment to Rigorous Security Standards Earning PCI DSS Certification
Waterloo, ON, May 17, 2022 — eSentire, the Authority in Managed Detection and Response (MDR), maintains one of the most secure and robust IT environments of any MDR provider in the industry. To that end, eSentire today announced that it has received the Payment Card Industry Data Security Standard (PCI DSS) certification, considered one of the most stringent and comprehensive payment card…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Sep 24, 2020

The Untold History of Managed Detection and Response Part I: “Collaborative Threat Management” and “Embedded Incident Response”

Wikipedia tells us that “A naming ceremony is an event at which a person or persons is officially assigned a name. The methods of the practice differ over cultures and religions. The timing at which a name is assigned can vary from some days after birth to several months or many years.”

Speak With A Security Expert Now

Managed Detection and Response (MDR) didn’t get a traditional naming ceremony; instead, the term was etched forever into the cybersecurity landscape (and security budgets) when Gartner published its first annual Market Guide to Managed Detection and Response in May 2016. And just last month, Gartner released the fifth edition of this guide.

However, at eSentire, managed detection and response functionally existed well before 2016 … we just called it something different. As eSentire’s founder, I’m proud that our company is known today as the creator and world leader of MDR. And, as MDR celebrates its fifth official industry “birthday,” this series takes a look at the past, present and future of the category as it becomes the service of choice within the cybersecurity industry.

Security-as-a-service

In the late 1990s and at the turn of the millennium, the beginnings of eSentire took shape. I was working in New York managing security for clients in the financial services sector. Typically, this entailed installing, configuring and managing firewalls, performing vulnerability assessments and penetration testing and similar activities.

After the terrorist attacks of 9/11, I came home to Ontario—just as the global recession was getting into full-swing. Information security (infosec) was all I knew, so I set up shop in November 2001, joined by a business partner and my wife, Carole. We called the company eSentire, from the Latin root for “Sentry,” and used the “lowercase e” because that was practically required by law in those days if you worked in technology.

We quickly realized we could achieve our goals—helping customers harden their security posture to prevent breaches—more effectively if we could see their actual network traffic, so we began delivering to our customers a hand-built, customized piece of equipment to give us those insights.

Sometimes, during the course of assessing and configuring a customer’s defenses, we would have the fortunate timing of actually seeing threat actors attempt an attack. And so we would immediately alert.

It didn’t take long before customers started asking us to leave the little network device installed, as part of their defense layers. Who were we to argue with them?! We started charging a service fee and all of a sudden we were providing security analysis as an ongoing managed service, in addition to our up-front consulting.

We needed a name for what we were doing and the two that we used most often were “Collaborative Threat Management” and “Embedded Incident Response.” (Today, I’m quick to concede that neither is as catchy or as accurate and precise as MDR.)

Filling a visibility gap

I often get asked what made us different or what gap were we trying to fill all those years ago? Was it that we were providing security-as-a-service at a time when most companies were sourcing, installing and managing solutions on their own? While the service aspect contributed to our success, in my view the major point of value was that we were filling a visibility gap—and we filled that gap in a couple of ways.

First, 20 years ago people were aggregating and looking at logs, it was like managed SIEM. But for what we were trying to do—provide real-time defense against very motivated attackers—logs were so high up, and the information they provided was so coarse, that they were at best supplemental.

What we needed more was that visibility into and analysis of network traffic. So we built up modules to do just that. Then, as instrumentation and telemetry from endpoint devices improved, we gained even more insights.

By consuming and analyzing information from multiple sources—network and endpoints, supplemented by logs—we gained a much more precise, accurate and actionable picture of the threats against our clients, which meant we could provide them with much better visibility into these threats than they had ever before experienced.

But we went further.

I’ll illustrate with an example.

I remember we had a client, who had a standalone IDS (intrusion detection system) in place. And one Christmas there was an exploit where your machines could get infected just by opening a JPEG. Needless to say, this exploit proved popular with attackers; security companies scrambled to respond and pretty soon there were something like 50 signatures. Unfortunately, these signatures also caused lots of false positives—not quite every single time someone opened a JPEG, but not too far off.

The IT person managing this IDS at our client told me, “I get all of these alerts and I don’t know what to do with them. I don’t mind getting a real alert, but the false positives are killing me.”

And because the IDS didn’t capture any traffic beyond the single packet that matched the signature, he was unable to dig in. Our little network device provided an answer by letting him look deeper into the full packet flow of the conversation to distinguish between the accurate alerts that needed an immediate response and those that were just someone opening up a Christmas card.

From alerts to action

Another thing we realized was that it didn’t do much good just to overwhelm someone with alerts. If they don’t have the resources or expertise to analyze the alerts and (when needed) to take action, then what’s the point?

So we evolved our model beyond what other security service providers were doing. Where managed security service providers (MSSPs) would wait for the customer to say, “I’d like you to look into ‘Alert X,’” we actually proactively performed investigations using high-fidelity data we had collected ... and we took action on behalf of our clients to defend them against attacks as those attacks unfolded.

Then we would send them a report that said, “Here’s what we did and here’s why we did it,” which we supported with the telemetry we had gathered and the analysis we had performed.

Needless to say, this new model proved popular and it separated us from the managed security service providers (MSSPs).

We knew that what we were doing was different, but we were really just a handful of infosec nerds working to protect our clients—we didn’t realize at the time that we were leading a cybersecurity revolution.

View Most Recent Blogs
Eldon Sprickerhoff
Eldon Sprickerhoff Founder and Chief Innovation Officer
In founding eSentire, Eldon Sprickerhoff responded to the incipient yet rapidly growing demand for a more proactive approach to preventing and investigating information security breaches. Now with over twenty years of tactical experience, he is acknowledged as a subject matter expert in information security analysis.