Managed Detection & Response
Keep Your Business Safe & Secure with Blue Bastion™
Key Benefits
24 x 7 continuous security monitoring of our customers’ infrastructure, applications, and data
A unified security management platform
Operationalizing and enhancing the utilization of our customers’ existing cyber security investments
Managed Endpoint Security
The only way to secure your network is to determine each instance in which a device or a person has access to your network and your data. We begin by analyzing your environment and identifying each endpoint. From there, we tailor our approach, policies, and procedures towards your specific use cases, reducing the complexity associated with a managed endpoint security platform while also shortening detection time and, ultimately, remediation time. This is achieved by monitoring, managing, and defending endpoints.
Blue Bastion uses a combination of endpoint solutions and external threat intelligence solutions:
Automated playbooks
Threat hunting assets for various indicators of compromise (IOC), as well as behaviors, to help identify threats
Internal threat intelligence
Endpoint detection and response (EDR)
24/7 managed detection and response (MDR) team, formerly referred to as our Security Operations Center (SOC)
SIEM as a Service
Everything we do for your organization starts by gaining an in-depth understanding of your environment. Once we better understand your toolsets, current security solutions, and the business-critical items that need to be logged, we work with you to integrate those items into our SIEM solution.
As we gain a better understanding of your emergency rotation and on-call processes, we then take our use cases for alerting and put them into production for our managed detection and response (MDR) team. These alerts are then passed through our in-house threat intelligence integrations, where automation initiatives can be discussed and thoughtfully deployed.
Micro-segmentation
Micro-segmentation is an approach to network security that allows us to divide your organization’s data center into manageable segments, to prevent the entire network from being exposed to a threat. Our methodology allows us to achieve immediate visibility of each distinguishable network element.
As part of our micro-segmentation process, we perform the following:
Deploy our solution
Become familiar with how your machines interact with one another
Scrutinize the data
Define alerts vs enforcement opportunities across your landscape
Enable alerts
Move enforcements to production, once trust is achieved and everyone is ready
Continuously enhance current deployment
This approach increases speed to value, while reducing the likelihood of disruption to your organization. Threat hunting, threat intelligence, and proactive block lists are implemented across this platform as well.
Threat Hunting
We take a multi-pronged approach to threat hunting. Because threat hunting is a buzzword that generally means something different to a wide-range of professionals within the security community, Blue Bastion has established multiple types of threat hunting styles as part of our services.
These services can be included as part of the comprehensive service you select, with the range of threat hunting options based upon your organization’s needs, available tools, and business limitations. As part of our threat hunting service, we generate data across our offensive security, digital forensics incident response (DFIR), and managed detection and response (MDR) teams.
As such, we all collaborate across our specific areas in order to: Identify new tactics, techniques, and procedures from both real-world threat actors (from DFIR and MDR teams) and from the research of our offensive security team.
We also receive threat intelligence from our threat intel partners. As such, those pieces of information are incorporated into our threat hunts.
If you would like to understand how we approach our threat hunt service on a deeper level, let us know.
Threat Intelligence
Threat intelligence is nothing new; however, Blue Bastion has taken a programmatic approach by building threat intelligence into our core. We created an algorithm based upon the collective experience of our engineers and analysts, to help categorize threat intelligence for our customers’ events. This has allowed us to reduce the amount of time spent per incident and decrease our time to detection, response, and remediation.
We work very closely with our threat intelligence partners, sharing our respective intel, as we strive to maintain a proactive security stance. All Blue Bastion teams have access to and utilize our threat intelligence information.
Playbook / Automation
Automation and orchestration are key to cybersecurity success. Our security development team primarily focuses on finding new ways to increase our efficiencies through different automation techniques, including the utilization of our SOAR solution to enhance our capabilities.