Among the due diligence a company should perform when signing with a managed detection and response (MDR) provider, one item that may not be top of mind is who owns custom content developed during the service. You may be surprised to find out it’s often the provider, not you.
MDR content ownership becomes an issue when you change providers or bring in-house the monitoring capability. In that case, you will want to take with you any custom content, including configurations and policies developed during the service. This is especially true as more companies adopt cloud-based endpoint detection and response (EDR), where it’s relatively simple to move from one MDR provider to another.
We are seeing an increasing trend in which MDR providers claim ownership of any content created while you were their customer, classifying it as their intellectual property (IP). That is certainly their prerogative, which means it’s important for you to understand who owns custom content developed under the service – and determine how important the content ownership question is to your decision-making process.
Why MDR Content Ownership Matters
For the service to be truly effective, the provider must tune and optimize the MDR tool to your particular environment, risk appetite, and other factors. All of which require configuration and content developed over time.
Then there is keeping content relevant. As new threats emerge and business operations evolve, your provider should be in tune with those changes, adapt policies, and deploy new security content. The MDR provider should know the event correlation logic based on what constitutes suspicious activity in your environment and continually refine it.
This will include the configuring of thresholds, whitelists, blacklists, indicators of compromise (IOC), and other parameters that consider information such as your geographic locations and operating hours for different sites and departments. For example, while a manufacturing facility may have three shifts, your financial experts are not likely to log in from one of them at 3 a.m.
As further support, a provider should be able to customize alert and incident response notification procedures to your needs. For less-critical assets, perhaps you want the MDR provider to act proactively in response to a threat, while for business-critical assets, it should first coordinate with your security team. All notification channels, escalation procedures, workflows, roles, and responsibilities should be clearly defined.
Trustwave Gives Clients Ownership of Custom MDR Content
As you can imagine, developing and managing content in response to those needs takes work that will span the duration of the service. The configurations, your environment, the threat landscape, and tools themselves evolve. Given the expertise required to create this content, I suppose that’s why some MDR providers consider configuration content to be their property.
At Trustwave, for example, some of the content we have developed includes pre-configured playbooks, packaged policy sets covering best practice configurations for different EDR technologies, industries, departments, geographies, and the like.
While these demonstrate Trustwave’s expertise and extensive experience in cybersecurity, we don’t consider the resulting MDR content to be our property. The way we look at it, giving ownership to the client is an investment in their security program as their MDR partner. This is in the unlikely event that you someday want to take your business to a different MDR provider, you keep all of the goodness that has been developed over time.
It’s worth asking other MDR providers whether they will do the same.
