Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in the Public Sector. Learn More

Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in the Public Sector. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Managed Detection and Response Providers Shouldn’t Lay Claim to Your Custom Content

Among the due diligence a company should perform when signing with a managed detection and response (MDR) provider, one item that may not be top of mind is who owns custom content developed during the service. You may be surprised to find out it’s often the provider, not you.

MDR content ownership becomes an issue when you change providers or bring in-house the monitoring capability. In that case, you will want to take with you any custom content, including configurations and policies developed during the service. This is especially true as more companies adopt cloud-based endpoint detection and response (EDR), where it’s relatively simple to move from one MDR provider to another.

We are seeing an increasing trend in which MDR providers claim ownership of any content created while you were their customer, classifying it as their intellectual property (IP). That is certainly their prerogative, which means it’s important for you to understand who owns custom content developed under the service – and determine how important the content ownership question is to your decision-making process.


Why MDR Content Ownership Matters

For the service to be truly effective, the provider must tune and optimize the MDR tool to your particular environment, risk appetite, and other factors. All of which require configuration and content developed over time.

Then there is keeping content relevant. As new threats emerge and business operations evolve, your provider should be in tune with those changes, adapt policies, and deploy new security content. The MDR provider should know the event correlation logic based on what constitutes suspicious activity in your environment and continually refine it.

This will include the configuring of thresholds, whitelists, blacklists, indicators of compromise (IOC), and other parameters that consider information such as your geographic locations and operating hours for different sites and departments. For example, while a manufacturing facility may have three shifts, your financial experts are not likely to log in from one of them at 3 a.m.

As further support, a provider should be able to customize alert and incident response notification procedures to your needs. For less-critical assets, perhaps you want the MDR provider to act proactively in response to a threat, while for business-critical assets, it should first coordinate with your security team. All notification channels, escalation procedures, workflows, roles, and responsibilities should be clearly defined.


Trustwave Gives Clients Ownership of Custom MDR Content

As you can imagine, developing and managing content in response to those needs takes work that will span the duration of the service. The configurations, your environment, the threat landscape, and tools themselves evolve. Given the expertise required to create this content, I suppose that’s why some MDR providers consider configuration content to be their property.

At Trustwave, for example, some of the content we have developed includes pre-configured playbooks, packaged policy sets covering best practice configurations for different EDR technologies, industries, departments, geographies, and the like.

While these demonstrate Trustwave’s expertise and extensive experience in cybersecurity, we don’t consider the resulting MDR content to be our property. The way we look at it, giving ownership to the client is an investment in their security program as their MDR partner. This is in the unlikely event that you someday want to take your business to a different MDR provider, you keep all of the goodness that has been developed over time.

It’s worth asking other MDR providers whether they will do the same.



Latest Trustwave Blogs

Using Trustwave DbProtect and Offensive Security Solutions to Protect Against Nation-State Cyber Threats

The US Director of National Intelligence (DNI) earlier this month gave a stark warning to the Senate Armed Services Committee detailing the cyberthreats arrayed against the US and the world from...

Read More

Defending the Energy Sector Against Cyber Threats: Insights from Trustwave SpiderLabs

It has always been clear, even before the Colonial Pipeline attack, that the energy sector is a prime target for not only criminal threat groups, but also nation-state actors. After all, halting fuel...

Read More

Trustwave SpiderLabs Unveils the 2024 Public Sector Threat Landscape Report

Trustwave SpiderLabs’ latest report, the 2024 Public Sector Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies details the security issues facing public sector...

Read More