Arctic Wolf recently unveiled new enhancements to its Managed Detection and Response (MDR) service, focusing on Identity Threat Detection and Response (ITDR). These updates, which include active response capabilities and integrations with Microsoft Defender for Identity and Okta, aim to bolster the defenses of businesses against increasingly sophisticated identity-based attacks.
The Growing Threat of Identity-Based Attacks
Cybercriminals are increasingly targeting identity infrastructures with tactics like credential stuffing and phishing. In 2023, Arctic Wolf’s Incident Response team found that 39% of the incidents they investigated involved external remote access using compromised credentials. This statistic underscores the critical need for robust ITDR capabilities within security operations.
“As adversaries increase the use of identity-based attacks, the ability to integrate robust ITDR capabilities into security operations is critical in building business resilience,” said Dan Schiappa, Chief Product and Service Officer at Arctic Wolf. “Effective cybersecurity hinges on detecting and remediating threats as quickly as possible.”
Key Enhancements to Arctic Wolf MDR
Active Response for Identity: The new active response capabilities allow for immediate action against threats within identity infrastructures. This includes swiftly disabling compromised user accounts and revoking access to sensitive systems, thereby reducing the risk of data breaches and other cyber incidents.
Integration with Microsoft Defender for Identity: This integration enhances visibility into identity infrastructures, facilitating the early detection of identity-based attacks. It is particularly effective against threats such as Business Email Compromise (BEC), which have become increasingly common.
Okta Impossible Travel Detection: Arctic Wolf has expanded its existing integration with Okta to include detection capabilities for suspicious logins based on geographical anomalies. If an account is accessed from widely separated locations within a short period, it is flagged as potentially compromised.
Addressing the Complexity of Cybersecurity
The introduction of these features comes at a time when the complexity of cybersecurity is ever-increasing. Jeff Williams, co-founder and CTO at Contrast Security, sheds light on the challenges faced by large tech companies like Microsoft in managing vulnerabilities.
“Microsoft is getting excoriated for taking a long time to respond to what turned out to be a very serious vulnerability. While it’s pretty obvious in hindsight that they made a mistake, I think commentators are judging them without seeing the whole picture,” Williams explained. He highlighted the complexity of modern software, built from numerous components and often riddled with thousands of reported vulnerabilities. “This is all of our fault. We reward companies for new features, not security.”
Williams points out that many organizations, including banks and healthcare companies, struggle with substantial backlogs of vulnerabilities. This widespread issue highlights the need for a shift in how security is prioritized in the development and deployment of software.
The Path Forward
Arctic Wolf’s latest enhancements reflect a broader industry trend towards more integrated and proactive cybersecurity measures. Through its cloud-native, AI-driven platform, Arctic Wolf processes over 5.5 trillion security events weekly from a global customer base of over 5,700 clients. This vast amount of data enables the company to provide timely and actionable insights, helping businesses stay one step ahead of potential threats.
The integration of robust ITDR capabilities into security operations represents a significant advancement in protecting against identity-based threats. As the cybersecurity landscape continues to evolve, companies like Arctic Wolf are crucial in helping organizations defend their most critical assets.
