Organizations today need a number of cybersecurity tools to defend against the daily onslaught of cyber threats. Unfortunately, many security teams struggle to manage said tools due to the challenge of securing all network entry points. Yossi Naar chief visionary officer & co-founder, Cybereason, explains how extended detection and response (XDR) can help identify broader malicious operations.
Organizations today are assembling an ever-growing array of tools to defend themselves against cyber threats. However, security teams often struggle to manage said tools. Each with its own unique requirements, teams are compelled to grow in order to keep up with all the tooling. In an industry that already faces a significant skills shortage, this presents an impediment to the scalability of a company’s security strategy. Tools are meant to play a supporting role in your and your company’s security needs. They should make your life easier, not create a burden. So, what is the alternative?
How Extended Detection and Response (XDR) Makes a Difference
It is undeniable that organizations face a broader, more distributed attack surface than ever before. Security teams are having to contend with an expanding inventory of both new and legacy devices; not to mention the dispersed nature of users following the recent upsurge in remote working. Attackers can infiltrate traditional firewalls, VPNs, and email servers, for instance, whilst hiding behind gaps in visibility, misconfigurations and stolen identities.Â
Frequently, evidence of malicious activity can be identified by security monitoring tools. Yet, these findings emerge as disparate, disconnected events. Without a means of collating all this information to gain a single bird’s eye view, security teams are in a constant battle to put out fires without addressing the root cause. This is where extended detection and response (XDR) is poised to make a difference.Â
Learn More: Is Extended Detection and Response (XDR) the Ultimate Foundation of Cybersecurity Infrastructure?
How To Combine Endpoint Data With Identity and CloudÂ
XDR assembles observations from various tools and processes, combining endpoint data with identity and cloud workspace activity, to provide an actionable, visual understanding of an attack. As opposed to simply monitoring for individual signs of an attack, organizations can identify a broader malicious operation and swiftly pivot to taking response measures to end it.
Unlike Endpoint Detection and Response (EDR) which focuses solely on laptops, desktops, and servers, XDR takes into account user identities, cloud architecture, productivity suites, email, network, and more. With built-in response capabilities, analysts are then guided, step-by-step on how to isolate or remediate the attack.
Bad actors are not only evading traditional defenses but are moving to high-impact, disruptive attacks like ransomware and data theft quicker than ever before. Having the ability to see and take action across all of these assets is crucial to mounting a comprehensive defense that protects both your assets and your end-users.
Some may wonder how XDR can achieve a different outcome compared to security information and event management (SIEM) or security orchestration, automation, and response (SOAR).Â
Learn More: Breaking Down Extended Detection and Response (XDR): Benefits, Hype, & Reality
How SIEM Identifies a Multi-Stage Attack
For instance, SIEM, like XDR, offers security teams a holistic view of their environment. However, it is limited in that it focuses on “monitoring and data analysisâ€, and does not take any action to reduce or prevent risk. Rather, human intervention is demanded to investigate and determine the correct response. Moreover, while it is often effective in spotting known commodity attacks, it lacks the capability to expose multi-stage efforts. Of course, as long as SIEM is unable to identify a multi-stage attack, the easier it is for bad actors to persist on the network, making it much harder to expel the adversary and resolve the issue.Â
In contrast, XDR maintains a proactive approach to prevent attacks, and reduce the risk of an ongoing breach. If malware is found deployed on a laptop, for instance, associated endpoints, email, and shared drives can be automatically assessed for impact.
What’s more, SIEM typically requires its analysts to be well-versed in multiple domains. They first need to be able to understand when certain behaviors should be classified as malicious. They would also need to ensure that the right data is being collected and they are required to learn complex query language to recall the data they seek. Conversely, XDR eliminates these concerns by instantly supplying analysts with context in just a few clicks.
SOAR, on the other hand, does provide a response mechanism to threats and has the ability to automate repetitive tasks. However, it needs to work in tandem with SIEM or a similar analytics tool. In addition to this, the effectiveness of the solution is only realized once detailed workflows are established. This requires a highly experienced team of professionals to operationalize.Â
In short, XDR provides the best of both worlds as it combines visibility and response; all whilst remaining accessible and user-friendly.Â
Learn More: 3 Steps for CISOs to Get More Out of SIEM Tool
The XDR Promise: Ease Security Processes
This is not to say that making the shift to XDR is easy. In fact, many organisations may be happy with the technologies and strategies they have in place to monitor, detect and stop cyber threats. Perhaps, substantial sums have already been invested in SIEM/SOAR or other customized solutions and they are simply not ready to give that up.Â
While a perfectly reasonable response, it is important to recognize that XDR can enhance the work done by SOAR and SIEM. Even if an enterprise had the experts to build, train and retrain their SOAR and SIEM, this method is highly inefficient. XDR promises to ease security processes by taking on the majority of the work, through automatic enrichment, pre-built detections, and guided response recommendations. Both SOAR and SIEM represent partial solutions, whereby the former acts as the muscle system and the latter is akin to nerves. Both require a ‘brain’, or XDR, to operate effectively and to allow security teams to be accurate and scalable in their threat responses.
Keep Up in Today’s Dynamic World With XDR
XDR isn’t the holy grail or silver bullet of cybersecurity, but it is the outcome of a convergent evolution of other technologies like SIEM and SOAR. It has recognized its weaknesses and it now offers teams the agility to tackle important, high-impact threats. Maintaining a strong security posture is not about jumping on the next trend but considering the long-term and assessing if existing tools and processes are sustainable; particularly in keeping up in today’s dynamic world.
Did you find this article helpful? Tell us what you think on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We’d be thrilled to hear from you.