Have you ever wondered why during the outbreak of war, it’s not just one of the armed forces that’s deployed, whether it’s the Army, Navy, Air Force or Intelligence, but all of them? It’s the classic case of – “The whole is greater than the sum of its parts”. The same analogy applies to cybersecurity too, making it pertinent for enterprises to fortify their cybersecurity posture across all possible vectors to avoid an impending breach. That’s why governments, enterprises, and other organizations would do well to re-evaluate their cybersecurity strategy.
With the increase in the investments made in cybersecurity by organizations in the last 5 years, today’s stark reality is that while the threat landscape is burgeoning, the meantime to identify a breach has increased to 197 days and containing it to 69 days across the industry vertical, according to a report by Verizon.
Traditionally, the endpoint protection platform (EPP) was considered “THE” solution to protect your organization, however, this philosophy has drastically changed with the assumption of the very real possibility “I will be breached”. This leads to the next question of effective detection and response strategy to deal with the threat once the network is compromised. EDR strategy has helped organizations to identify and respond to attacks they believe would have gone unnoticed. With the volume and sophistication of modern attacks, does it still hold good?
EDR an eye-opener: starting point in detection and response strategy
EDR was an eye-opener to the industry and a must-have starting point to redefine enterprise-wide Threat Detection and Response (TDR). EDR gives a lot of visibility on what is happening on endpoints by capturing activity data, using which we can detect and respond. However, in an enterprise, endpoint is just one piece of an IT infrastructure and there could be EDR blind spots like IoT, printer, contractor/guest endpoints etc.
While 94% of attacks start with phishing, email becomes an important vector to consider. With the increasing cloud adoption and serverless platforms, it has become pertinent to detect and respond to cloud infrastructure effectively. Add to this, there is an entire IT/OT convergence underway, where OT is increasingly becoming part of the IT infrastructure that’s connected to the network. So, with this scenario, the effective detection and response strategy has to be extended beyond endpoint to email, network, cloud and IIoT.
Going back to the analogy, to be victorious in war, enemy threats and attacks need to be confronted vehemently at all fronts (i.e., air, land, water) to avoid penetration and siege. You don’t go to war with the Army alone; you usually need the assistance of Air Force, Navy, and Intelligence side-by-side to complement your overall combat strategy. If we were to juxtapose this analogy to cybersecurity, then endpoint in XDR is our Army in the field; Air support is the cloud security; network visibility is the Navy at sea; threat research is the Military Intelligence and centralized console is your Unified Command.
Emergence of XDR
If you can record what happened on the endpoint, why couldn’t you record everything on the intrusion kill chain for later review? XDR expanded the EDR idea. XDR platform would give you complete visibility at every phase of the kill chain including the endpoint, giving enterprises the ability to monitor and account for compromise, no matter where it originates.
The dwell time (MTTD/MTTR) is adequately addressed by XDR through:
- Full visibility – complete picture
- Speed and confidence to respond
- High fidelity alerts
- Vendor consolidation
- Correlation and collaboration
Choosing the right XDR solution
An attack that resulted into alerts on email, endpoint and network can be combined into a single incident. The primary goals of an XDR solution are to increase detection accuracy and improve security operations efficiency and productivity. Effective XDR solution should have:
- Multi-prevention techniques and not rely on AI/ML only.
- Complement existing SIEM/SOAR by sending consolidated high fidelity alerts, which minimizes the level of noise and raw information.
- Managed services to address skill shortage.
- Solution/platform to break silos and tell a story of attack life cycle.
The XDR approach delivers faster detection and response across the multiple security layers because it breaks down the silos, and it tells a STORY instead of making noise.
When you have incomplete threat data, you see an incomplete security picture. Or worse, you may see the wrong picture. And in cybersecurity, the price to pay for seeing the wrong picture is hefty.
Disclaimer: The author of this article is Vijendra Katiyar, Director – Enterprise Business, India & SAARC, Trend Micro. All views expressed in this post are his own.
