Extended Detection and Response (XDR)

Posted on by
extended detection and response (XDR) cybrary definition

Secure your business with CyberHoot Today!!!

Sign Up Now

Extended Detection and Response (XDR) is touted as a consolidation of technologies and disparate system monitoring into a single tool or suite of tools that provides extended visibility, analysis, and response across networks and cloud environments. XDR claims to be a more sophisticated and advanced progression of Endpoint Detection and Response (EDR) security. EDR tools contain and remove threats on endpoints and workloads, while XDR extends those capabilities beyond endpoints to multiple security control points. This includes email, networks, servers, and cloud environments to detect threats faster using data collected across various domains. Greater visibility and correlation are a good thing if it works.

XDR represents a major step forward in enterprise security capabilities. Since XDR has access to raw data collected across the environment, in theory, it can detect bad actors that are using legitimate software to gain access to the system. It performs automated analysis and correlation of activity data, allowing security teams to potentially identify and contain threats more effectively. For example, it can extend to include network detections, lateral movement, anomalous connections, beacons, exfiltration, and delivery of malicious artifacts. 

Finally, like EDR, XDR responds to the threat in order to contain and remove it, and with XDR’s greater visibility and data collection across the environment, analysts and SOCs can take more authoritative actions on impacted assets. However, CyberHoot would caution against blinding automating these responses, as there is a strong potential for unintended consequences. In all cases, repeated testing and trial and error are essential to a successful XDR setup and automated response capability.

What does this mean for an SMB or MSP?

The vast majority of SMBs or MSPs don’t need to worry about setting up XDR as it can become expensive depending on the number of users you have. However, if you have the budget for it, on average, around $50 per user per year, and the time to set up and test it repeatedly, then you might consider deploying it. If you want something similar, but less costly. consider an EDR solution. EDR services can cost less than $40 per user per year, about 20% cheaper than the average XDR solution.
 
These tools may simply be overkill for your business or clients, so CyberHoot’s minimum essential recommendations may be best for your SMB or MSP. Continue reading to see what our recommendations are. 
 

CyberHoot’s Minimum Essential Cybersecurity Recommendations

The following recommendations will help you and your business stay secure with the various threats you may face on a day-to-day basis. All of the suggestions listed below can be gained by hiring CyberHoot’s vCISO Program development services.

  1. Govern employees with policies and procedures. You need a password policy, an acceptable use policy, an information handling policy, and a written information security program (WISP) at a minimum.
  2. Train employees on how to spot and avoid phishing attacks. Adopt a Learning Management system like CyberHoot to teach employees the skills they need to be more confident, productive, and secure.
  3. Test employees with Phishing attacks to practice. CyberHoot’s Phish testing allows businesses to test employees with believable phishing attacks and put those that fail into remedial phish training.
  4. Deploy critical cybersecurity technology including two-factor authentication on all critical accounts. Enable email SPAM filtering, validate backups, and deploy DNS protection, antivirus, and anti-malware on all your endpoints.
  5. In the modern Work-from-Home era, make sure you’re managing personal devices connecting to your network by validating their security (patching, antivirus, DNS protections) or prohibiting their use entirely.
  6. If you haven’t had a risk assessment by a 3rd party in the last 2 years, you should have one now. Establishing a risk management framework in your organization is critical to addressing your most egregious risks with your finite time and money.
  7. Buy Cyber-Insurance to protect you in a catastrophic failure situation. Cyber-Insurance is no different than Car, Fire, Flood, or Life insurance. It’s there when you need it most.

Each of these recommendations, except cyber-insurance, is built into CyberHoot’s product and virtual Chief Information Security Officer services. With CyberHoot you can govern, train, assess, and test your employees. Visit CyberHoot.com and sign up for our services today. At the very least continue to learn by enrolling in our monthly Cybersecurity newsletters to stay on top of current cybersecurity updates.

To learn more about Extended Detection and Response (XDR), watch this short 2-minute video:

Sources: 

VMWare

Palo Alto Networks

TrendMicro

Related Terms:

Endpoint Detection and Response (EDR)

Security Event and Incident Management (SEIM)

CyberHoot does have some other resources available for your use. Below are links to all of our resources, feel free to check them out whenever you like: 

Note: If you’d like to subscribe to our newsletter, visit any link above (besides infographics) and enter your email address on the right-hand side of the page, and click ‘Send Me Newsletters’.

Share this on your social networks. Help Friends, Family, and Colleagues become more aware and secure.