Extended Detection and Response (XDR) is touted as a consolidation of technologies and disparate system monitoring into a single tool or suite of tools that provides extended visibility, analysis, and response across networks and cloud environments. XDR claims to be a more sophisticated and advanced progression of Endpoint Detection and Response (EDR) security. EDR tools contain and remove threats on endpoints and workloads, while XDR extends those capabilities beyond endpoints to multiple security control points. This includes email, networks, servers, and cloud environments to detect threats faster using data collected across various domains. Greater visibility and correlation are a good thing if it works.
XDR represents a major step forward in enterprise security capabilities. Since XDR has access to raw data collected across the environment, in theory, it can detect bad actors that are using legitimate software to gain access to the system. It performs automated analysis and correlation of activity data, allowing security teams to potentially identify and contain threats more effectively. For example, it can extend to include network detections, lateral movement, anomalous connections, beacons, exfiltration, and delivery of malicious artifacts.
Finally, like EDR, XDR responds to the threat in order to contain and remove it, and with XDR’s greater visibility and data collection across the environment, analysts and SOCs can take more authoritative actions on impacted assets. However, CyberHoot would caution against blinding automating these responses, as there is a strong potential for unintended consequences. In all cases, repeated testing and trial and error are essential to a successful XDR setup and automated response capability.
The vast majority of SMBs or MSPs don’t need to worry about setting up XDR as it can become expensive depending on the number of users you have. However, if you have the budget for it, on average, around $50 per user per year, and the time to set up and test it repeatedly, then you might consider deploying it. If you want something similar, but less costly. consider an EDR solution. EDR services can cost less than $40 per user per year, about 20% cheaper than the average XDR solution. These tools may simply be overkill for your business or clients, so CyberHoot’s minimum essential recommendations may be best for your SMB or MSP. Continue reading to see what our recommendations are.
The following recommendations will help you and your business stay secure with the various threats you may face on a day-to-day basis. All of the suggestions listed below can be gained by hiring CyberHoot’s vCISO Program development services.
Each of these recommendations, except cyber-insurance, is built into CyberHoot’s product and virtual Chief Information Security Officer services. With CyberHoot you can govern, train, assess, and test your employees. Visit CyberHoot.com and sign up for our services today. At the very least continue to learn by enrolling in our monthly Cybersecurity newsletters to stay on top of current cybersecurity updates.
Sources:
Related Terms:
Endpoint Detection and Response (EDR)
Security Event and Incident Management (SEIM)
CyberHoot does have some other resources available for your use. Below are links to all of our resources, feel free to check them out whenever you like:
Note: If you’d like to subscribe to our newsletter, visit any link above (besides infographics) and enter your email address on the right-hand side of the page, and click ‘Send Me Newsletters’.
Discover and share the latest cybersecurity trends, tips and best practices – alongside new threats to watch out for.
A recent discovery by cybersecurity firm Oligo Security has unveiled a series of critical vulnerabilities in...
Read moreA newly uncovered cyberattack campaign is exploiting Zoom’s Remote Control feature to infiltrate the systems...
Read moreGet sharper eyes on human risks, with the positive approach that beats traditional phish testing.