As cybersecurity threats continue to evolve and become more sophisticated, you may have heard more and more about XDR (extended detection & response) as a cybersecurity solution. But it can be difficult to pin down exactly what XDR does and why it’s such a powerful tool for housing providers to use, particularly alongside a managed cybersecurity partner.
As a relatively new approach to threat detection and response, XDR is often described as delivering ‘holistic’ protection against cyberattacks, in the sense that it provides organisations with a more complete view of security events across their entire IT environment and technology stack (incl. endpoints, networks and cloud infrastructure).
Using an XDR approach, organisations can mitigate and monitor threats across a wider attack surface, and from previously-siloed security tools offering, as Gartner puts it, a “unified security incident detection and response platform that automatically collects and correlates data from multiple proprietary security components.”
In other words, what XDR offers is a much easier and faster investigation, threat-hunting and response service than previous generations of security tools – invaluable for housing providers storing so much sensitive and personal information.
How does XDR work?
XDR connects and aggregates data from multiple security solutions, allowing them to work together to improve threat visibility and reduce the length of time required to identify and respond to an attack (what we call ‘dwell time’).
Ideal for cloud-based environments, XDR typically involves the use of advanced analytics and machine-learning algorithms to analyse security event data from multiple sources in real-time. This can include log data from endpoints, network traffic and cloud services, as well as leveraging threat intelligence feeds and other contextual data.
By analysing this data, XDR solutions can identify complex, multi-stage security threats and incidents that might otherwise be missed by traditional security tools.
XDR in a nutshell:
- Data is ingested from multiple log types across multiple points of an organisation’s attack surface;
- Data is parsed and correlated using machine learning and automation to identify suspicious or abnormal activity;
- This activity is then prioritised by severity so threat hunters can quickly contain, investigate and respond.
It’s worth pointing out that because XDR typically involves automated response capabilities, security teams can quickly contain and mitigate threats as soon as they are detected. This results not only in faster response times but also reduces the burden on security teams to constantly act.
Automated actions that organisations may choose to set up could include quarantining infected endpoints, blocking malicious network traffic or notifying security personnel of potential incidents.
What’s the difference between MDR and XDR?
Where MDR (managed detection & response) improved detection and response capabilities over the use of tools such as traditional anti-virus software, XDR extends the range of MDR over as many attack vectors as possible, so not just endpoints but also gaining the visibility and ability to take response actions on other surfaces including email, user accounts, applications and cloud infrastructure.
In short, XDR takes a wider view than MDR and also has a much broader capability. It uses cutting-edge technologies (such as machine learning) to provide higher visibility to organisations and employs analytics and automation to help detect or even predict attacks.
What are the benefits of a managed XDR service?
An XDR solution is more than a cybersecurity ‘upgrade’; it completely changes the way cybersecurity is approached. In making this leap, housing providers can benefit from:
- Scalability: XDR gives housing providers the ability to scale their security infrastructure as their needs change because the solutions leveraged within the service are cloud-based and bespoke rulesets can always be tailored to suit.
- Enhanced threat visibility: XDR delivers granular visibility by working across multiple layers, collecting and correlating data from an array of sources such as email, endpoints, users, cloud workloads and networks.
- Improved efficiency: with advanced analytics and correlation content pre-built in the tool, on top of threat-focused TTP (tactic, technique & procedure) bespoke rulesets, XDR automatically detects and contains advanced threats. This means that security teams can react with greater agility.
- Boosted productivity: XDR unites multiple tools under one centralised solution, meaning that they are much easier to handle, oversee and manage. Aggregating data in one place like this saves time and allows the different tools to act in unison, making the whole workflow much smoother.
- Better compliance: XDR helps housing providers meet a range of compliance and regulatory requirements by providing continuous monitoring and reporting on security controls; this means it’s easier to demonstrate information security compliance.
- Customised alerts: XDR solutions have the ability to enrich automatic responses to threats based on rules and through the use of security orchestration and automated response (SOAR). As well as cutting down on manual investigation time and reducing alert fatigue, this allows analysts to make key decisions faster and more effectively.
- Continuous improvement: XDR solutions use machine learning to continuously learn and improve over time. In this way, the protection organisations receive from their XDR solution will get better and better as time goes on.
Sean Tickle is the cyber services director at Littlefish.
