Peculiarities of Modern XDR Solutions

The deployment of Extended Detection and Response (XDR) solutions is a promising trend in building and enhancing the comprehensive protection of digital infrastructure. XDR applies machine learning algorithms to accurately identify and respond to incidents. It can be combined with Security Information and Event Management (SIEM) as well as Security Orchestration, Automation, and Response (SOAR) tools. This tactic is the best bet for companies that aren’t yet mature enough to implement a full-blown Security Operations Center (SOC).

Let’s take a look at the features of today’s XDR systems and dwell on how this growing market will evolve down the line.

What is XDR?

In recent years, XDR solutions have been increasingly implemented to build and enhance comprehensive protection, increase the efficiency of incident response, and conduct in-depth cybersecurity investigations. So, what is XDR, what is it for, and what are the ultimate benefits of using this technology?

XDR was created to tackle threat actors’ multi-pronged approaches to infiltrating systems that result in compromising many elements of an organization’s infrastructure in one go. It boasts highly accurate automatic detection based on behavioral analysis at all levels: the host, the network, and even in isolated environments. A product like this can flexibly fit into the secured infrastructure and support effective emulation.

There are three major components of XDR:

•       Continuous monitoring of endpoint devices, the network, and other sources to record all security events like a “black box” on an airplane.
•       Automatic detection of anomalous activity on endpoints and the network based on signatures that are not available to Endpoint Detection and Response (EDR) systems.
•       Manual detection, also known as “hunting”, which gives IT teams the big picture of how exactly the attacker has acted.

Is XDR a product category or a concept?

There are different perspectives on this matter. Most experts think of XDR as a product. Some consider it to be a cross-product concept that emerged to address the demands of the market and customers, given that every customer has different needs and tasks such a tool should solve.

Furthermore, the single-vendor paradigm imposes significant restrictions that should be eliminated to deliver reliable defenses. Regardless of categorization, it is not so important for the end user whether XDR is a concept or a product as long as it does the protection job properly.

The lack of qualified InfoSec specialists is one of the reasons the market needs XDR solutions. Such a system allows organizations to automate and unify many security-related workflows while optimizing event monitoring and metrics, which makes it much easier to ensure a decent level of protection. Top-notch XDR tools support the option to subscribe to extra services, for example, deeper forensic analysis and proactive threat hunting. It is also possible to engage external analysts for a more effective investigation of security breaches.

If you deploy a combo of EDR and Network Traffic Analysis (NTA) and organize control at the host and network levels, will you end up with an XDR? No, because the missing link in this scenario is a system that will collect all the data and do something with it, which means that there is no detection and response as such.

Most experts agree that SOAR / SIEM and XDR are two parallel competing branches that pursue pretty much the same objective. You can build your own SOAR / SIEM using different modules, merge all these modules, and adjust them to your tasks. Or you can purchase a turnkey XDR solution and benefit from feature updates and other enhancements on the vendor’s end.

To recap, the basic concept of XDR combines EDR and NTA while eliminating single-vendor dependency from the security equation.

“Data lake” as the foundation of XDR

An arbitrary event is recorded in two databases: one for long-term storage used to parse incidents that took place, say, six months ago; and the other for parsing current incidents. This way, data is amassed from multiple sources and processed quickly. The customer prioritizes the sources they need to monitor, and the vendor can independently collect additional materials. The entirety of this information is referred to as “data lake”, and that’s the entity XDR leverages to do its thing.

Choosing an optimal XDR system

It is worth highlighting several key points that will help a company make an informed decision when selecting the most suitable XDR solution:

•       Incident detection and investigation features are paramount.
•       The ease of investigation is important as well because a lot of logs are accumulated along the way.
•       The tool should support different operating systems.

Another important criterion is the ability to go beyond the original IT ecosystem. As a matter of fact, today’s best XDR solutions are ones that evolved from EDR. Collecting data from more infrastructure devices takes detection and investigation to the next level. A tool worth its salt should support integration with third-party systems as well.

From the end user’s perspective, the most important thing is to be able to simply connect all data sources to XDR in a hassle-free way and forget about it until the first incident occurs. With that said, there are also three basic criteria: easy setup, efficiency, and usability.

How does XDR detect complex attacks?

Generally speaking, the functioning of XDR is based on two components: the host part and the correlation kernel that collects data from the network and the hosts. Different products work differently in terms of the load they put on the host. A common denominator is that all XDR tools efficiently leverage machine learning, which has already stepped into the Internet security area and helps identify different viruses as intrusion attempts on the go. The customer can create detection rules on their own, and the vendor supplies additional rules, updating them further on for a fee.

Cross-detection is another incredibly important feature of XDR. For example, if a malicious object is extracted from email traffic, the suspicious signature will be automatically blocked on all hosts. The hash of the malicious file flows from one client (if it is not isolated) into a shared database and is then synchronized between all clients.

What are the benefits of using XDR compared to SOAR? The idea behind SOAR is to integrate “everything with everything else”, while XDR helps you respond very quickly and very accurately, automating many processes and facilitating the work of SOC analysts. Additional advantages include manual incident response options, effective actions at the host level, automatic actions at the level of other systems, and firewall optimization.

XDR in the context of a SOC

In most scenarios, XDR can work without SOC, but it all depends on the specific tasks. Using SOC is a must if an infrastructure spans thousands of machines; moreover, it is best to outsource these services. Also, you will need analysts competent enough to interact with XDR.

On the other hand, XDR can be delivered as SaaS (Software-as-a-Service). Essentially, XDR and EDR are data enrichment tools for SOCs which, in their turn, use SIEM-based systems to operate. In this complex fusion, XDR will act as the main source of security-related data.

XDR can also be effective for organizations that are not yet ripe for implementing SOC but want to monitor, automate, and investigate cyber incidents. It will maximize the efficiency of fulfilling these tasks. Moreover, it can be a great SOC alternative for some companies. One way or another, there should be a qualified specialist who works with XDR.

XDR market trends and forecasts

Most analysts believe XDR will become a mass phenomenon in the next three-five years. Such products are in demand because they are convenient for everyone seeking to have an all-embracing view of what is going on inside the IT infrastructure. Vendors will also continue to enhance their XDR tools and will connect more cross-product functions. Chances are that some sort of a hybrid instrument will appear, and everything will be wrapped in a new marketing shell while the basic concept will remain the same.

XDR or SIEM / SOAR?

First things first, these are architecturally different solutions. SOAR can’t perform fast processing of large amounts of data and make decisions based on behavioral analysis as XDR does. Many companies use both solutions. In the future, these two approaches will likely merge and complement each other. The market choice will dot the i’s and cross the t’s in this context.

Conclusion

XDR solutions are very promising. They are developed by leading vendors in the cybersecurity sector and are a natural evolutionary step (EDR plus NTA) in providing comprehensive protection. XDR boasts high-speed processing of large amounts of logs collected from all key infrastructure nodes over any specified period, giving the administrator actionable insights into what is happening inside the perimeter.

By applying behavioral algorithms and machine learning, XDR paves the way toward efficient and timely incident response, a rollback of an attacker’s activity, and the improvement of defense layers. XDR solutions are fairly pricey to deploy, and yet the cost is lower than that of implementing individual components that will not be linked seamlessly in a single ecosystem.

XDR systems are worthwhile for companies that do not have a SOC in place but are looking for a professional end-to-end incident investigation solution. It also works well with SIEM / SOAR models already in use, significantly speeding up incident management. In the next few years, the XDR market will go through significant enhancements in response to the growing need for such a comprehensive product among businesses.