eXtended detection and response (XDR) is a security technology that unites multiple security systems into one. Organizations are transitioning from traditional systems such as endpoint detection and response (EDR) and security and information event management (SIEM) to XDR, in a move that is analogous to the transition from agile to DevOps work processes.
XDR can detect threats quickly by automatically collecting and combining information from across the IT environment—endpoints, servers, email and social media messages, cloud and application workloads—giving security analysts the context they need for fast investigation and response.
In many cases, attacks occur in the borders between security silos. Each silo may be adequately protected by a security solution, but in between those silos, attacks remain evasive because security analysts have a limited view on the environment, determined by their security tooling. XDR connects silos with a unified threat identification and response strategy.
Just like in the past development and operations teams were responsible for separate silos, with independent tooling and split responsibilities, security teams are split into silos, with limited communication between them. Security threats that cut across silos are difficult to mitigate. XDR enables new organizational structures in which security teams work together, with shared responsibility for mitigating threats, no matter where they occur in the IT environment.
Benefits of XDR
The purpose of XDR is to promote the visibility of threats and security incidents throughout an organization’s ecosystem. Its key benefits include:
- Centralized monitoring and management – XDR solutions provide a single pane of glass for security incidents happening across the corporate network, endpoints and workloads. Consistent security rules can be implemented across diverse IT infrastructure, both in the cloud and on-premises.
- Unified visibility – XDR integrates security visibility across endpoints, cloud infrastructure, network traffic, etc. This allows security analysts to understand potential security incidents without having to learn and use other platforms.
- Fast ramp up – XDR offers built-in integration with an organization’s IT infrastructure, and uses multiple threat discovery mechanisms from a variety of security technologies. Because analysts only need to learn one platform, time to value dramatically increases.
- Increased productivity – XDR eliminates the need to manually switch between multiple dashboards or tools to collect security data. This allows analysts to more effectively detect and respond to security threats.
- Low Total Cost of Ownership (TCO) – XDR provides a fully integrated network security platform. This can reduce the costs associated with purchasing, configuring and integrating multiple solutions.
- Analyst empowerment – XDR provides a shared workflow for all tiers in the security organization. This reduces the need for training and allows Level 1 analysts to perform more in-depth analysis, reducing their need to escalate to higher analyst tiers.
XDR is designed to give security teams full visibility into an organization’s endpoints and network infrastructure. Increased visibility has many security benefits:
- Unified detection and remediation – XDR provides centralized and integrated incident response capabilities across all corporate environments. This allows security personnel to quickly identify threats, mitigate them and recover, all using the same platform, reducing the impact on the organization and overhead costs.
- Better understanding of threats and attacks – Attack indicators are rare and far between, and each one on its own may not be enough for analysts to identify the threat. XDR collects these signals from multiple sources, across environments and over time, helping analysts identify threats that would otherwise remain invisible.
- Threat hunting – With unified visibility and data analysis accessible to everyone in the security environment, all analysts can carry out proactive analysis to identify threats that have already compromised the corporate environment.
How Does XDR Work?
What is the real difference between an XDR system and the traditional toolchain of endpoint detection and response (EDR), security orchestration, network protection and data analysis tools?
The answer is the language it uses. An effective XDR system should provide a unified, abstracted language to describe security signals, data and security controls. This language clearly specifies the potential security associations of each data point, by adding the concept of an “attack history.”
The XDR security language removes certain non-essential information, but suppresses noise, revealing high-risk attacks. It does not require expert manipulation, so security analysts do not need to be interpreters anymore—they can spend their time actually mitigating attacks. It is easy to understand, rich with context and content, based on advanced technology, but generating straightforward outputs that make an analyst’s job easier.
This unified security language is new, because the technology needed to enable it was not available until recently. Here are some of the advanced technologies that have recently matured and power the XDR information experience:
- Threat intelligence feeds – Now delivered in real-time and with more data and context.
- Next-generation machine learning – Multidimensional traffic algorithms that take into account signals from many independent data sources, unlike traditional systems such as user and event behavioral analytics (UEBA), which had a narrow set of inputs.
- Natural language processing (NLP) – Algorithms that can be trained to draw conclusions from security rules, revealing information about threats, security alerts and how they interact with security controls.
- Reasoning mechanisms – Algorithms that identify causal relationships, allowing the system to aggregate data points and automatically generate an attack story. This is a dynamic analysis, not based on predefined rules as with old-school security information and event management (SIEM) systems.
Mistakes to Avoid With XDR Platforms
While XDR is widely believed to be the future of EDR and network security, it is a new technology and there are several pitfalls you should try to avoid in your implementation:
- High integration complexity – Check the cost and effort involved in integrating the XDR solution with your environment. Maintaining this integration is also costly. For example, if your organization already has a SIEM, integrating it with the XDR system is non-trivial.
- Time to implement – The adoption time required for an XDR solution is crucial. Organizations are transitioning to remote work, and attackers are using remote workers, unsecured remote devices and networks, to gain access to sensitive data. A detection and response solution that takes weeks or months to successfully integrate into the stack is risky.
- Limited automated analysis – Some XDR solutions do not leverage the full power of AI-driven analysis, limiting themselves to initial data processing and correlation, which may be better than existing systems, but still require manual work from analysts.
- Operational complexity – The promise of XDR is to simplify workflows and improve productivity. If the XDR solution itself is too complex or requires analysts to learn new skills, adoption may be difficult and the total cost of the solution increases accordingly.
An Enabler for DevSecOps
XDR is not just a technology platform, it is a new organizational model that will help security teams work more closely together, focusing on threats rather than on specific tools or IT systems.
This ties into a broader movement in security organizations to transition to DevSecOps models, in which developers, security and operations work together to shift security left and integrate security into all parts of the development life cycle.
XDR technology will make it easier for security teams to act as a whole, and apply security tooling and practices consistently to a variety of environments, from a developer’s workstation to a full production environment. Thus, XDR may become a key enabler for the easier adoption of DevSecOps methodologies in highly secure environments.
