Traditional antivirus is just not enough anymore. Not on a business network anyway.
Threats have evolved.
The self-propagating virus designed for random mayhem has largely been replaced by organised gangs of hackers
determined to hold your business to ransom and extort you.
As the threats evolve, so must the tools.
These days, anyone operating a business network needs to be using EDR.
Or is it MDR?
Or XDR?
They all seem to do similar things, but every vendor swears blind that their 3-letter acronym
is better than the other 3-letter acronyms.
So what is the difference, and what should you be looking out for?
Welcome back to the Pro Tech Show!
I know there are other "Something DR" products out there as well,
but we kind of went through a phase of it being the trendy thing;
so marketing people just started slapping "DR" on everything, and some of it got a bit silly.
I'm focusing on EDR, MDR, and XDR because they all overlap,
and you essentially have to choose between them.
We'll start with EDR, short for Endpoint Detection and Response.
Where antivirus is concerned with malicious software, EDR focuses on malicious behavior.
It monitors activities and events on devices, looking for patterns that may indicate malicious action.
For example, it's normal for a user or device to look up information
from the network's directory on a pretty frequent basis.
This isn't suspicious.
But if a user tries to look up every scrap of information all at the same time
an EDR tool would flag this for investigation;
because while each individual action is normal,
the bigger picture looks rather like an attacker performing network reconnaissance
in order to expand their foothold on your systems.
EDR records system activity, suspicious or otherwise, to provide data for future investigations.
This data is vital when a breach is detected
because it allows defenders to understand how the breach occurred and what the attacker actually did.
The last thing you want to find out is that your network has been breached,
but you have no idea when it occurred or what data the bad actor had access to
and could have potentially stolen or changed.
Unknowns here are really, really bad.
Not only can EDR help nip attacks in the bud,
it also provides the data you need to figure out exactly what happened and when.
The last part of EDR is the "R" for response.
As well as alerting you to malicious activity,
EDR can proactively take action to mitigate attacks before they have a chance to cause damage.
If events are recorded that indicate a system has been breached
EDR can automatically isolate the system from the network in order to cut off the attack.
Strictly speaking, EDR is a separate solution to antivirus;
however practically speaking a lot of security vendors these days provide both in a single package.
When looking at EDR solutions therefore, it's important to ask
whether the one you're looking at is designed to replace or complement your existing antivirus.
In terms of downsides: the biggest challenge with EDR is the amount of information it produces.
EDR is not as precise as antivirus because it's rarely working from a black and white list of what
constitutes malicious activity.
Almost every data point an EDR system collects could be either good or bad depending on context.
EDR tries to assess this based on the known patterns and threat intelligence it has access to,
but there is a lot of grey area between definitely good and definitely bad.
Automatically isolating live systems based on a guess is risky,
so with most detections EDR will flag the events for an administrator to review.
Compared to an antivirus EDR generates way more alerts for investigation;
and because these alerts are not as definitive the investigations require more effort and more
expertise.
Implementing EDR may require you to upskill or upscale your team,
which is why many organisations prefer to outsource the job to a partner.
This partner provides the necessary expertise and manpower to triage the alerts generated by the EDR
software and provides clear and actionable recommendations to you.
This, in a nutshell, is MDR: Managed Detection and Response.
MDR is basically just a marketing term used to describe a package that consists of EDR software
plus a managed service to take care of it for you.
Not all vendors use this name.
You might come across names MDR, Managed EDR, Managed XDR, MXDR, some will include it with
another offering such as Managed Services, Managed Security Services, Security Monitoring,
or SOC (Security Operations Centre).
The value of an MDR solution comes down to the quality of the
filtering and advice they give you.
You can probably purchase the same EDR tool more cheaply,
but with MDR you're paying for their time and expertise.
Unfortunately, this is highly variable.
A good MDR service can significantly reduce the effort and expense required for a company to
derive value from an EDR solution, but some IT people I've spoken to said all their MDR provider
does is forward alerts to them over a certain severity.
That's no good when you're paying someone to
interpret it and give advice.
If your managed service can be replaced by changing the default
alert threshold on the EDR platform, then your service isn't really worth anything at all!
Finally, we come to XDR: Extended Detection and Response.
Yes, I know the word "extended" doesn't
start with an "X", but any marketing person will tell you that adding an X to your product's name
automatically makes it better.
More X's mean more better, plus E was already taken.
EDR solutions,
as the name implies, are focused on endpoints.
XDR solutions integrate data from other systems
as well.
If you've got an EDR solution that stores and analyses activity from your endpoints,
why not also have it pull in logs from other sources as well, like your firewall, and analyse
those too?
That's the premise of XDR. It gives you expanded visibility over more of your estate,
and could be considered as an evolution of EDR, or EDR+.
If you detect malicious actions that are
communicating with an external party then as well as isolating that endpoint like EDR, XDR might
also be able to add a firewall rule to block communication with a suspicious IP address.
Where the lines start getting really blurry is when you include four-letter acronyms as well
and throw SIEM and SOAR into the mix.
SIEM stands for Security Information
and Event Management.
SOAR stands for Security Orchestration, Automation, and Response.
These sound like they overlap with XDR and…
well they do.
SIEM is a platform that ingests all of your
security data from various corners of your network.
It stores it for compliance needs, and to assist
threat hunting and investigations.
It combines data from various sources and correlates it to
spot suspicious activity.
The heart of a SIEM solution is a big data and analytics engine
which can be used to apply intelligence to security information and help sift through it.
Traditional SIEM provides a single source for your security data and provides actionable
intelligence, but doesn't provide any kind of automated remediation.
That's where SOAR comes in.
SOAR is used to automate functions within a Security Operations Center or SOC.
It can speed
up common tasks and it can be combined with SIEM to automate remediation responses to security
events.
If this is starting to sound similar to XDR, it's because it is.
XDR in some ways
does the same sort of thing as both SIEM and SOAR, but in a single platform that also incorporates
EDR.
That's not to say it's a full replacement for SIEM or SOAR.
XDR is not as comprehensive as
either of these tools would traditionally be.
XDR is more focused on endpoints.
Its data
ingestion and analytics won't be as all-encompassing and powerful as a proper SIEM tool,
and its orchestration capabilities will be rather limited compared to SOAR;
but it's also going to be a heck of a lot cheaper as well!
SIEM and SOAR tools have a reputation for
massively expensive.
They not only tend to command huge licensing fees,
but they're so complex they often require a considerable spend on professional services
to get them tuned correctly for your environment.
XDR might not be as capable as these full-fat
solutions, but it fills a very important gap in the market.
In the past you had the massively
expensive enterprise end of things where companies could afford to invest large sums of money in
SIEM and SOAR;
but if you were a typical company who couldn't afford this level of spend then you
were left with a bunch of disconnected systems, all with their own alerts and no overarching
view of what was happening across the estate.
There wasn't much of a mid-range option,
let alone low-end.
More cost-effective SIEM solutions have sprung up in recent years
as the technologies required to build them have become more accessible to normal IT budgets,
largely thanks to the likes of Elasticsearch and its derivatives, but they've not gained a huge
amount of traction with your average company.
This underserviced mid-range is where XDR fits.
Maybe you don't need full-blown SIEM and SOAR.
Maybe a less complicated solution that concentrates
the most common touchpoints in your network and integrates some useful mitigation actions
at a less-than-stratospheric price is exactly what you need.
I think of XDR as EDR, plus SIEM Lite,
plus SOAR Lite.
It's a step up from EDR into something more comprehensive.
Depending on your
needs it might not satisfy your compliance agenda,
or it may not integrate with all of your systems,
and you may need full SIEM and SOAR; but for most organisations it offers much more
compelling value.
If you're still confused about where the line between XDR and SIEM lies that's because
there isn't really a firm line.
In fact, those budget-friendly SIEM tools I mentioned: the OSSIM,
AlienVault, Wazuh, and Elastic Security types of solution? Depending on which way the marketing
wind blows and who's writing the article, they now sometimes refer to themselves as SIEM and
sometimes as XDR.
The lines that divide these terms are becoming increasingly blurred as they
eat into each other's market share and features.
As with EDR, you can get XDR in fully-managed form.
I've seen the acronym MXDR starting to appear, though some places might just call it MDR still,
and others call it managed security or managed SOC.
At the end of the day, vendors will jump
aboard whatever term they think is trending that particular month; so just because they don't list
MDR or MXDR as a service doesn't mean they don't offer it under a different name.
If I were to
arrange this into some kind of tiering system: we'd have antivirus at the bottom, which isn't really
good enough anymore, then we'd have EDR as what I now consider the minimum acceptable standard for
a company to be using.
Really, I mean EDR plus antivirus here, but many EDR solutions integrate
the antivirus as well.
If you want someone to manage it for you, it may be called MDR.
Your next upgrade is XDR, which pulls in data from sources other than endpoints and gives you greater
visibility of your estate.
Again, you can manage it yourself or get someone else to do it for you
under one of many different acronyms.
Finally, if your needs are truly complex you might need to
combine EDR with SIEM and SOAR, but expect to pay for the privilege.
Over time, we'll likely see
XDR continue to eat SIEM's lunch as the solutions grow more capable, and we'll also continue to see
SIEM tools integrate their own automation and EDR capabilities to compete, leading to even more
blurring of the lines.
If you're still with me, good job of making it this far!
Please hit the
like button, share, and subscribe. It helps more people to see the video.
One thing I didn't mention
is that some of these tools also have integrated vulnerability detection, but there's no need to
spend XDR money for that as I compare the two best free options in the market for you right here.
I think free is a price all of us can get behind!