Where we are
In the world of threat detection and response, alert fatigue and tool sprawl are real problems. Security professionals are struggling to manage different tools and control points and still relying on manual processes, which results in security that is fragmented and reactive. Analysts need better visibility and control, more context, and better use of automation so they can cut through the noise and respond to threats faster and more effectively. XDR promises to optimize the security operations center (SOC) by accomplishing all the above.
So, what exactly is XDR?
As previously discussed in an August 4 blog by our team, opinions differ on how to define XDR, or extended detection and response. Is it the evolution of endpoint detection and response? Is it the next generation of SIEM? Is it security analytics? Should it be considered a nascent market, or is it a convergence of existing technologies?
However you define it, what’s clear is that industry leaders are embracing the idea of a more integrated approach to security and rapidly acquiring the technologies they need to augment their XDR capabilities.
There are already several XDR vendors out there, and their capabilities vary widely. So, how do you figure out what solution will work best for you?
At AT&T, we see XDR as the evolution of threat detection and response. It combines telemetry and other data from various sources and leverages data analytics and machine learning to aggregate and continuously analyze this data in order to provide context and enable the rapid and effective detection and mitigation of threats.
Core XDR capabilities
The following capabilities are essential to an XDR:
A single pane of glass
A strong XDR solution functions as a single pane of glass, integrating all the security tools in your environment to give you centralized visibility into your endpoints, cloud environments, SaaS apps, and networks.
Manage tool sprawl and improve productivity
Well-executed XDR solutions eliminate the need to separately monitor and maintain an array of point products. Analysts receive fewer duplicate alerts, which gives them more time to focus on the ones that matter.
Lower total cost of ownership
As security operations become more efficient and as the number of monitoring tools decreases, overall cost of ownership is lowered. A holistic threat detection and response model alleviates the burden of managing multiple tools and greatly reduces the risk of compromise.
At AT&T Cybersecurity, we’re building on our established infrastructure for threat intelligence, data analytics, automation, and integration and introducing managed XDR as a service to give SOC analysts:
- Better threat detection
- Fewer alerts (contextualizing/prioritizing)
- Automated processes
A managed service that lets you keep the tools you have
A vendor-agnostic managed XDR service lets you keep the tools you have in place. At AT&T, we have the infrastructure and the expertise to take the information from your endpoint, your cloud, and your network and bring it all together to give your security teams a clear picture of your threat environment.
AlienApps extend our award-winning USM Anywhere platform’s threat detection and security orchestration capabilities to your security and productivity tools. Our managed service leverages AlienApps to deliver vendor-agnostic integration and response actions across IT and security tools.
What should you know before investing in an XDR?
Will you need to “rip and replace”?
Organizations looking for XDR solutions have two options. They can go with a vendor-agnostic XDR (sometimes referred to as “open” or “hybrid” XDR) where a platform relies on integrations with security tools from different vendors, or they can opt for a single-vendor platform, also known as “closed” or “native” XDR.
Before investing in an XDR platform, find out if the vendor will require you to use their EDR. Will you need to replace your current technology? Will you need to sell your various security teams on a new tool—and then face the costs and challenges (including training), as well as the risks that inevitably accompany such an undertaking, or can the vendor incorporate your current solution into their XDR platform through an API integration?
If you are fine with replacing what you have, find out whether the vendor can facilitate a migration plan. So, for example, if you want to move from one endpoint protection solution to another, will the vendor guide you through the process, helping you prepare a roadmap, execute the plan, and ensure the new solution is working correctly? Note that if the vendor does not provide this guidance, a third-party consulting group can.
Through AlienApps, AT&T provides integrations with a large and mature ecosystem of best-of-breed security solutions. Customers don’t need to replace any tools to gain a better command-and-control infrastructure.
What are your goals?
Which vendor has the capabilities or roadmap that most align with what you need? For many buyers, the goal is to eliminate overlapping capabilities in their stack, which wastes budget and personnel resources. Will the solution you are investigating help you remove overlapping capabilities in your stack and facilitate visibility across your systems, for example, information technology (IT), operational technology (OT), Internet of Things (IoT)? And will it allow you to conduct coordinated incident response?
What environments do you need to secure?
Understanding what you need to secure is key. Do you have visibility into data across your endpoint, network, cloud, edge and OT devices? A managed XDR service gives you access to cybersecurity consultants who can assess your environment to help you understand where your gaps are.
What does the vendor’s roadmap look like?
Vendors are still building out their XDR capabilities. Assess vendor roadmaps to see if they offer clear strategies for how they plan to evolve and differentiate their solutions, including future integrations and/or their ability to integrate at all.
Look at ancillary capabilities
Find out if solutions offer ancillary capabilities; for example, will you be able to easily report against regulatory frameworks such as PCI DSS, FedRAMP, GDPR, HIPAA, and NIST? Will you be able to share reporting with executives or board members, so they have visibility into your organization’s security posture?
A managed service to help mature your security
The power of XDR lies in its ability to combine detection, response, threat analytics, and machine-learning capabilities into a single platform that can ingest and correlate data and telemetry to provide contextual alerts so threats can be quickly detected and mitigated.
But while organizations are accustomed to building and supporting traditional detection and response solutions, maintaining an advanced solution that includes managing big data models takes time and specialized resources. Documenting and managing a repeatable process for incident response can also be challenging. For example, organizations must establish which response actions can be fully automated, which need manual review before countermeasures can be executed, and which require approval at a higher level.
AT&T can help with this. We offer XDR as a managed service so you can leverage our established technology and expertise to continuously monitor your IT assets and quickly detect and effectively respond to true cybersecurity threats.
Contact us to learn more about how we can help your organization drive more efficient security operations through improved threat detection and response.