In the past few years, significant progress has been made in threat detection programs with the advancement and adoption of security tools like endpoint/EDR, network/NDR, identity/IAM, email, and cloud security tools. But despite the increased expectation from the new tooling, it hasn’t translated to an increased impact from security operations. While organizations now have sources of data indicating a breach, it is often not accessible, or complete, nor is it easily deciphered.
A few trends are causing security to become increasingly complex, hindering the effectiveness of teams tasked to protect organizations. At the core are the attackers with greater skills, tools and opportunities to exploit, forcing security teams to have a greater collective level of expertise to keep pace. The shift to the cloud, accelerated by the pandemic, requires new knowledge for securing cloud workloads. And the growing number of point security solutions, all firing their own alerts, require constant context switches to manage. Analysts need a security decision support system that augments their ability to identify, investigate and comprehend the nature of the attack activity, and clearly understand the appropriate response measures. Let’s look at how Open XDR helps achieve this.
There is no doubt that data is a critical element to the success of security, but the criticality of data is not being served in today’s security models. We need to address the data dependency in a more complete way, improving its coverage and management:
Any form of compromise to these data elements, whether from single-vendor stacks limiting efficacy from data scope or forced data limits from escalating data charges, compromises all downstream security operations activity. The massive investment in tooling and people is undermined by models that fail to prioritize complete approaches to data.
It is only when we have all the data available from across the attack surface, and cross-correlate all activities, that we can effectively expose malicious attack activity. But the purpose needs to shift from more detection and creation of alerts to building a picture of the attack. Existing detection and response programs put heavy emphasis on detection, but can lack an ability to offload activity from analysts and empower them with the knowledge to foster productive investigations.
Extended detection and response is more than a collection of broader data sources, but is a resulting evolution of the analyst’s ability to triage, investigate and understand the impact of the attack. The analyst’s clarity of the incident is what drives effective response: knowing the root cause, affected users and assets, and the timeline of events is a critical link for effective containment. Put another way, Mean Time To Respond (MTTR) can be a false indicator of what we are truly striving for, as we don’t just want to respond faster, we want to do it in an accurate and appropriate way. When we focus on better understanding the attack impact, the appropriate response measures are clear. And for that, the analyst needs visibility and clarity to all the aspects of an incident.
Often when we hear about breaches we are surprised to find out that the indicators and even the alerts existed, but that these were dismissed or overlooked. This is not the fault of the team: it is the result of the systematic failure to spot real incidents. Attackers leverage the plethora of alerts and erase their traces to blend in without being detected, making it challenging for analysts to uncover actual malicious activity. Only systems that can holistically look at all telemetry, and link together low-fidelity, seemingly unrelated indicators, can solve the issue of incidents being overlooked.
This is where the power of Open XDR comes into play. Open XDR drives accelerated and confident response through automated investigations and dynamic cross-correlation of signals.
Hunters' open XDR provides critical capabilities to augment an analyst’s ability to address sophisticated attacks. These include:
At a time when CISO priorities include simplification and reduction of tooling to alleviate budgetary and performance drain, Hunters' open XDR provides the mechanism to tackle underlying gaps and challenges in security operations. The ability to finally digest and process vast amounts of data will not just increase performance but also facilitate improved results with positive outcomes:
When a platform can effectively accelerate analysts’ ability to clearly understand incidents and appropriately act upon them, it fills a major gap in today's security operations workflows. Hunters XDR, with a complete approach to data and automated analytics, puts investigative power back in the analyst's hands.
Explore how this security operations transformation is delivered -