The Case for Open XDR

Disconnected point tools create security operations challenges. ESG research indicates that many firms anchor their security operations with an assortment of disconnected point tools, making it difficult to assess security status, detect cyber-attacks, or respond to incidents in a timely manner. These challenges also introduce lots of operational overhead as the security staff must deploy, configure, and operate each security tool.

Organizations are moving toward a tightly coupled security operations infrastructure. Proactive CISOs are moving beyond security point tools toward a security operations and analytics platform architecture (SOAPA). SOAPA is designed to address many technology issues by providing an integrated technology stack for data management, messaging, analysis, and security operations.

XDR may fill the SOAPA role. Recognizing the need for SOAPA, technology vendors are now promoting eXtended detection and response (XDR) tools—integrated platforms of security products spanning hybrid IT architectures, designed to interoperate and coordinate on threat prevention, detection, and response. In this way, XDR can unify control points, security telemetry, analytics, and operations into one enterprise system. Thus, XDR can be seen as a technology platform emulating the SOAPA design.

Enterprise organizations need open XDR. Despite the promise of XDR, many organizations remain reluctant to move forward as they don’t want to embark on costly and complex projects that involve replacing existing security controls and analytics solutions. Open XDR alleviates these issues by acting as an overlay that sits on top of the existing security infrastructure. Open XDR can synthesize the alerts from multiple security controls, act as a common workbench for security operations, monitor/measure security efficacy, and take automated actions for incident response and risk mitigation. Some open XDR systems also provide services for continuous testing and controls validation, creating a closed loop for threat prevention, detection, and risk mitigation.

Increasingly sophisticated threat landscape. Organizations are under attack by an assortment of cyber-criminals, hacktivists, and nation states that use social engineering techniques like spearphishing to compromise systems, move laterally across their networks, create privileged accounts, and steal valuable data. Many organizations find it difficult to monitor cyber-threats; correlate cyber-threat intelligence (CTI) with internal security telemetry; or keep up with the tactics, techniques, and procedures (TTPs) used by cyber-adversaries.

Volume and variety of security data. Aside from threat intelligence, organizations rely upon a variety of other security data sources like system logs, NetFlow/IPFIX data from networks, endpoint telemetry from EDR systems, proxy logs, cloud logs, DNS logs, etc. Collecting, processing, and analyzing volumes of security data can require a highly scalable data pipeline for analyzing real-time and batch data. Unfortunately, many organizations don’t have data pipelining expertise within their security departments, leading to difficulties staying ahead of massive volumes of security telemetry.

Overwhelming amount of security alerts. Over many years, organizations have added multiple security analytics tools as countermeasures for different types of threats. Each individual security system is programmed to issue alerts when it detects anomalous, suspicious, or malicious behavior, often leading to thousands of alerts per day. Given this volume, many security operations teams are overwhelmed as they attempt to triage, prioritize, and investigate alerts that could indicate a damaging cyber-attack in progress.

Growing attack surface. Organizations are regularly moving workloads to public cloud infrastructure, embracing SaaS applications, and deploying IoT devices as part of digital transformation initiatives. To defend against attacks, security teams must be able to discover, monitor, and protect all assets as they connect and disconnect to and from the network. This can be a daunting task as the attack surface grows unabated—especially as it extends to public clouds outside of traditional corporate data centers.

Synthesizes alerts from current controls. Open XDR uses advanced analytics to piece together individual security alerts, uncover real cyber-attacks, piece together the entire attack kill chain, and then provide high-fidelity comprehensive alerts to the SOC team. Applying detection content across tools unifies alerts and investigation-related artifacts abstracting out duplicate alerts and false positives. Armed with kill chain details, open XDR can map alerts to the MITRE ATT&CK framework, helping analysts contextualize attack progress and pinpoint the right remediation actions. .

Acts as a workbench for SOC analysts. SOC analysts often complain about “swivel chair” management as they pivot from tool to tool to detect and respond to security incidents. Open XDR can help alleviate this inefficient process by acting as a centralized workbench for SOC activities like security investigations, security control fine-tuning, threat hunting, etc. This alone should help organizations improve SOC output and productivity.

Monitors and measures security performance. Security programs are complex and multi-faceted, so CISOs need the right visibility and reports to measure where they need to focus their attention. By sitting above existing controls, open XDR can measure which ones are consistently detecting the tactics, techniques, and procedures (TTPs) used by sophisticated adversaries. This information can help CISOs adjust controls, identify security team members who may be overworked or need additional training, or locate ineffective security controls that need replacement. In this way, open XDR can also help CISOs measure ROI on security spending and guide them to areas requiring additional investment. .

Automates investigation and remediation actions. While not a full-function SOAR, Open XDR can be instrumented to take actions based upon the severity and types of synthesized alerts. For example, when a SIEM alert fires, open XDR can recognize the alert type and immediately pull the right EDR, NDR, and threat intelligence data needed for a full security investigation. Automation can also extend to incident response actions like blocking an IP address or file hashes, creating watchlists, or running IOC lookups against multiple technologies to uncover the scope of an attack. Leading open XDR solutions will also provide routines for automated threat hunting based upon the latest threat intelligence on exploits and campaigns. Open XDR can also integrate with existing SOAR platforms to participate in more comprehensive security operations workflows.