Why Should Organizations Consider Extended Detection and Response (XDR)?

Why Should Organizations Consider Extended Detection and Response (XDR)?

• 1.
  Why Should Organizations ConsiderExtended Detection and Response (XDR)? Christopher M. Steffen, CISSP, CISA Vice President – Research Enterprise Management Associates (EMA) [email protected] Sponsored by . . .
• 2.
  2 Watch the On-DemandWebinar • Why Should Organizations Consider Extended Detection and Response (XDR)? On-Demand Webinar: https://info.enterprisemanagement.com/extended-detection-and- response-xdr-webinar-ws • Check out upcoming webinars from EMA here: https://www.enterprisemanagement.com/freeResearch
• 3.
  | @ema_research Featured Speaker Chrisbrings over 25 years of industry experience as a noted information security executive, researcher, and presenter, focusing on IT management/leadership, cloud security, and regulatory compliance. He also serves as the co-chair of the zero trust working group for the Cloud Security Alliance (CSA) Chris’s technical career started in the financial services vertical in systems administration for a credit reporting company, eventually building the Network Operations group, as well as the Information Security practice and Technical Compliance practice for the company before leaving as the Principal Technical Architect. He has been the Director of Information for a manufacturing company and the Chief Evangelist for several technical companies, focusing on cloud security and cloud application transformation. He’s also held the position of CIO of a financial services company, overseeing the technology-related functions of the enterprise. Chris currently leads the information security, risk and compliance management practice for Enterprise Management Associates (EMA), a leading industry analyst firm that provides deep insight across the full spectrum of IT and data management technologies. Chris holds several technical certifications, including Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA), and was awarded the Microsoft Most Valuable Professional Award five times for virtualization and Cloud and Data Center Management (CDM). He holds a Bachelor of Arts (Summa Cum Laude) from the Metropolitan State College of Denver. © 2023 Enterprise Management Associates, Inc. 3 Christopher Steffen Vice President - Research Information Security, Risk and Compliance Management Enterprise Management Associates | @ema_research
• 4.
  | @ema_research Sponsors © 2023Enterprise Management Associates, Inc. 4 | @ema_research
• 5.
  Research Methodologies and Demographics
• 6.
  | @ema_research Demographics &Methodology 6 Which of the following best describes your organization's primary industry? Which of the following BEST describes your specific role (IT Related)? 31.9% 17.1% 15.2% 10.0% 4.3% 2.9% 2.4% 2.4% 2.4% 1.9% 1.4% 1.4% 1.0% 1.0% 1.0% 0.5% 0.5% 0.5% 0.5% 0.5% 0.5% 0.5% 0.5% IT Director CIO/CTO IT Manager/Supervisor (or equivalent) VP IT IT Administrator/System Administrator Chief Data Officer CISO/CSO VP Information Security Information Security Director IT Project/Program Manager IT Service Manager/ITSM Team Leader IT Business Analyst Director of IT Audit/Compliance Director of Cloud Computing/Cloud… Programmer/Developer/Engineer Chief Compliance Officer Chief Privacy Officer Director of Architecture IT Director/Manager (other) IT Auditor/Compliance Specialist IT Architect IT Consultant/Integrator Help Desk/IT Support 14.4% 12.3% 11.9% 11.4% 7.2% 4.7% 4.2% 4.2% 4.2% 4.2% 3.4% 3.0% 2.1% 2.1% 1.7% 1.3% 1.3% 1.3% 1.3% 1.3% 1.3% 0.4% 0.4% 0.4% Manufacturing Computer/Technology Services (IaaS, SaaS, MSP, MSSP,… Finance/Financial Services/Banking Computer/Technology Software (mobile app, consumer,… Retail/Wholesale/Distribution Healthcare/Medical/Pharmaceutical Computer/Technology Hardware (devices, chip,… Computer/Technology: Other Professional Services (non-technical) Transportation/Airlines/Trucking/Rail Telecommunications Utilities/Energy Business Services/Consulting Insurance Automotive Ecommerce Education (federal, state & local) Gaming/Digital Entertainment Government (federal, state & local) Oil/Gas/Chemicals Other Aerospace/Defense Nonprofit/Not for Profit Travel/Hospitality/Recreation © 2023 Enterprise Management Associates, Inc.
• 7.
  XDR in theEnterprise 7
• 8.
  | @ema_research © 2023Enterprise Management Associates, Inc. Do you envision an XDR solution or some other security tool/solution replacing your SIEM solution your organization is currently using? 81.1% 18.9% Yes No Is your organization currently using/evaluating an extended detection and response (XDR) solution? 59.7% 26.3% 8.1% 3.8% 2.1% Yes - currently using within our organization Yes - currently evaluating, with funding approved to purchase in the next 3 months Yes - currently evaluating to purchase in the next budget year Yes - soliciting vendors/proof of concept, but no immediate plans to purchase No - not currently using/evaluating
• 9.
  | @ema_research © 2023Enterprise Management Associates, Inc. Which technologies/products do you expect in an XDR platform? 24.1% 20.5% 13.6% 12.6% 9.7% 8.9% 8.5% 2.0% SIEM EDR Email Security Threat Detection NDR ASM SOAR UBA
• 10.
  | @ema_research © 2023Enterprise Management Associates, Inc. What is the primary use case you are looking to solve with XDR? 60.6% 17.8% 6.8% 11.4% 1.7% 1.7% Improve detection of advanced threats Provide automated analyst response Prioritize alert Tool consolidation EDR replacement Alert correlation across tools
• 11.
  | @ema_research © 2023Enterprise Management Associates, Inc. What are the most important orchestration capabilities of an XDR solution? 3.34 3.16 2.95 2.78 2.76 Enrichment Provisioning and deprovisioning Customization (playbooks) Visualizations Collaboration (email, slack, tickets, etc.) What are the most important automation capabilities of an XDR solution? 3.44 3.36 3.04 2.85 2.31 Repetitive Task Reporting Low-code automation Visualization Alert Automation
• 12.
  | @ema_research © 2023Enterprise Management Associates, Inc. Assuming XDR is the evolution of EDR beyond endpoints, which XDR capabilities appeal to you most? 25.5% 21.5% 20.6% 19.0% 13.4% Advanced analytics Simplified visualization of complex attacks Correlation and enrichment of security data from multiple security controls Automated cross-response capabilities Reduction in the number of escalations to higher-skilled security analysts
• 13.
  | @ema_research © 2023Enterprise Management Associates, Inc. When considering the functions and capabilities of an XDR solution, which of the following functions / capabilities are the most important? 8.69 8.66 8.66 8.64 8.62 8.61 8.61 8.61 8.6 8.58 8.55 8.55 Ease of Use / Management Attack understanding/intelligence Automated detection of zero-day attacks Unified Threat Hunting Capabilities Provide Automated Detection of Complex Threats with… Enable More Threat Hunting Imrpove Mean Time to Response (MTTR) Integrate Visibly with Existing Tools and Data Sources Rapid Time to Value / Ease of Deployment Improve Mean Time to Detection (MTTD) End-user Support from Vendor Ingest Multiple Data Sources
• 14.
  Conclusions
• 15.
  | @ema_research Conclusions © 2022Enterprise Management Associates, Inc. XDR solutions are in line to replace underperforming legacy security solutions. But it isn’t always because a solution is underperforming, solution complexity, deployment and maintenance, and resource requirements are important factors. If an XDR solution can easily supplant these solutions and about 1/3 of the annual cost, security leaders are forced to pay attention. . | @ema_research Technology leaders are looking for in a XDR solution mimic the capabilities of the solutions that they are ,looking to replace, namely SIEM and SOAR solutions. XDR takes the core capabilities of SIEM and SOAR solutions and provides those insights in a simple and easy manner to digest. For many organizations, having a simpler and less expensive XDR solution to achieve those same capabilities is likely the right decision. It is not enough to just point out threats and low-level attacks: organizations are looking to their XDR solution to provide advanced insights into the threat landscape.. Organizations looking to evaluate and deploy an XDR solution would do well to make the vendor prove these core capabilities – not just as a point in time, but from a tactical and long-term perspective. Organizations are always updating their security tools and are looking to XDR to help with this process SIEM, SOAR and threat detection are the most important capabilities Ease of use, zero-day threat detection, better reporting attacks, complex analytics, and automated reporting
• 16.
  | @ema_research Conclusions © 2023Enterprise Management Associates, Inc. Extended detection and response, or XDR, is a cybersecurity solution that: • Integrates with existing and future security and operations tools • Provides in-depth insights and reporting to technicians and decisionmakers • Streamlines security operations across users, endpoints, data, networks, cloud resources, applications and other workloads • Applies analytics and automation to detect, analyze, hunt, and mitigate threats. | @ema_research Taking these considerations, functions and capabilities to create a unified definition of “XDR”, EMA proposes the following definition:
• 17.
  | @ema_research Get theReport Learn more and download https://bit.ly/3rLfcaZ © 2022 Enterprise Management Associates, Inc. 17 | @ema_research