Page 85 - Cyber Defense eMagazine Annual RSA Edition for 2024

epitomized by Verizon’s 2023 malware threat report, which found endpoint-installed malware was
directly responsible for up to 30% of data breaches.

EDR solutions take an approach that prioritizes endpoint protection within enterprise threats. This
is achieved in a multi-faceted way – first by monitoring and collecting data from endpoints, and then
analyzing this data to detect patterns indicative of attack, and sending relevant alerts to the security
team.

The first step involves telemetry ingestion. By installing agents on each endpoint, the individual
usage patterns of every device are registered and collected. The hundreds of different security-
related events collected include registry modifications, memory access, and network connections.
This is then sent to the central EDR platform for continuous file analysis. Whether on-premises or
cloud-based, the core EDR tool examines each file that interacts with the endpoint. If a sequence
of file actions matches a pre-recognized indicator of attack, the EDR tool will classify the activity as
suspicious and automatically send an alert. By bringing suspicious activity and pushing alerts to the
relevant security analyst, it becomes possible to identify and prevent attacks with far greater
efficiency. Modern EDRs can also initiate automated responses according to predetermined triggers.

What is XDR?

XDR is an evolution from EDR. EDR systems can challenge resource-strapped organizations.
Maintaining an EDR system demands significant investments of time, finances, bandwidth, and
personnel. A more distributed workforce and an increasing array of devices and access locations
cause more visibility gaps, further complicating the detection of advanced threats. XDR focuses the
capabilities of your security system.

XDR integrates threat data from previously isolated security tools – such as EDR – across an
organization’s entire technology infrastructure. This leads to more efficient threat hunting and
response capabilities. An XDR platform gathers security telemetry from endpoints, cloud workloads,
networks, and email systems. XDR provides key contextual insights that help security teams
understand the tactics, techniques, and procedures (TTPs) used by attackers.

Its extended detection offers a comprehensive view of security incidents and streamlines threat
investigation, enhancing the overall effectiveness of cybersecurity teams. See our guide for
successful XDR implementation with your current security framework.

XDR vs EDR

Whereas EDR specifically targets endpoint-level threats, XDR better meets the current needs
landscape. It integrates data from endpoints, network traffic, cloud environments, and emailsystems,

85