尊敬的 微信汇率：1円 ≈ 0.046166 元 支付宝汇率：1円 ≈ 0.046257元 [退出登录]
SlideShare a Scribd company logo

Extended Detection and Response (XDR) An Overhyped Product Category With Ultimate Security Potential

•
•
Raffael Marty
Raffael Marty

Extended Detection and Response, or XDR for short, is one of the acronyms that are increasingly used by cybersecurity vendors to explain their approach to solving the cyber security problem. We have been spending trillions of dollars on approaches to secure our systems and data, with what success? Cybersecurity is still one of the biggest and most challenging areas that companies, small and large, are dealing with. XDR is another approach driven by security vendors to solve this problem. The challenge is that every vendor defines XDR slightly differently and makes it fit their own “challenge du jour” for marketing and selling their products. In this presentation we will demystify the XDR acronym and put a working model behind it. Together, we will explore why XDR is a fabulous concept, but also discover that it’s nothing revolutionarily new. With an MSP lens, we will explore what the XDR benefits are for small and medium businesses and what it means to the security strategy of both MSPs and their clients. The audience will leave with a clear understanding of what XDR is, how the technology matters to them, and how XDR will ultimately help them secure their customers and enable trusted commerce.

Internet
1 of 19
Download to read offline
Extended Detection and Response (XDR) An Overhyped Product Category With Ultimate Security Potential R a f f a e l M a r t y G e n e r a l M a n a g e r C y b e r s e c u r i t y, C o n n e c t W i s e 3/ 3 1 / 2 2
Raffael Marty General Manager Cybersecurity @ ConnectWise Professional: • Based in Austin, TX • General Manager Cybersecurity @ ConnectWise • Chief Research and Intelligence Officer @ Forcepoint • Head of Security Analytics @ Sophos • Founder @ Loggly – the first logging as a service platform • Chief Security Strategist @ Splunk • Head of Content @ ArcSight Other: • Investor and Advisory • LED Tinkerer • Zen Student
• What You Should Know About XDR • The Cybersecurity Challenge • The Cyber Defense Matrix • The MSP Product Landscape • What’s XDR? • What does XDR mean for MSPs? Extended Detection and Response (XDR)
• There is too much hype around XDR • Extended Detection and Response (XDR) is here to stay • No two vendors define XDR the same way • The XDR “concepts” have a lot of potential and you should understand them What You Should Know About XDR
Cybercrime To Cost The World $10.5 Trillion Annually By 2025
Introducing the Cyber Defense Matrix Identify Protect Detect Respond Recover Devices Applications Networks Data Users
Product Categories in the Matrix Identify Protect Detect Respond Recover Devices Asset Mgmt, Vuln Mgmt, Certificate Mgmt AV, EPP, FIM, HIPS, Whitelisting, Patch Mgmt, Email security EPP, UEBA, SIEM EP Response, EP Forensics IR Applications SAST, DAST, SW Asset Mgmt, Fuzzers CASB RASP, WAF, ZT App Access, CASB, SSPM Source Code Compromise, App IDS, SIEM,CASB, SSPM SSPM IR Networks Netflow, Network Discovery, Vuln Mgmt FW, IPS, UTM, Microseg, ESG, SWG, SASE, ZTNA, DNS, VPN DDoS Detection, Net Traffic Analysis, UEBA, SIEM, DNS DDoS Response, NW Forensics, SASE IR Data Data Discovery, Classification Encryption, Tokenization, DLP, DRM, DBAM, Email security Dark Web Scanning, Data Behavior Analytics, SIEM DRM, Breach Response Backup Users IAM, Background Chk, MFA Security Awareness Training, MFA Insider Threat, UEBA, SIEM • Not one product covers all areas – one needs multiple solutions to get comprehensive security coverage
Where We Are (SMBs) Identify Protect Detect Respond Recover Devices Excel EDR EDR EDR Applications Networks FW, IPS, VPN IDS Data Encryption Backup Users MFA MFA Security Awareness Training 8 products / solutions Partial Coverage Good Coverage $10T Security Gap
• Based on risk, extend necessary capabilities (leverage an assessment tool) • Implement asset (and application) inventory • Are cloud workloads protected? • Are SaaS applications protected? • Deploy patch management (70% of all breaches happen to unpatched machines) – don’t forget your IoT devices (and your NAS) • Business Email Compromise (BEC) still one of the top attack vectors • Be prepared for the inevitable (Incident Readiness) That’s Not Good Enough
Where SMBs Should Be Identify Protect Detect Respond Recover Devices Asset Inventory (or Vuln Mgmt) EDR Patch Mgmt Email Security EDR Email Security EDR IR Applications Application Inventory (or Vuln Mgmt) CASB, SSPM CASB, SSPM SSPM IR Networks Vulnerability Mgmt FW, IPS, VPN IDS IR Data Encryption Email Security DarkWeb Scanning Backup Users MFA SAT MFA / SSO 15 products / solutions • All operating systems • On-prem, cloud, IoT • On-prem and SaaS • Covering BYOD • Dealing with alert monitoring and false positives • What data? • MFA across all applications (on- prem, cloud, SaaS) New Additions
Further capabilities not covered in the matrix: • Orchestrate remediation and response [includes SOAR] • Conditional access, step up auth, zero trust • Risk-based analytics engine [includes UEBA] • Common policy and workflow engine (enforce across any channel) • Alert triage with enriched alerts and incidents in a single pane of glass • Threat intelligence across channels Shortcomings of the Cyber Defense Matrix ‘coverage’ ‘interplay’
SIEM and MDR Security Information and Event Management (SIEM) • Provides a single console to see across multiple point solutions • Supports other use-cases, such as compliance reporting or assisting in incident response scenarios • No response capability
SIEM and MDR Managed Detection and Response • Outsources ability to stay up to date on latest threats • Running your own SOC is expensive • Provides 24x7 monitoring • Provides basic response • Often lacks full response capability • Generally lacks data and user security
EDR++ SIEM++ A New Concept - What Is XDR? vs Identify Protect Detect Respond Recover Devices Applications Networks Data Users Identify Protect Detect Respond Recover Devices Applications Networks Data Users
The XDR Platform XDR Platform (cloud based) Multi-vendor Product Ecosystem Detection Response Driving Outcomes – The Right Way to Invest in Security • Decreased mean time to detection and response (MTTD and MTTR) • Operationalize manual steps into automated actions • Superior protection and detection (higher accuracy) • Move left of boom • Improve efficacy of entire product ecosystem • Decreased deployment complexity Multi-channel Threat Intelligence Policy
XDR – Intelligence and Orchestration Extended Detection and Response (XDR) • Bi-directional information flow • Automated response and remediation • Central policy • Risk centric • Drive zero trust and left of boom detections vs. Security Information and Event Management (SIEM) • Threat detection use-cases • Threat hunting • Compliance reporting • Event centric • Long term storage • Needs point products to provide data and execute actions • Unfortunately not what you get from XDR vendors today…
Point Products • You need individual products • Find products that cover multiple areas • Get a handle on inventory of devices and applications XDR • Do not let the XDR vendors fool you • If you are just starting out, start with MDR • Find a vendor that has a vision you can understand and matches your path • Plot a path to zero trust data access • Can your XDR provider match your existing processes (e.g., via your RMM)? Process • Find a vendor that meets you where you are and matches your growth strategy (DIY, DWY, DFY) • Work with a vendor that offers products, education, and coaching • Be incident ready and please, have backups Next Steps on Your XDR Journey Identify Protect Detect Respond Recover Devices Applications Networks Data Users
Grow your cybersecurity practice June 6-8, 2022 Gaylord Palms Resort & Convention Center | Orlando theitnation.com/secure Secure TM
Thank You @raffaelmarty connectwise.com/cybersecurity

Recommended

From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
Security Information Event Management - nullhyd
Security Information Event Management - nullhydSecurity Information Event Management - nullhyd
Security Information Event Management - nullhyd
n|u - The Open Security Community
 
SIEM presentation final
SIEM presentation finalSIEM presentation final
SIEM presentation final
Rizwan S
 
SOC and SIEM.pptx
SOC and SIEM.pptxSOC and SIEM.pptx
SOC and SIEM.pptx
SandeshUprety4
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 
SIEM : Security Information and Event Management
SIEM : Security Information and Event Management SIEM : Security Information and Event Management
SIEM : Security Information and Event Management
SHRIYARAI4
 
Dragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations Center
Dragos, Inc.
 
SOAR and SIEM.pptx
SOAR and SIEM.pptxSOAR and SIEM.pptx
SOAR and SIEM.pptx
Ajit Wadhawan
 

Recommended

From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
Security Information Event Management - nullhyd
Security Information Event Management - nullhydSecurity Information Event Management - nullhyd
Security Information Event Management - nullhyd
n|u - The Open Security Community
 
SIEM presentation final
SIEM presentation finalSIEM presentation final
SIEM presentation final
Rizwan S
 
SOC and SIEM.pptx
SOC and SIEM.pptxSOC and SIEM.pptx
SOC and SIEM.pptx
SandeshUprety4
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 
SIEM : Security Information and Event Management
SIEM : Security Information and Event Management SIEM : Security Information and Event Management
SIEM : Security Information and Event Management
SHRIYARAI4
 
Dragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations Center
Dragos, Inc.
 
SOAR and SIEM.pptx
SOAR and SIEM.pptxSOAR and SIEM.pptx
SOAR and SIEM.pptx
Ajit Wadhawan
 
SIEM - Activating Defense through Response by Ankur Vats
SIEM - Activating Defense through Response by Ankur VatsSIEM - Activating Defense through Response by Ankur Vats
SIEM - Activating Defense through Response by Ankur Vats
OWASP Delhi
 
SIEM Architecture
SIEM ArchitectureSIEM Architecture
SIEM Architecture
Nishanth Kumar Pathi
 
SIEM - Your Complete IT Security Arsenal
SIEM - Your Complete IT Security ArsenalSIEM - Your Complete IT Security Arsenal
SIEM - Your Complete IT Security Arsenal
ManageEngine EventLog Analyzer
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
SIEM Primer:
SIEM Primer:SIEM Primer:
SIEM Primer:
Anton Chuvakin
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
Priyanka Aash
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is on
Justin Henderson
 
SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)
Osama Ellahi
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadar
Virginia Fernandez
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
hashnees
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
mohamed nasri
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
NIST Zero Trust Explained
NIST Zero Trust ExplainedNIST Zero Trust Explained
NIST Zero Trust Explained
rtp2009
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
k33a
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)
PECB
 
Threat Intelligence & Threat research Sources
Threat Intelligence & Threat research SourcesThreat Intelligence & Threat research Sources
Threat Intelligence & Threat research Sources
LearningwithRayYT
 
What is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the BasicsWhat is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the Basics
Sagar Joshi
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
Soc
SocSoc
Soc
Mukesh Chaudhari
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
Steve Lodin
 
seqrite-mssp-portal-datasheet.pdf
seqrite-mssp-portal-datasheet.pdfseqrite-mssp-portal-datasheet.pdf
seqrite-mssp-portal-datasheet.pdf
seqriteseo
 
Chap 6 cloud security
Chap 6 cloud securityChap 6 cloud security
Chap 6 cloud security
Raj Sarode
 

More Related Content

What's hot

SIEM - Activating Defense through Response by Ankur Vats
SIEM - Activating Defense through Response by Ankur VatsSIEM - Activating Defense through Response by Ankur Vats
SIEM - Activating Defense through Response by Ankur Vats
OWASP Delhi
 
SIEM Architecture
SIEM ArchitectureSIEM Architecture
SIEM Architecture
Nishanth Kumar Pathi
 
SIEM - Your Complete IT Security Arsenal
SIEM - Your Complete IT Security ArsenalSIEM - Your Complete IT Security Arsenal
SIEM - Your Complete IT Security Arsenal
ManageEngine EventLog Analyzer
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
SIEM Primer:
SIEM Primer:SIEM Primer:
SIEM Primer:
Anton Chuvakin
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
Priyanka Aash
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is on
Justin Henderson
 
SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)
Osama Ellahi
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadar
Virginia Fernandez
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
hashnees
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
mohamed nasri
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
NIST Zero Trust Explained
NIST Zero Trust ExplainedNIST Zero Trust Explained
NIST Zero Trust Explained
rtp2009
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
k33a
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)
PECB
 
Threat Intelligence & Threat research Sources
Threat Intelligence & Threat research SourcesThreat Intelligence & Threat research Sources
Threat Intelligence & Threat research Sources
LearningwithRayYT
 
What is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the BasicsWhat is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the Basics
Sagar Joshi
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
Soc
SocSoc
Soc
Mukesh Chaudhari
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
Steve Lodin
 

What's hot (20)

SIEM - Activating Defense through Response by Ankur Vats
SIEM - Activating Defense through Response by Ankur VatsSIEM - Activating Defense through Response by Ankur Vats
SIEM - Activating Defense through Response by Ankur Vats
 
SIEM Architecture
SIEM ArchitectureSIEM Architecture
SIEM Architecture
 
SIEM - Your Complete IT Security Arsenal
SIEM - Your Complete IT Security ArsenalSIEM - Your Complete IT Security Arsenal
SIEM - Your Complete IT Security Arsenal
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
 
SIEM Primer:
SIEM Primer:SIEM Primer:
SIEM Primer:
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is on
 
SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management)
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadar
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
 
NIST Zero Trust Explained
NIST Zero Trust ExplainedNIST Zero Trust Explained
NIST Zero Trust Explained
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)
 
Threat Intelligence & Threat research Sources
Threat Intelligence & Threat research SourcesThreat Intelligence & Threat research Sources
Threat Intelligence & Threat research Sources
 
What is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the BasicsWhat is SIEM? A Brilliant Guide to the Basics
What is SIEM? A Brilliant Guide to the Basics
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
 
Soc
SocSoc
Soc
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
 

Similar to Extended Detection and Response (XDR) An Overhyped Product Category With Ultimate Security Potential

seqrite-mssp-portal-datasheet.pdf
seqrite-mssp-portal-datasheet.pdfseqrite-mssp-portal-datasheet.pdf
seqrite-mssp-portal-datasheet.pdf
seqriteseo
 
Chap 6 cloud security
Chap 6 cloud securityChap 6 cloud security
Chap 6 cloud security
Raj Sarode
 
Managed Security Operations Centre Alternative - Managed Security Service
Managed Security Operations Centre Alternative - Managed Security Service Managed Security Operations Centre Alternative - Managed Security Service
Managed Security Operations Centre Alternative - Managed Security Service
Netpluz Asia Pte Ltd
 
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Mark Simos
 
ciso-platform-annual-summit-2013-Hp enterprise security overview
ciso-platform-annual-summit-2013-Hp enterprise security overviewciso-platform-annual-summit-2013-Hp enterprise security overview
ciso-platform-annual-summit-2013-Hp enterprise security overview
Priyanka Aash
 
Micro Focus SRG Solution Mapping to the New BDDK Regulations for Turkish Fina...
Micro Focus SRG Solution Mapping to the New BDDK Regulations for Turkish Fina...Micro Focus SRG Solution Mapping to the New BDDK Regulations for Turkish Fina...
Micro Focus SRG Solution Mapping to the New BDDK Regulations for Turkish Fina...
Emrah Alpa, CISSP CEH CCSK
 
QRadar-XDR-Solution.pdf
QRadar-XDR-Solution.pdfQRadar-XDR-Solution.pdf
QRadar-XDR-Solution.pdf
ssuserf5beb3
 
Protecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomwareProtecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomware
Cloudera, Inc.
 
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP'sAlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault
 
TIG / Infocyte: Proactive Cybersecurity for State and Local Government
TIG / Infocyte: Proactive Cybersecurity for State and Local GovernmentTIG / Infocyte: Proactive Cybersecurity for State and Local Government
TIG / Infocyte: Proactive Cybersecurity for State and Local Government
Infocyte
 
Daniel Grabski | Microsofts cybersecurity story
Daniel Grabski | Microsofts cybersecurity storyDaniel Grabski | Microsofts cybersecurity story
Daniel Grabski | Microsofts cybersecurity story
Microsoft Österreich
 
Microsoft Sentinel- a cloud native SIEM & SOAR.pdf
Microsoft Sentinel- a cloud native SIEM & SOAR.pdfMicrosoft Sentinel- a cloud native SIEM & SOAR.pdf
Microsoft Sentinel- a cloud native SIEM & SOAR.pdf
Kranthi Aragonda
 
Azure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and complianceAzure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and compliance
Asaf Nakash
 
Cyber Security Needs and Challenges
Cyber Security Needs and ChallengesCyber Security Needs and Challenges
Cyber Security Needs and Challenges
Happiest Minds Technologies
 
Cyber Security protection by MultiPoint Ltd.
Cyber Security protection by MultiPoint Ltd.Cyber Security protection by MultiPoint Ltd.
Cyber Security protection by MultiPoint Ltd.
Ricardo Resnik
 
Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05
Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05 Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05
Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05
sucesuminas
 
Crush Cloud Complexity, Simplify Security - Shield X
Crush Cloud Complexity, Simplify Security - Shield XCrush Cloud Complexity, Simplify Security - Shield X
Crush Cloud Complexity, Simplify Security - Shield X
Prime Infoserv
 
BATbern48_How Zero Trust can help your organisation keep safe.pdf
BATbern48_How Zero Trust can help your organisation keep safe.pdfBATbern48_How Zero Trust can help your organisation keep safe.pdf
BATbern48_How Zero Trust can help your organisation keep safe.pdf
BATbern
 
XG Firewall
XG FirewallXG Firewall
XG Firewall
DeServ - Tecnologia e Servços
 
Cyber Security in the market place: HP CTO Day
Cyber Security in the market place: HP CTO DayCyber Security in the market place: HP CTO Day
Cyber Security in the market place: HP CTO Day
Symantec
 

Similar to Extended Detection and Response (XDR) An Overhyped Product Category With Ultimate Security Potential (20)

seqrite-mssp-portal-datasheet.pdf
seqrite-mssp-portal-datasheet.pdfseqrite-mssp-portal-datasheet.pdf
seqrite-mssp-portal-datasheet.pdf
 
Chap 6 cloud security
Chap 6 cloud securityChap 6 cloud security
Chap 6 cloud security
 
Managed Security Operations Centre Alternative - Managed Security Service
Managed Security Operations Centre Alternative - Managed Security Service Managed Security Operations Centre Alternative - Managed Security Service
Managed Security Operations Centre Alternative - Managed Security Service
 
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
 
ciso-platform-annual-summit-2013-Hp enterprise security overview
ciso-platform-annual-summit-2013-Hp enterprise security overviewciso-platform-annual-summit-2013-Hp enterprise security overview
ciso-platform-annual-summit-2013-Hp enterprise security overview
 
Micro Focus SRG Solution Mapping to the New BDDK Regulations for Turkish Fina...
Micro Focus SRG Solution Mapping to the New BDDK Regulations for Turkish Fina...Micro Focus SRG Solution Mapping to the New BDDK Regulations for Turkish Fina...
Micro Focus SRG Solution Mapping to the New BDDK Regulations for Turkish Fina...
 
QRadar-XDR-Solution.pdf
QRadar-XDR-Solution.pdfQRadar-XDR-Solution.pdf
QRadar-XDR-Solution.pdf
 
Protecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomwareProtecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomware
 
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP'sAlienVault MSSP Overview - A Different Approach to Security for MSSP's
AlienVault MSSP Overview - A Different Approach to Security for MSSP's
 
TIG / Infocyte: Proactive Cybersecurity for State and Local Government
TIG / Infocyte: Proactive Cybersecurity for State and Local GovernmentTIG / Infocyte: Proactive Cybersecurity for State and Local Government
TIG / Infocyte: Proactive Cybersecurity for State and Local Government
 
Daniel Grabski | Microsofts cybersecurity story
Daniel Grabski | Microsofts cybersecurity storyDaniel Grabski | Microsofts cybersecurity story
Daniel Grabski | Microsofts cybersecurity story
 
Microsoft Sentinel- a cloud native SIEM & SOAR.pdf
Microsoft Sentinel- a cloud native SIEM & SOAR.pdfMicrosoft Sentinel- a cloud native SIEM & SOAR.pdf
Microsoft Sentinel- a cloud native SIEM & SOAR.pdf
 
Azure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and complianceAzure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and compliance
 
Cyber Security Needs and Challenges
Cyber Security Needs and ChallengesCyber Security Needs and Challenges
Cyber Security Needs and Challenges
 
Cyber Security protection by MultiPoint Ltd.
Cyber Security protection by MultiPoint Ltd.Cyber Security protection by MultiPoint Ltd.
Cyber Security protection by MultiPoint Ltd.
 
Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05
Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05 Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05
Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05
 
Crush Cloud Complexity, Simplify Security - Shield X
Crush Cloud Complexity, Simplify Security - Shield XCrush Cloud Complexity, Simplify Security - Shield X
Crush Cloud Complexity, Simplify Security - Shield X
 
BATbern48_How Zero Trust can help your organisation keep safe.pdf
BATbern48_How Zero Trust can help your organisation keep safe.pdfBATbern48_How Zero Trust can help your organisation keep safe.pdf
BATbern48_How Zero Trust can help your organisation keep safe.pdf
 
XG Firewall
XG FirewallXG Firewall
XG Firewall
 
Cyber Security in the market place: HP CTO Day
Cyber Security in the market place: HP CTO DayCyber Security in the market place: HP CTO Day
Cyber Security in the market place: HP CTO Day
 

More from Raffael Marty

Exploring the Defender's Advantage
Exploring the Defender's AdvantageExploring the Defender's Advantage
Exploring the Defender's Advantage
Raffael Marty
 
How To Drive Value with Security Data
How To Drive Value with Security DataHow To Drive Value with Security Data
How To Drive Value with Security Data
Raffael Marty
 
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Raffael Marty
 
Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?
Raffael Marty
 
Understanding the "Intelligence" in AI
Understanding the "Intelligence" in AIUnderstanding the "Intelligence" in AI
Understanding the "Intelligence" in AI
Raffael Marty
 
Security Chat 5.0
Security Chat 5.0Security Chat 5.0
Security Chat 5.0
Raffael Marty
 
AI & ML in Cyber Security - Why Algorithms are Dangerous
AI & ML in Cyber Security - Why Algorithms are DangerousAI & ML in Cyber Security - Why Algorithms are Dangerous
AI & ML in Cyber Security - Why Algorithms are Dangerous
Raffael Marty
 
AI & ML in Cyber Security - Why Algorithms Are Dangerous
AI & ML in Cyber Security - Why Algorithms Are DangerousAI & ML in Cyber Security - Why Algorithms Are Dangerous
AI & ML in Cyber Security - Why Algorithms Are Dangerous
Raffael Marty
 
Delivering Security Insights with Data Analytics and Visualization
Delivering Security Insights with Data Analytics and VisualizationDelivering Security Insights with Data Analytics and Visualization
Delivering Security Insights with Data Analytics and Visualization
Raffael Marty
 
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't ChangedAI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
Raffael Marty
 
Security Insights at Scale
Security Insights at ScaleSecurity Insights at Scale
Security Insights at Scale
Raffael Marty
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
Raffael Marty
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
Raffael Marty
 
Visualization in the Age of Big Data
Visualization in the Age of Big DataVisualization in the Age of Big Data
Visualization in the Age of Big Data
Raffael Marty
 
Big Data Visualization
Big Data VisualizationBig Data Visualization
Big Data Visualization
Raffael Marty
 
The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?
Raffael Marty
 
Workshop: Big Data Visualization for Security
Workshop: Big Data Visualization for SecurityWorkshop: Big Data Visualization for Security
Workshop: Big Data Visualization for Security
Raffael Marty
 
Visualization for Security
Visualization for SecurityVisualization for Security
Visualization for Security
Raffael Marty
 
The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?
Raffael Marty
 
DAVIX - Data Analysis and Visualization Linux
DAVIX - Data Analysis and Visualization LinuxDAVIX - Data Analysis and Visualization Linux
DAVIX - Data Analysis and Visualization Linux
Raffael Marty
 

More from Raffael Marty (20)

Exploring the Defender's Advantage
Exploring the Defender's AdvantageExploring the Defender's Advantage
Exploring the Defender's Advantage
 
How To Drive Value with Security Data
How To Drive Value with Security DataHow To Drive Value with Security Data
How To Drive Value with Security Data
 
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
 
Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?
 
Understanding the "Intelligence" in AI
Understanding the "Intelligence" in AIUnderstanding the "Intelligence" in AI
Understanding the "Intelligence" in AI
 
Security Chat 5.0
Security Chat 5.0Security Chat 5.0
Security Chat 5.0
 
AI & ML in Cyber Security - Why Algorithms are Dangerous
AI & ML in Cyber Security - Why Algorithms are DangerousAI & ML in Cyber Security - Why Algorithms are Dangerous
AI & ML in Cyber Security - Why Algorithms are Dangerous
 
AI & ML in Cyber Security - Why Algorithms Are Dangerous
AI & ML in Cyber Security - Why Algorithms Are DangerousAI & ML in Cyber Security - Why Algorithms Are Dangerous
AI & ML in Cyber Security - Why Algorithms Are Dangerous
 
Delivering Security Insights with Data Analytics and Visualization
Delivering Security Insights with Data Analytics and VisualizationDelivering Security Insights with Data Analytics and Visualization
Delivering Security Insights with Data Analytics and Visualization
 
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't ChangedAI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't Changed
 
Security Insights at Scale
Security Insights at ScaleSecurity Insights at Scale
Security Insights at Scale
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
 
Visualization in the Age of Big Data
Visualization in the Age of Big DataVisualization in the Age of Big Data
Visualization in the Age of Big Data
 
Big Data Visualization
Big Data VisualizationBig Data Visualization
Big Data Visualization
 
The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?
 
Workshop: Big Data Visualization for Security
Workshop: Big Data Visualization for SecurityWorkshop: Big Data Visualization for Security
Workshop: Big Data Visualization for Security
 
Visualization for Security
Visualization for SecurityVisualization for Security
Visualization for Security
 
The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?The Heatmap
 - Why is Security Visualization so Hard?
The Heatmap
 - Why is Security Visualization so Hard?
 
DAVIX - Data Analysis and Visualization Linux
DAVIX - Data Analysis and Visualization LinuxDAVIX - Data Analysis and Visualization Linux
DAVIX - Data Analysis and Visualization Linux
 

Recently uploaded

Call Girls In Chennai 💯Call Us 🔝 8824825030 🔝Independent Chennai Escorts Serv...
Call Girls In Chennai 💯Call Us 🔝 8824825030 🔝Independent Chennai Escorts Serv...Call Girls In Chennai 💯Call Us 🔝 8824825030 🔝Independent Chennai Escorts Serv...
Call Girls In Chennai 💯Call Us 🔝 8824825030 🔝Independent Chennai Escorts Serv...
payalgupta2u
 
Top 10 Digital Marketing Trends in 2024 You Should Know
Top 10 Digital Marketing Trends in 2024 You Should KnowTop 10 Digital Marketing Trends in 2024 You Should Know
Top 10 Digital Marketing Trends in 2024 You Should Know
Markonik
 
Unlimited Short Call Girls Navi Mumbai ✅ 9967824496 FULL CASH PAYMENT
Unlimited Short Call Girls Navi Mumbai ✅ 9967824496 FULL CASH PAYMENTUnlimited Short Call Girls Navi Mumbai ✅ 9967824496 FULL CASH PAYMENT
Unlimited Short Call Girls Navi Mumbai ✅ 9967824496 FULL CASH PAYMENT
rajesh344555
 
KubeCon & CloudNative Con 2024 Artificial Intelligent
KubeCon & CloudNative Con 2024 Artificial IntelligentKubeCon & CloudNative Con 2024 Artificial Intelligent
KubeCon & CloudNative Con 2024 Artificial Intelligent
Emre Gündoğdu
 
Call Girls Dehradun 8824825030 Escort In Dehradun service 24X7
Call Girls Dehradun 8824825030 Escort In Dehradun service 24X7Call Girls Dehradun 8824825030 Escort In Dehradun service 24X7
Call Girls Dehradun 8824825030 Escort In Dehradun service 24X7
manalishivani8
 
Network Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. IT
Network Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. ITNetwork Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. IT
Network Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. IT
Sarthak Sobti
 
HistorySrSec2024 daahi sadhin sgg-25.pdf
HistorySrSec2024 daahi sadhin sgg-25.pdfHistorySrSec2024 daahi sadhin sgg-25.pdf
HistorySrSec2024 daahi sadhin sgg-25.pdf
AdiySgh
 
Cyber Crime with basics and knowledge to cyber sphere
Cyber Crime with basics and knowledge to cyber sphereCyber Crime with basics and knowledge to cyber sphere
Cyber Crime with basics and knowledge to cyber sphere
RISHIKCHAUDHARY2
 
Tesla Humanoid Robot - PPT in 11 Simple Slide
Tesla Humanoid Robot - PPT in 11 Simple SlideTesla Humanoid Robot - PPT in 11 Simple Slide
Tesla Humanoid Robot - PPT in 11 Simple Slide
abzjkr
 
Measuring and Understanding the Route Origin Validation (ROV) in RPKI
Measuring and Understanding the Route Origin Validation (ROV) in RPKIMeasuring and Understanding the Route Origin Validation (ROV) in RPKI
Measuring and Understanding the Route Origin Validation (ROV) in RPKI
APNIC
 
VVIP Call Girls Kolkata💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Se...
VVIP Call Girls Kolkata💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Se...VVIP Call Girls Kolkata💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Se...
VVIP Call Girls Kolkata💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Se...
graggunno
 
Powai Call Girls ☑ +91-9920725232 ☑ Available Hot Girls Aunty Book Now
Powai Call Girls ☑ +91-9920725232 ☑ Available Hot Girls Aunty Book NowPowai Call Girls ☑ +91-9920725232 ☑ Available Hot Girls Aunty Book Now
Powai Call Girls ☑ +91-9920725232 ☑ Available Hot Girls Aunty Book Now
reddyaditi530
 
Nashik Call Girls 💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Service
Nashik Call Girls 💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort ServiceNashik Call Girls 💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Service
Nashik Call Girls 💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Service
sabanasarkari36
 
一比一原版圣托马斯大学毕业证(UST毕业证书)学历如何办理
一比一原版圣托马斯大学毕业证(UST毕业证书)学历如何办理一比一原版圣托马斯大学毕业证(UST毕业证书)学历如何办理
一比一原版圣托马斯大学毕业证(UST毕业证书)学历如何办理
uqbyfm
 
Seizing the IPv6 Advantage: For a Bigger, Faster and Stronger Internet
Seizing the IPv6 Advantage: For a Bigger, Faster and Stronger InternetSeizing the IPv6 Advantage: For a Bigger, Faster and Stronger Internet
Seizing the IPv6 Advantage: For a Bigger, Faster and Stronger Internet
APNIC
 
Call Girls In Mahipalpur 🔥 +91-9711199012🔥High Profile Call Girl Mahipalpur
Call Girls In Mahipalpur 🔥 +91-9711199012🔥High Profile Call Girl MahipalpurCall Girls In Mahipalpur 🔥 +91-9711199012🔥High Profile Call Girl Mahipalpur
Call Girls In Mahipalpur 🔥 +91-9711199012🔥High Profile Call Girl Mahipalpur
alisha panday
 
Bangalore Call Girls 9079923931 With -Cuties' Hot Call Girls
Bangalore Call Girls 9079923931 With -Cuties' Hot Call GirlsBangalore Call Girls 9079923931 With -Cuties' Hot Call Girls
Bangalore Call Girls 9079923931 With -Cuties' Hot Call Girls
narwatsonia7
 
Call Girls Vijayawada 7742996321 Vijayawada Escorts Service
Call Girls Vijayawada 7742996321 Vijayawada Escorts ServiceCall Girls Vijayawada 7742996321 Vijayawada Escorts Service
Call Girls Vijayawada 7742996321 Vijayawada Escorts Service
huse9823
 
Enhancing Security with Multi-Factor Authentication in Privileged Access Mana...
Enhancing Security with Multi-Factor Authentication in Privileged Access Mana...Enhancing Security with Multi-Factor Authentication in Privileged Access Mana...
Enhancing Security with Multi-Factor Authentication in Privileged Access Mana...
Bert Blevins
 
10 Conversion Rate Optimization (CRO) Techniques to Boost Your Website’s Perf...
10 Conversion Rate Optimization (CRO) Techniques to Boost Your Website’s Perf...10 Conversion Rate Optimization (CRO) Techniques to Boost Your Website’s Perf...
10 Conversion Rate Optimization (CRO) Techniques to Boost Your Website’s Perf...
Web Inspire
 

Recently uploaded (20)

Call Girls In Chennai 💯Call Us 🔝 8824825030 🔝Independent Chennai Escorts Serv...
Call Girls In Chennai 💯Call Us 🔝 8824825030 🔝Independent Chennai Escorts Serv...Call Girls In Chennai 💯Call Us 🔝 8824825030 🔝Independent Chennai Escorts Serv...
Call Girls In Chennai 💯Call Us 🔝 8824825030 🔝Independent Chennai Escorts Serv...
 
Top 10 Digital Marketing Trends in 2024 You Should Know
Top 10 Digital Marketing Trends in 2024 You Should KnowTop 10 Digital Marketing Trends in 2024 You Should Know
Top 10 Digital Marketing Trends in 2024 You Should Know
 
Unlimited Short Call Girls Navi Mumbai ✅ 9967824496 FULL CASH PAYMENT
Unlimited Short Call Girls Navi Mumbai ✅ 9967824496 FULL CASH PAYMENTUnlimited Short Call Girls Navi Mumbai ✅ 9967824496 FULL CASH PAYMENT
Unlimited Short Call Girls Navi Mumbai ✅ 9967824496 FULL CASH PAYMENT
 
KubeCon & CloudNative Con 2024 Artificial Intelligent
KubeCon & CloudNative Con 2024 Artificial IntelligentKubeCon & CloudNative Con 2024 Artificial Intelligent
KubeCon & CloudNative Con 2024 Artificial Intelligent
 
Call Girls Dehradun 8824825030 Escort In Dehradun service 24X7
Call Girls Dehradun 8824825030 Escort In Dehradun service 24X7Call Girls Dehradun 8824825030 Escort In Dehradun service 24X7
Call Girls Dehradun 8824825030 Escort In Dehradun service 24X7
 
Network Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. IT
Network Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. ITNetwork Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. IT
Network Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. IT
 
HistorySrSec2024 daahi sadhin sgg-25.pdf
HistorySrSec2024 daahi sadhin sgg-25.pdfHistorySrSec2024 daahi sadhin sgg-25.pdf
HistorySrSec2024 daahi sadhin sgg-25.pdf
 
Cyber Crime with basics and knowledge to cyber sphere
Cyber Crime with basics and knowledge to cyber sphereCyber Crime with basics and knowledge to cyber sphere
Cyber Crime with basics and knowledge to cyber sphere
 
Tesla Humanoid Robot - PPT in 11 Simple Slide
Tesla Humanoid Robot - PPT in 11 Simple SlideTesla Humanoid Robot - PPT in 11 Simple Slide
Tesla Humanoid Robot - PPT in 11 Simple Slide
 
Measuring and Understanding the Route Origin Validation (ROV) in RPKI
Measuring and Understanding the Route Origin Validation (ROV) in RPKIMeasuring and Understanding the Route Origin Validation (ROV) in RPKI
Measuring and Understanding the Route Origin Validation (ROV) in RPKI
 
VVIP Call Girls Kolkata💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Se...
VVIP Call Girls Kolkata💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Se...VVIP Call Girls Kolkata💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Se...
VVIP Call Girls Kolkata💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Se...
 
Powai Call Girls ☑ +91-9920725232 ☑ Available Hot Girls Aunty Book Now
Powai Call Girls ☑ +91-9920725232 ☑ Available Hot Girls Aunty Book NowPowai Call Girls ☑ +91-9920725232 ☑ Available Hot Girls Aunty Book Now
Powai Call Girls ☑ +91-9920725232 ☑ Available Hot Girls Aunty Book Now
 
Nashik Call Girls 💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Service
Nashik Call Girls 💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort ServiceNashik Call Girls 💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Service
Nashik Call Girls 💯Call Us 🔝 7374876321 🔝 💃 Independent Female Escort Service
 
一比一原版圣托马斯大学毕业证(UST毕业证书)学历如何办理
一比一原版圣托马斯大学毕业证(UST毕业证书)学历如何办理一比一原版圣托马斯大学毕业证(UST毕业证书)学历如何办理
一比一原版圣托马斯大学毕业证(UST毕业证书)学历如何办理
 
Seizing the IPv6 Advantage: For a Bigger, Faster and Stronger Internet
Seizing the IPv6 Advantage: For a Bigger, Faster and Stronger InternetSeizing the IPv6 Advantage: For a Bigger, Faster and Stronger Internet
Seizing the IPv6 Advantage: For a Bigger, Faster and Stronger Internet
 
Call Girls In Mahipalpur 🔥 +91-9711199012🔥High Profile Call Girl Mahipalpur
Call Girls In Mahipalpur 🔥 +91-9711199012🔥High Profile Call Girl MahipalpurCall Girls In Mahipalpur 🔥 +91-9711199012🔥High Profile Call Girl Mahipalpur
Call Girls In Mahipalpur 🔥 +91-9711199012🔥High Profile Call Girl Mahipalpur
 
Bangalore Call Girls 9079923931 With -Cuties' Hot Call Girls
Bangalore Call Girls 9079923931 With -Cuties' Hot Call GirlsBangalore Call Girls 9079923931 With -Cuties' Hot Call Girls
Bangalore Call Girls 9079923931 With -Cuties' Hot Call Girls
 
Call Girls Vijayawada 7742996321 Vijayawada Escorts Service
Call Girls Vijayawada 7742996321 Vijayawada Escorts ServiceCall Girls Vijayawada 7742996321 Vijayawada Escorts Service
Call Girls Vijayawada 7742996321 Vijayawada Escorts Service
 
Enhancing Security with Multi-Factor Authentication in Privileged Access Mana...
Enhancing Security with Multi-Factor Authentication in Privileged Access Mana...Enhancing Security with Multi-Factor Authentication in Privileged Access Mana...
Enhancing Security with Multi-Factor Authentication in Privileged Access Mana...
 
10 Conversion Rate Optimization (CRO) Techniques to Boost Your Website’s Perf...
10 Conversion Rate Optimization (CRO) Techniques to Boost Your Website’s Perf...10 Conversion Rate Optimization (CRO) Techniques to Boost Your Website’s Perf...
10 Conversion Rate Optimization (CRO) Techniques to Boost Your Website’s Perf...
 

Extended Detection and Response (XDR) An Overhyped Product Category With Ultimate Security Potential

  • 1. Extended Detection and Response (XDR) An Overhyped Product Category With Ultimate Security Potential R a f f a e l M a r t y G e n e r a l M a n a g e r C y b e r s e c u r i t y, C o n n e c t W i s e 3/ 3 1 / 2 2
  • 2. Raffael Marty General Manager Cybersecurity @ ConnectWise Professional: • Based in Austin, TX • General Manager Cybersecurity @ ConnectWise • Chief Research and Intelligence Officer @ Forcepoint • Head of Security Analytics @ Sophos • Founder @ Loggly – the first logging as a service platform • Chief Security Strategist @ Splunk • Head of Content @ ArcSight Other: • Investor and Advisory • LED Tinkerer • Zen Student
  • 3. • What You Should Know About XDR • The Cybersecurity Challenge • The Cyber Defense Matrix • The MSP Product Landscape • What’s XDR? • What does XDR mean for MSPs? Extended Detection and Response (XDR)
  • 4. • There is too much hype around XDR • Extended Detection and Response (XDR) is here to stay • No two vendors define XDR the same way • The XDR “concepts” have a lot of potential and you should understand them What You Should Know About XDR
  • 5. Cybercrime To Cost The World $10.5 Trillion Annually By 2025
  • 6. Introducing the Cyber Defense Matrix Identify Protect Detect Respond Recover Devices Applications Networks Data Users
  • 7. Product Categories in the Matrix Identify Protect Detect Respond Recover Devices Asset Mgmt, Vuln Mgmt, Certificate Mgmt AV, EPP, FIM, HIPS, Whitelisting, Patch Mgmt, Email security EPP, UEBA, SIEM EP Response, EP Forensics IR Applications SAST, DAST, SW Asset Mgmt, Fuzzers CASB RASP, WAF, ZT App Access, CASB, SSPM Source Code Compromise, App IDS, SIEM,CASB, SSPM SSPM IR Networks Netflow, Network Discovery, Vuln Mgmt FW, IPS, UTM, Microseg, ESG, SWG, SASE, ZTNA, DNS, VPN DDoS Detection, Net Traffic Analysis, UEBA, SIEM, DNS DDoS Response, NW Forensics, SASE IR Data Data Discovery, Classification Encryption, Tokenization, DLP, DRM, DBAM, Email security Dark Web Scanning, Data Behavior Analytics, SIEM DRM, Breach Response Backup Users IAM, Background Chk, MFA Security Awareness Training, MFA Insider Threat, UEBA, SIEM • Not one product covers all areas – one needs multiple solutions to get comprehensive security coverage
  • 8. Where We Are (SMBs) Identify Protect Detect Respond Recover Devices Excel EDR EDR EDR Applications Networks FW, IPS, VPN IDS Data Encryption Backup Users MFA MFA Security Awareness Training 8 products / solutions Partial Coverage Good Coverage $10T Security Gap
  • 9. • Based on risk, extend necessary capabilities (leverage an assessment tool) • Implement asset (and application) inventory • Are cloud workloads protected? • Are SaaS applications protected? • Deploy patch management (70% of all breaches happen to unpatched machines) – don’t forget your IoT devices (and your NAS) • Business Email Compromise (BEC) still one of the top attack vectors • Be prepared for the inevitable (Incident Readiness) That’s Not Good Enough
  • 10. Where SMBs Should Be Identify Protect Detect Respond Recover Devices Asset Inventory (or Vuln Mgmt) EDR Patch Mgmt Email Security EDR Email Security EDR IR Applications Application Inventory (or Vuln Mgmt) CASB, SSPM CASB, SSPM SSPM IR Networks Vulnerability Mgmt FW, IPS, VPN IDS IR Data Encryption Email Security DarkWeb Scanning Backup Users MFA SAT MFA / SSO 15 products / solutions • All operating systems • On-prem, cloud, IoT • On-prem and SaaS • Covering BYOD • Dealing with alert monitoring and false positives • What data? • MFA across all applications (on- prem, cloud, SaaS) New Additions
  • 11. Further capabilities not covered in the matrix: • Orchestrate remediation and response [includes SOAR] • Conditional access, step up auth, zero trust • Risk-based analytics engine [includes UEBA] • Common policy and workflow engine (enforce across any channel) • Alert triage with enriched alerts and incidents in a single pane of glass • Threat intelligence across channels Shortcomings of the Cyber Defense Matrix ‘coverage’ ‘interplay’
  • 12. SIEM and MDR Security Information and Event Management (SIEM) • Provides a single console to see across multiple point solutions • Supports other use-cases, such as compliance reporting or assisting in incident response scenarios • No response capability
  • 13. SIEM and MDR Managed Detection and Response • Outsources ability to stay up to date on latest threats • Running your own SOC is expensive • Provides 24x7 monitoring • Provides basic response • Often lacks full response capability • Generally lacks data and user security
  • 14. EDR++ SIEM++ A New Concept - What Is XDR? vs Identify Protect Detect Respond Recover Devices Applications Networks Data Users Identify Protect Detect Respond Recover Devices Applications Networks Data Users
  • 15. The XDR Platform XDR Platform (cloud based) Multi-vendor Product Ecosystem Detection Response Driving Outcomes – The Right Way to Invest in Security • Decreased mean time to detection and response (MTTD and MTTR) • Operationalize manual steps into automated actions • Superior protection and detection (higher accuracy) • Move left of boom • Improve efficacy of entire product ecosystem • Decreased deployment complexity Multi-channel Threat Intelligence Policy
  • 16. XDR – Intelligence and Orchestration Extended Detection and Response (XDR) • Bi-directional information flow • Automated response and remediation • Central policy • Risk centric • Drive zero trust and left of boom detections vs. Security Information and Event Management (SIEM) • Threat detection use-cases • Threat hunting • Compliance reporting • Event centric • Long term storage • Needs point products to provide data and execute actions • Unfortunately not what you get from XDR vendors today…
  • 17. Point Products • You need individual products • Find products that cover multiple areas • Get a handle on inventory of devices and applications XDR • Do not let the XDR vendors fool you • If you are just starting out, start with MDR • Find a vendor that has a vision you can understand and matches your path • Plot a path to zero trust data access • Can your XDR provider match your existing processes (e.g., via your RMM)? Process • Find a vendor that meets you where you are and matches your growth strategy (DIY, DWY, DFY) • Work with a vendor that offers products, education, and coaching • Be incident ready and please, have backups Next Steps on Your XDR Journey Identify Protect Detect Respond Recover Devices Applications Networks Data Users
  • 18. Grow your cybersecurity practice June 6-8, 2022 Gaylord Palms Resort & Convention Center | Orlando theitnation.com/secure Secure TM
  翻译：