Impact of XDR on Cyber Incident Response Times

Incident response is, in many ways, the foundation of modern cybersecurity strategies. Hopefully, your company is not performing manual incident response with a designated person or team that leaps into investigation mode every time the software flags a potential threat. It’s good to have humans on the case, but the mainstreaming of AI and machine learning (ML) technology for cybersecurity has changed the game, for the better.

No matter what type of business you’re in, it’s a universal truism that speed kills – aka efficiency is our North Star. If AI has given us anything, it is speed, freeing up our time to conduct actual revenue generating business. The emergence of Extended Detection and Response (XDR) cybersecurity technology has upped the ante in threat detection efficiencies, surpassing SIEM, Network Detection and Response (NDR), and Endpoint Detection & Response (EDR).

Let’s look under the hood to see why and how XDR enhances the speed and efficiency of responding to incidents.

1. Real-time threat detection with XDR

CISA stated that, “The most challenging aspect of the incident response process is often accurately detecting and assessing cybersecurity incidents.” XDR technology not only detects threats accurately, but also keeps it real (-time). Swift incident response is made even faster by swift threat detection. XDR collects and transmits telemetry data from across your organization's security infrastructure about the performance and behavior of your company's devices, networks, and applications – all in one place. XDR doesn’t leave out any segments of an organization’s IT footprint. XDR then analyzes it in real-time using advanced analytics and ML algorithms to identify and respond to future cyber security threats.

2. Automated incident response

The days of manual intervention are over. Here are the broad strokes process of typical incident response:

• Incident detection

• Team communication

• Impact and risk assessment

• Customer communication

• Response escalation

• Incident response delegation

The incident undergoes a detailed evaluation by the team. Following this assessment, customers and stakeholders are promptly notified. The response is then escalated to the relevant team member for mitigation. Specific team members are assigned to handle the mitigation process and work towards resolving the incident. Naturally, this is a lengthy process, if not automated.

Threats can wreak havoc on your assets in a matter of minutes. The business could have already lost valuable customer data or time before your team has even realized a threat is taking place. Propelled by AI and machine-learning, XDR responds to detected threats faster and more accurately. And it does so 24/7/365. IBM's 2021 Cost of a Data Breach Report reported that organizations using AI/ML for cybersecurity had an average breach lifecycle (the time from identification to containment) 74 days shorter than those not using AI.

The impact and assessment phase of incident response, if executed manually, saps resources and money. If we go beyond the broad strokes, the process (CISA) gets dizzying:

• Determine investigation scope

• Collect and preserve data

• Perform technical analysis

• Correlate events and document timeline

• Identify anomalous activity

• Gather incident indicators

• Analyze for common adversary TTPs

• Validate and refine investigation scope

3. Integration of security tools in XDR

This type of assessment could take security personnel hours or days to figure out. XDR facilitates investigation into threats by providing you with as much information on a threat as possible. The automation frees up IT and security teams to prioritize more urgent investigations that can cause real damage. XDR unites different security tools with a single thread of data — only the data immediately relevant for detection — into one place for analysis, which results in speedier incident resolution. Especially for small- and medium-sized businesses (SMB), saving time, money and human resources on cybersecurity is paramount. SMBs spend an average of between $826 and $653,587 on cybersecurity incidents. Speed is money.

4. Proactive threat hunting

Perhaps one of most problematic approaches to securing a company’s data and systems is the reactive mindset. For SMBs in particular, cybersecurity is often relegated to a nice-to-have. ITRC’s 2023 Business Impact Report indicated that 53% of small businesses implemented new cybersecurity tools after an attack. If businesses adopt a proactive security posture, they stand to prevent damage such as loss of revenue, loss of customer trust, and unfortunate employee cutbacks.

Network traffic analysis, incident analysis, malware analysis, and threat hunting are some ingenious proactive measures to gather intel on the TTPs used by threat actors. XDR supports proactive threat hunting, which can preemptively reduce incident response times.

5. XDR’s real-time threat intelligence

Organizations can be proactive on a micro level as well. If we take a step back in the chronology of threat detection and response, it becomes clear that robust threat intelligence generates operational efficiencies before a threat is detected.

Our Samurai XDR provides a comprehensive view of the threat landscape, leading to quicker response times. With the threat landscape evolving so quickly, traditional security solutions cannot keep up or offer sufficient protection without threat intelligence. Threat intelligence informs every step of the incident response process. For more information, see our earlier article Building an Edge in Threat Intelligence.

Samurai XDR is supported by NTT's Global Threat Intelligence Center (GTIC) which provides dedicated R&D capabilities, focused on the development and constant curation of Threat Intelligence.

Quicker cyber incident response times minimize damage, which is our objective. Samurai XDR’s standard of speed and automation will help you save time, accomplish more, and stay safe.

About the Author:

Greg Garten is the Chief Technology Officer of NTT Security Holdings and Samurai XDR, with 25 years of experience ranging from telco/carrier to advanced technology startup environments, focusing on the creation and delivery of global managed services. Greg has been with NTT for over 10 years, focusing on the engineering and product development of their cybersecurity platforms, products, and services. Greg has also held various engineering and executive roles at companies such as Intuit, Cisco, Silver Lake Sumeru, Exodus Communication, Cybera, and several overseas technology startups and multinational technology companies. He is an active Member IEEE, ISC2, and ISSA.

3 Takeaways:

1. XDR Enhances Cybersecurity Efficiency: By integrating AI and machine learning, XDR significantly reduces incident response times.

2. Automation and Real-Time Detection: XDR automates the incident response process, minimizing manual intervention and enabling real-time threat detection across an organization’s entire IT infrastructure.

3. Proactive Threat Hunting: XDR supports proactive threat hunting and real-time threat intelligence, helping organizations prevent potential cyber incidents before they escalate, ultimately saving time, resources, and money.

Bibliography:

1. CISA (Cybersecurity and Infrastructure Security Agency). "The National Cyber Incident Response Plan (NCIRP)." CISA, 2023. Accessed August 22, 2024. https://www.cisa.gov/ncirp

2. ISACA “The Essentiality of Cybersecurity for Small Businesses: Applying Zero Trust Principles.” ISACA, 2023. https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2023/the-essentiality-of-cybersecurity-for-small-businesses

3. FRSecure. "Incident Response Statistics: How Do You Compare?" FRSecure, 2023. Accessed August 22, 2024. https://frsecure.com/incident-response-statistics/

4. Verizon. "2024 Data Breach Investigations Report." Verizon. Accessed August 22, 2024. https://www.verizon.com/business/resources/reports/dbir/.

5. NTT “Global Threat Intelligence Report 2024.” https://www.security.ntt/global-threat-intelligence-report-2024

6. Identity Theft Resource Center “Business Impact Report.” ITRC’s 2023 Business Impact Report