Cyberattacks are increasing in frequency and sophistication, which means that having standalone security solutions is not enough for MSPs who want to protect their customers effectively. Effective cybersecurity hygiene must include proactive monitoring with extended visibility, multi-layered security, and 24x7x365 detection and response.
Solution maturity is essential when clients evaluate MSPs and should also be carefully evaluated when MSPs are selecting technology partners. For example, in the case of security, Extended Detection and Response (XDR) solutions, including bundled security operations center (SOC) services, have emerged as a critical part of a comprehensive security offering.
XDR helps MSPs offer advanced security solutions to a wide range of clients without having to build a SOC from scratch or invest heavily in hiring more staff. XDR solutions like Barracuda XDR provide management and monitoring in a central platform. Centralizing the data makes responding to security incidents that much easier and often minimizes the time to remediation as a result.
In addition, XDR can help MSPs collect and automatically correlate data across multiple layers and endpoints, making threat detection faster and more accessible via automated analysis. Because XDR solutions are backed by security professionals, threat detection with a mature XDR offering will minimize alert fatigue while still finding bad actors.
The right XDR toolset will help an MSP provide the deepest level of coverage for each asset or network they are monitoring, allows them to pivot to new verticals or tactics quickly, and provides a way to audit their coverage easily.
More than Just XDR
Beyond features and functions of the XDR platform, a trusted XDR partner should utilize a variety of security tools that may be incorporated into, or work in conjunction with the platform to provide holistic protection.
For example, a security information and event management (SIEM) is one of the tools that enable security analysts to review log and event data, identify threats, and perform investigations. Ideally, these systems can pull data from every part of a customer environment, aggregate that data into a central platform, and use that information to support threat detection.
Advanced security teams will utilize Machine Learning (ML) detections with their SIEM to identify patterns and behaviors in the network or on an asset. ML detections can often include or be considered as user-entity behavior analysis (UEBA). With such detections, breaches caused by zero-day attacks or with innovative techniques can still be identified.
Another tool used by security teams to automate many of their activities is a security orchestration, automation, and response (SOAR) platform. From researching threat intel to blocking malicious actors from an asset or network, SOAR platforms allows security teams to programmatically investigate and remediate the activity found in the tools like a SIEM to respond to and minimize the cyber security threats.
With SOAR, more security tools can be utilized by security analysts to investigate and validate what is found with the SIEM. For example, SOAR platforms will commonly research Indicators of Compromise (IoCs) on Threat Intelligence Platforms (TIP).
With advanced security teams, SIEM and SOAR are often used together – with SIEM handling log collection to support analysis and threat detection, and SOAR coordinating the response. However, without trained security professionals, neither tool will be designed to properly identify risks or respond to them. Within a SIEM for example, poorly constructed rules will result in excessive, redundant, or irrelevant information. This can and will cause alert fatigue. Even worse, poorly designed rules can fail to find malicious actors. With skilled security professionals, XDR ensures the right rules are created and “tuned” for each customer environment to find actual threats.
Here is an example of how XDR will utilize these tools. The SIEM has detected an IP address that is performing suspicious activity. The SOAR platform then looks up this IP address in one of the TIPs and sees that it is listed as a known, malicious IP address. Once validated, the SOAR platform goes to the customer’s firewall and blocks this IP address. The activities performed by the SOAR platform along with the relevant information found from the SIEM and any other response steps necessary are shown in the XDR dashboard (as well as in the notification to the MSP and/or customer).
XDR provides these services as well as advanced analytics to demonstrate a company’s security posture and to help drive business decisions. To further demonstrate their security coverage, an XDR offering should map to a framework like the MITRE ATT&CK framework. If there are gaps in coverage, such mappings will help MSPs show this to their customers.
Barracuda XDR provides these advanced security services to MSPs and its customers 24x7x365.
This is just scratching the surface of the toolset a mature XDR offering incorporates to identify and respond to security risks. This ensures XDR is providing faster response times, streamlined security processes, and more robust protection.
