Displaying items by tag: xdr

One of the most commonly asked questions in cybersecurity is “where do I start?” This common question shows just how overwhelmed many organizations are when faced with the reality of the threats that are out there. From ransomware to business email compromise, the threat actors certainly seem to be ahead of the implementations when it comes to securing the data that organizations are responsible for. So where should an organization start when it comes to building or optimizing their cybersecurity program?

EDR, XDR, and MDR are acronyms that are well known to most organizations. The operative letters here are DR which stands for Detection and Response. The E, X, and M stand for Endpoint, E(x)tended, and Managed respectively. Each one of these is designed to monitor a device for threats and respond according to the profile/configuration/policy enabled for the device. This is different than the traditional “anti-virus/anti-malware” application in many ways. The most common is that an EDR is intended to do more than check files against a signature list and quarantine them if identified. The modern EDR does look for malware, but it also monitors script execution, process starts/stops, file and registry reads and writes and, in many cases, network activity that can indicate potential compromise.

A couple of days ago an email was sent to me about a new tool kit being sold on the darker side of the internet. The claim what that this new tool could kill the processes behind “any” AV, EDR, or XDR running on Windows 7 and newer. The same email included a link to what was supposed to be proof of its efficacy. I opened the link in a sandbox on a controlled VM just to be sure the link was not malicious all on its own. What I saw was nothing all that new, although it was a bit worrying.

The news has been abuzz about the $65+ Billion-dollar purchase of Activision/Blizzard by Microsoft. It has been seen as an opening shot in a new stage in the console wars and is, even now, under review by the FTC. However, there are rumors that Mandiant and Microsoft are in talks about a potential acquisition of the Incident Response company. These rumors come on the heels of an announcement by Mandiant that they are partnering with NextGen XDR developer SentinelOne. Where to start on this one…