We had a community webinar on "XDR : A Holistic View Through Security Analytics – Across Endpoint, Network And Cloud". We discussed the fundamentals; Endpoint solutions vs XDR; Implementation experience, challenges; post implementation feedback, outcome vs expectation, use cases; MDR vs human skills.

 

Session Agenda

  • What is EDR, XDR
  • Endpoint solutions vs XDR
  • Implementation experience , challenges
  • Post implementation feedback, outcome vs expectation, use cases
  • MDR vs human skills

 

About Speaker

  • Abdur Rafi, Head IT Infrastructure & CISO,  ABP Group
  • Soumya Biswas, IT Infrastructure & Security Specialist, ABP Group
  • Debajyoti Das, Senior Executive IT Security, ABP Group

 

(Webinar) Recorded

 

Discussion Highlights

1. Extended Detection and Response (XDR) solutions are designed to provide automated threat detection and response through data visibility and the use of threat intelligence and data analytics. XDR collects activity data from multiple vectors including endpoints, servers, and networks.

 

2. Automobile Attack Surfaces : Fifteen of the most hacable and exposed attack surfaces, including several electronic control units on a next generation car. Like - Smartphone, Remote link type app, Airbag ECU, OBD2, USB, Bluetooth, DSRC-Based Receiver (V2X), Remote key, Passive keyless entry, Vehicle access system ECU, Steering and Braking ECU, Engine and Transmission ECU, Lighting system ECU, ADAS system, TPMS

 

3. Endpoint Detection & Response

  • Spam Phishing email
  • Known Rogue eebsite
  • Unknown Rogue website
  • Known Malware
  • Unknown Malware
  • Fileless Attack
  • Exploit

1.png?profile=RESIZE_710x

 

4. Endpoint Protection Plan (EPP)

Detection : Ioc scan, Advanced detection techniques, Behaviour analysis

Investigation : Root cause, Attack Visualization, Enriched alert data

Response : Automated response on discovery, Multiple response options, Quick response during the investigation

 

5. How XDR works : XDR isolates and dissects threats on different attack surfaces

  • Endpoints
  • Email
  • Network
  • Servers
  • Cloud workloads

 

6. Endpoint Protection Policies

  • Threat Protection
  • Peripheral control
  • Application control
  • Data Loss Prevention
  • Web Control
  • Update Management
  • Windows Firewall

 

7. Threat Analysis Center - ML / PE-A

2.png?profile=RESIZE_710x

 

 

E-mail me when people leave their comments –

CISO Platform

You need to be a member of CISO Platform to add comments!

Join CISO Platform

RSAC Meetup Banner

CISO Platform

A global community of 5K+ Senior IT Security executives and 40K+ subscribers with the vision of meaningful collaboration, knowledge, and intelligence sharing to fight the growing cyber security threats.

Join CISO Community Share Your Knowledge (Post A Blog)