Endpoint Security - EDR/MDR/XDR solutions

Endpoint Security is a practice of securing entry points (laptops, desktops, IoT devices, servers, etc.) from malicious actors and malicious campaigns. It consists of multiple security approaches that complement each other, from vulnerability management and AVs to more complex and innovative EDR solutions.

In recent years, organizations have switched from traditional antivirus softwares to more complex and versatile solutions called EDR (Endpoint Detection and Response). In response to the growing threat landscape, EDR has rapidly evolved from detecting signature-based threats from a database of known malicious patterns to showing detective and preventative capabilities with deep visibility into every action happening at the endpoint. For a long time, additional security mechanisms were integrated within AV capabilities, making it more reactive but missing on expertise of security teams to make decisions on the severity of incident and take action when needed. Such solutions are known as EPP (Endpoint Protection Platform). Many EPP vendors recognize the need for in-time actions (respond, contain, remediate and investigate) in post-incident situations, hence many include EDR/MDR/XDR capabilities in order to get more active approach:

• Detect security incidents
• Contain incidents at the endpoint
• Investigate security incidents
• Provide remediation guidance

How is EDR evolving?

The evolution of EDR goes towards more advanced solutions, MDR (Managed Detection and Response) and XDR (Extended Detection and Response).

Although similar in nature with EDR capabilities, MDR is a service designed to help organizations take necessary actions in case of the security attack and stay vigilant about any potential incidents. XDR is a security product that helps security teams carry out all the necessary actions in regards to responding, detecting threats and investigating incidents. General capabilities for both solutions include:

MDR provides:

• 24/ managed services (security team),
• proactive threat hunting,
• managed remediation,
• threats and alerts prioritization,
• continuous security improvement.

XDR adds:

• multiple data sources (endpoints, network, cloud, applications),
• unified visibility,
• integration with other security technologies.

MDR and XDR can be seen as two solutions working together to provide the best security service with the most advanced security products. The former offering external resources to perform all actions needed to preserve the confidentiality, integrity and availability of organization’s data with the help of integrated XDR characteristics.

Let’s have a look at the EDR market

Per Gartner, the EDR market is growing and there is no slowing down when it comes to organizations seeking more robust and complete security solutions. Many are adapting to new threats, zero-day vulnerabilities and incidents by expanding their security coverage area with new security tools, technologies and services. The what and how are not defined within these solutions and the lack of regulations gives them the liberty of classifying and increasing diversity of products and services as the market demands. For that reason, you will find most vendors offering different features under the same category or module (EDR, MDR, XDR, etc.) which lets organizations search and compare what is out there to find and integrate the best EDR/MDR/XDR solution that suits their security needs.

Figure 1: Most popular EDR/MDR/XDR solutions

Conclusion

The line between mentioned solutions is blurry and vendors are constantly in the need of improving their security offerings making the complete picture more-rounded and ready for any kind of attack, threat and potential breach.

In CSO, Josh Fruhlinger wrote:

But one thing to keep in mind is that the whole EDR market is in some ways an attempt to put an umbrella label on a somewhat heterogenous category, and is thus always evolving.