A breach of your systems is highly likely. How will your organisation detect and respond to it?

In today’s digital ecosystem, the question isn’t if your organisation will face a security breach, but when, and importantly, will you be able to detect and respond to it quickly?  

The attack surface of any modern organisation with more than 50 employees is so large that it is virtually impossible to halt every breach attempt by external and internal actors.  That reality has forced a paradigm shift from a purely preventive approach to one of robust detection and rapid response. 

Recent breaches of the defences of some of Australia’s most well-resourced organisations highlight the likelihood of a breach.  Among the notable entries are Latitude Financial, Canva, Optus, Medibank, and HWL Ebsworth Lawyers, (whose breach is still making headlines at the date of publication).  These entities all had their client data accessed in a clear indication the battleground has shifted from keeping attackers at bay outside the walls, to detecting their activities within.

So, what tools are available to an organisation’s IT team?  There are many, but this article will focus on the features, benefits and interoperability of two: Endpoint Detection and Response (EDR) and Security Information and Event Management (SIEM).

This article aims to equip you with the knowledge and tools to assess how EDR and SIEM might fit with your current security posture and bolster your ability to detect and respond effectively.

Let’s start with EDR

Endpoint Detection and Response (EDR) technology is a cornerstone in modern cybersecurity frameworks, serving as an always-on guard against potential threats. But before diving into the mechanics of the technology, it’s crucial to understand what an “endpoint” is.

In layman’s terms, an endpoint is any device that connects to your organisation’s network. This includes computers, laptops, smartphones, tablets, and servers. Each of these devices, when connected to your network, could potentially serve as an entrance point for adversaries if not adequately secured.

The essential benefit of EDR lies in its ability to continuously monitor and analyse the endpoints in a network. Here’s a breakdown of how it operates:

1. Monitoring and Data Collection:
   • EDR technology keeps a watchful eye on all activities occurring on the endpoints connected to your network. It collects a vast amount of data, encompassing file activities, communications, and behavioural data of users and systems.  Many EDR products come to understand what “normal” activity on your network looks like.
2. Threat Detection:
   • Utilising sophisticated algorithms and heuristics, EDR scans the collected data to identify anomalies or activities that deviate from the established baseline, which could signify a potential threat.
3. Investigation:
   • When a suspect activity or group of activities exceeds an established level of tolerance, EDR alerts security personnel and facilitates a deep dive into the incident, enabling cybersecurity personnel to investigate, determine the nature of the threat and the data or systems affected.
4. Response:
   • EDR empowers your organisation to respond to the threat swiftly. This could range from isolating affected endpoints to prevent the spread of malware, to initiating predefined security protocols to mitigate the threat.
5. Remediation:
   • Beyond merely responding, EDR assists in remedying the breach’s effects, ensuring that vulnerabilities are patched and the systems are fortified against similar threats in the future.

By offering real-time insight into the network’s activities and ensuring very little slips through the cracks, EDR gives your organisation or your managed service provider the ability to detect a breach faster and puts your security team on the front foot to stem an outflow of information or prevent the next stage deployment of malware.  Several providers also offer an interconnected EDR solution that not only detects and responds to incidents within your organisation, but shares intelligence from other detections within the provider’s network, resulting in a continually improving posture against threats emerging across the world.

So, what is SIEM?

Security Information and Event Management (SIEM) technology serves as a linchpin in fortifying an organisation’s cybersecurity posture. Unlike EDR that zeroes in on endpoint activities, SIEM casts a wider net, offering a panoramic view of the organisation’s security landscape by aggregating and analysing data from various sources within the network.

Here’s how SIEM operates:

1. Data Aggregation:
   • SIEM gathers data from a plethora of sources within your organisation’s network. This includes servers, firewalls, routers, and other network devices, alongside applications and databases. It aggregates log data, which are records of events occurring within these systems.
2. Normalisation and Correlation:
   • The collected data is then normalised, meaning it’s transformed into a standard format. SIEM technology correlates this data, identifying relationships between different events to unveil potential security incidents.
3. Threat Detection:
   • By employing advanced analytics and rule-based strategies, SIEM identifies hard-to-detect anomalies or suspicious activities that could signify a security threat. It can detect both known and unknown threats by matching activities against known attack patterns or by identifying abnormal behaviour within the network.
4. Alerting and Reporting:
   • Once a threat is detected, SIEM generates alerts to notify cybersecurity personnel. It also provides detailed reporting on incidents, aiding in the investigation and compliance requirements.
5. Forensic Analysis:
   • SIEM provides tools for forensic analysis, enabling cybersecurity teams to delve into the details of security incidents, to understand their origin, impact, and to devise an effective response.
6. Response Automation:
   • Some advanced SIEM solutions offer automated response capabilities, where predefined actions are triggered in response to detected threats, aiding in swift mitigation.

So, are EDM and SIEM the same thing or complementary?

They are different and complementary.  While EDR focuses on real-time monitoring and analysis of endpoint activities, SIEM provides a wider and more holistic view of the security ecosystem by aggregating data from various network sources. EDR excels in identifying, investigating, and responding to threats at the endpoint level, whereas SIEM proves its value in detecting broader network anomalies, providing comprehensive reporting, and enabling forensic analysis.

Moreover, SIEM’s ability to automate responses to threats and provide compliance reporting adds a layer of functionality that complements the real-time detection and response capabilities of EDR.

Together, SIEM and EDR form a robust cybersecurity fabric, each contributing distinct yet complementary capabilities. By integrating both technologies, your organisation can achieve a more nuanced and effective security posture, ensuring a rapid response to threats and a well-rounded strategy to pre-empt, detect, and mitigate cybersecurity risks.

Here’s a side-by side comparison of EDR and SIEM:

If you can only afford one, how should you proceed?

Both is better, but if your budget doesn’t permit it, starting with EDR is the most practical route. You don’t get the whole-of-network detection capability of a SIEM platform, but seeing as many common compromises begin on the desktop or at the outer edge of the network, EDR can address the most pressing security demand.

The last word

Unfortunately, a breach is no longer a distant possibility but a very possible eventuality that necessitates a paradigm shift from prevention to swift detection and response. EDR and SIEM are two complementary technologies that enable that defensive response.

Endpoint Detection and Response (EDR) scrutinises every nuance of endpoint activities to ensure threats are detected and nipped in the bud when rules or heuristic algorithms are triggered.

And Security Information and Event Management (SIEM) extends vigilance across the network, aggregating, and analysing a plethora of data to provide a panoramic view of the security landscape, thus enabling a proactive stance against a broad spectrum of cyber threats beyond the endpoints on your network.

While EDR is adept at real-time threat detection and response at the endpoint level, SIEM excels in providing a holistic view of network security, compliance reporting, and facilitating a cohesive response to mitigate threats across the network.

Thus, they are complementary, not exclusive technologies.

Computer One is an accredited partner of several EDR and SIEM platforms and can design and deliver an effective security posture improvement for your organisation. Contact us for a confidential discussion.