Why Extended Detection and Response (XDR) Must Unite the Industry
summary
On May 24th a compromise begins when a Google account exposes browser‑synced corporate credentials, adversaries exploit MFA fatigue, enroll devices, add admin users and escalate privileges, then exfiltrate a Box folder; defenders see Cobalt Strike, MiniDuke, Impacket, living‑off‑the‑land binaries and a sticky‑key bypass tied to actor UNC2447. Cisco maps activity to MITRE ATT&CK, counts 25,000 NVD vulnerabilities and a 3x growth in firewall rules, concludes XDR must ingest endpoint, network, firewall, identity, email and DNS telemetry, apply analytics and automate ~80% of responses.
AI-written summary · about
chapters (9)
- 0:00Start
- 15:12Credentials Acquired - Hurdles Still to Clear
- 19:39Let's Talk Tooling
- 24:23Lessons Learned
- 32:26Telemetry Data Source Importance
- 33:50Lack of integration and automation are the biggest pain points for existing XDR solutions
- 35:24What are the building blocks of an ideal XDR?
- 38:31Shift focus to outcomes
- 39:24Quickly position teams to achieve incremental XDR milestones
related talks
40mBeyond Endpoints: A Case for Open XDR
40mHow to Build a Long-term XDR Architecture Strategy
47mOpen XDR: A Strategy for Evolving Security Needs
40mThe Skeptic's Guide to Using XDR to Get Zero Trust
27mThe Offensive Approach to Cybersecurity
20mConnecting the Dots in a Cyber Pandemic Era
38mCyber risk management: Bringing security to the boardroom
50mGlobal Threat Overview