How the Adoption of EDR Transforms a SOC’s Effectiveness

Endpoint detection and response (EDR) is much more than a next-generation endpoint capability, it is a driving force of evolutionary change within security operations centers (SOC) today. EDR provides visibility where most organizations are blind. In our network-centric world, EDR provides a fast path to endpoint context, enabling rapid identification of false positives or the origin of attacks. 

To illustrate this point, I created a litmus test to review common limitations in security information and event management (SIEM) and threat monitoring today. Because most SIEM have insufficient endpoint data, threat analysts struggle to answer even the most fundamental questions, such as: 

Nor the more complex questions such as:

Life without EDR 

For organizations without EDR, researching and responding to threats is a maddening exercise. With limited access to endpoints or endpoint context, threat analysts -- particularly in large enterprise or managed security service provider (MSSP) -- have few choices other than to open a ticket and delegate the research to others with access to the targeted machine. 

The stakeholder could be in another department or region. For MSSPs, this is the heartbeat of communication between the SOC and customers under attack. Tickets may be answered quickly but a large majority take days and weeks. Some aren’t answered at all. In fact, due to the substantial delays incurred, special tools have been created to address the hold up. 

This is the average day to day of threat analysts in the SOC. It’s not sexy, nor is it cost effective. Repeated tens (if not hundreds) of times on a daily or weekly basis drives up organizational costs to an unsupportable level. When I hear people say: “I can’t afford to build or staff a SOC,” it’s not surprising given the status quo. Manual and human intensive tasks give security a bad name. This is life without EDR. 

Life with EDR

The introduction of EDR is a major evolution in SOC effectiveness. Threat analysts no longer need to ask others to validate threats, the data is available to real-time query. With immediate access to the data, three incredible things happen:

Inevitably, a breach will occur. When that does happen, utilizing a best-in-class EDR vendor that includes continuous and centralized recording takes the guesswork out of incident response. The attacker may have erased their tracks, but EDR recorded the attackers every move with an endpoint DVR, the cyber equivalent to a surveillance camera. With a complete historical recording of an attacker and their actions, incident responders don’t need to fly to the scene of the crime, scrape RAM, or image machines to look for clues. The full recorded history of the attack enables on the spot incident response. 

EDR is much more than an endpoint security product; it’s causing an evolution in the people and process utilized within security operation centers globally. And for individual corporations or customers who rely on MSSPs to deliver skills and expertise, EDR is a fundamental technology that is not optional. It’s a foundational requirement of the next generation security operation center and primary reason we’ll collapse the average ~250 day gap between attack initiation and discovery.