How XDR can identify and fill the cracks in state and local government’s cybersecurity posture

Sometimes, you can have too much of a good thing. 

In technology, this is called tool sprawl. When organizations deploy too many siloed point solutions or applications, the process of effectively managing them all can actually hinder performance. This is a fine line to walk as governments embrace digital transformation, especially in this new era of hybrid and flexible work—one that has created an exploding number of different applications running on various devices across a variety of networks. 

That’s a lot more surface area for security leaders to protect from sophisticated cyber threats. Historically, the response has been to integrate point security solutions to defend each layer of the IT infrastructure—from the server to the network to the endpoint. In other words, trying to protect data from the initial sprawl creates even more sprawl. 

Remember The Buggles’ classic, “Video Killed the Radio Star?” Well, tool sprawl has killed governments’ security posture, unless IT leaders can rise above it to see the big picture in real-time. 

Policymakers continue to emphasize the critical need to strengthen cybersecurity measures at all levels of government in the face of increasingly sophisticated and harmful attacks. According to the Cybersecurity and Infrastructure Security Agency, local governments are more vulnerable to cyberattacks than ever before, and leaders must step up efforts to protect against, identify and respond to threats to security and privacy. Extended detection response (XDR) can be the answer to that call—and the concept may be more familiar than decision-makers realize. 

Using XDR to connect the dots

While the term XDR was only coined recently, the approach has been around for some time. The process evolved from endpoint detection and response (EDR), which pinpoints, collects and analyzes data correlations between endpoints, providing an ongoing, comprehensive view of the situation.

XDR takes this a few steps further by providing insights across endpoints, as well as networks, servers, cloud infrastructure, SIEM tools and more, all of which aid to broaden an organization’s visibility. XDR accomplishes this because it collects telemetry from multiple sources, uses machine-learning tools throughout the process and takes action when a threat is detected.

Think of a security operations center (SOC) as an emergency room: ER doctors can treat multiple patients’ injuries at once, quickly and efficiently with a comprehensive plan of action that enables collaboration. Then, when the patients are stable enough, they consult a specialist who plans the recovery and rehabilitation to help patients regain their strength. It’s important to be aware of all the moving pieces to effectively triage threats to an organization’s security, and once the situation is less dire, team members can focus on strengthening the individual elements.

Put simply, XDR is the consolidation, simplification and value enhancement of security data—with consolidation being the greatest asset. XDR can act as an operating system for SOCs, helping to monitor, identify and respond to threats. The approach encourages situational awareness, bypassing the need for traditional “swivel chair analytics,” and provides insights on a single, comprehensive interface by consolidating multiple tools. 

XDR helps apps and people excel

One of XDR's most appealing attributes is its capacity to be integrated into a variety of existing infrastructures, as opposed to the “rip and replace” methods required by some other practices. In fact, XDR’s inherent flexibility encourages collaboration and improves the efficiency and value of any system, streamlining connections between different applications. By enabling security solutions to do what they’re intended to do—identify threats—XDR better equips security personnel to analyze these identified vulnerabilities and respond to inbound threats. 

Effective use of XDR can maximize available cyber talent by providing a 360-degree view of an organization’s existing resources, and thus closes potential workforce gaps that make an organization more susceptible to outside threats. This thorough view of assets increases threat visibility and clears pathways to better solutions while increasing SOC productivity and minimizing wasted time and resources. 

The federal government has already begun to reap the benefits of XDR: CISA issued a request for information to integrate EDR efforts across agencies, as outlined in last May’s executive order. In that same vein, the integration of XDR technologies could further maximize the potential of state and local governments’ available tools, increasing threat hunting capabilities without disrupting existing cybersecurity processes. 

State and local governments can—and should—continue to embrace digital transformation, and as IT teams modernize to support their agency mission, it’s imperative that their security processes work with and not against them. While XDR can’t help eliminate tool sprawl, it can help protect against the vulnerabilities that are often exposed in times of innovation.

John Harmon is regional vice president of cyber solutions for Elastic.