Incident & Breach Response , Next-Generation Technologies & Secure Development , Security Operations

Using XDR to Detect Ransomware, Supply Chain Attacks

Extended detection and response, or XDR, can play an important role in improving the detection of ransomware and supply chain attacks, says Peter Firstbrook of Gartner.

See Also: SIEM Wishlist: Top 5 Reasons Security Teams Can’t Wait to Upgrade

Organizations are tracking behavior on the endpoints, on the network and on email, he says, "but attacks cut across all of these security controls - email gateway controls, firewall controls, endpoints controls.

"We treat incident response on these various points differently. What XDR is saying is that all of these are part of the same attack. So XDR is integrating incident response experience and their workflow and contextualizing them."

In a video interview with Information Security Media Group, Firstbrook also discusses:

• How best to respond to supply chain attacks;
• The state of IT security;
• How XDR can play a role in analyzing threats.

Firstbrook is a vice president and analyst with Gartner. He has more than 20 years of experience as an industry analyst, helping clients improve their security posture to defend and respond to hacking, ransomware and phishing attacks.