Cybersecurity Architecture: Detection

 

The Security Equation: S = P + D + R

Cybersecurity is defined by the formula S = P + D + R, which stands for:

• P = Prevention: The controls and defenses put in place to stop attacks before they happen.

• D = Detection: The ability to identify when an attack is underway or has already occurred.

• R = Response: The actions taken to contain and recover from an attack.

The majority of the cybersecurity domains previously discussed (Identity, Endpoint, Network, Application, and Data security) focus on prevention. This video, however, focuses on the crucial Detection aspect, which is primarily handled by a Security Operations Center (SOC).

---

Detection Technologies: SIEM vs. XDR

The SOC relies on two main technologies for detection:

1. SIEM (Security Information and Event Management)

A SIEM is a centralized system that aggregates data from all security domains.

• How it works: It acts as a single console, collecting logs, events, and alarms from every part of the network (endpoints, firewalls, applications, etc.).

• Key Functions:

  • Collection: Gathers all security-related data into a central database.

  • Correlation: Analyzes and links multiple alarms from different systems to identify a single, coordinated attack.

  • Analysis: Uses rules, machine learning, and user behavior analytics (UBA) to find known threats and anomalies.

  • Reporting: Generates reports for management to track security performance and trends.

2. XDR (Extended Detection and Response)

XDR is a newer, more proactive technology that evolved from Endpoint Detection and Response (EDR).

• How it works: Instead of bringing all data up to a central SIEM, XDR pushes detection capabilities down to individual endpoints (desktops, servers). It can also perform Federated Search, querying data from multiple systems in real time instead of relying on a pre-collected database.

• SIEM vs. XDR: It's not a competition between the two, but rather a complementary relationship (XDR + SIEM). A SIEM is excellent for comprehensive alarms, while XDR is more efficient at performing targeted investigations by leaving data in place and querying it only when needed.

---

The Importance of Threat Hunting 

Threat hunting is a proactive security measure designed to reduce the time it takes to identify and contain an attack.

The Problem: Long Attack Timelines

• MTTI (Mean-Time-to-Identify): The average time to detect a breach is around 200 days.

• MTTC (Mean-Time-to-Contain): The average time to fix the problem after it's identified is another 70 days.

• Total Time: An attacker can be in a system for over 270 days before the organization fully recovers.

The Solution: Proactive Hunting

• Reactive Investigation: A standard investigation is a reaction to an existing alarm.

• Proactive Threat Hunting: A skilled security analyst develops a hypothesis about a potential attack and uses tools like a SIEM and XDR to actively search for signs of a breach that has not yet been detected. This helps to move the detection timeline much earlier, minimizing the attacker's dwell time and the damage they can cause.

By focusing on detection, organizations can shorten the time between an attack and its discovery, a critical step in a robust security strategy.