Expert view: SASE + XDR, the winning formula for modern cyber defence

OP-ED · 4 MARCH 2024

Expert view: SASE + XDR · Lire en français

In an ever more connected world with a fragile geopolitical balance, the cyber threat is everywhere and more sophisticated by the day.

Using increasingly elaborate tactics, attackers exploit weaknesses in digital systems to launch offensives ranging from opportunistic cybercrime to campaigns orchestrated by state entities or organised networks.

In its recent report, the French National Cybersecurity Agency (ANSSI) highlights the emergence of ever stealthier attack techniques, making them all the harder for traditional defences to detect.

The consequences of a security breach can be catastrophic, leading to financial losses, reputational damage and, in the most serious cases, threats to national security.

Security teams, often short on resources, struggle to coordinate the use of various defence tools that generally do not communicate with each other.

This situation can lead to crucial alerts being missed and to delays in applying patches and remediation measures.

XDR: unify to protect better

The XDR (Extended Detection and Response) model addresses this challenge by centralising security data on a single platform for better incident detection.

This model goes beyond traditional tools by also integrating threat analysis across networks, clouds and applications, in addition to workstations and servers.

The effectiveness of XDR depends on high-quality interpretation of sensor data, enabling fine-grained event correlation and relevant threat detection.

Drawing on artificial intelligence and machine learning, XDR identifies threats quickly, making them easier for security teams to analyse so they can respond effectively.

The quality of this data varies, from data that comes directly from the vendor and needs no integration, to less reliable data from other sources.

When data quality is lower, the performance of correlation and detection systems drops.

In this situation, XDR fails to detect all existing threats and produces a high number of false positives.

This directly affects the workload and the effectiveness of investigations carried out by security teams.

Moreover, when resolving problems involves working on systems from different vendors, the time and complexity required increase considerably.

SASE + XDR: an obvious fit

Gartner's latest report on cybersecurity trends indicates that 75% of companies are looking to consolidate their defence and detection tools in order to reduce costs and simplify.

By merging network and security services on a single platform, the SASE (Secure Access Service Edge) model meets this aim perfectly, offering global visibility and unified security policy management.

By consolidating network and security operations, SASE provides end-to-end visibility and a consistent security policy for all users and devices, wherever they are.

The convergence of XDR and SASE technologies is therefore natural.

As we have seen, the effectiveness of XDR can be reduced by the quality of the data it processes and by the need to integrate various security information feeds.

By harnessing this extended visibility and applying it to threat detection and response, SASE significantly improves the quality of the data available to XDR.

The complementarity of XDR and SASE thus lies in SASE's ability to provide better-quality, more consistent data, which enriches XDR's threat detection capabilities.

When high-quality data is fed into advanced AI/ML algorithms, XDR can surface more precise and relevant security threats.

As a result, security analysts are better equipped to act quickly and accurately, improving incident response and reducing reaction time to threats.

The greater effectiveness of XDR, thanks to the rich data provided by SASE, goes beyond threat detection: it also extends to incident investigation and response.

Through a unified SASE management interface, analysts can move seamlessly through events and data, which simplifies investigations and speeds up verdicts.

Remediation procedures are also optimised, as teams can deploy responses through this unified interface, reducing operational complexity and resolution times.

An example: Cato Networks XDR

In early 2024, SASE pioneer Cato Networks added XDR Pro to its platform.

Cato XDR Pro delivers in-depth analysis of signals collected within the organisation's environment, as well as of the billions of signals that flow through its own infrastructure.

Unlike tools that focus exclusively on data from endpoints and servers, XDR Pro takes advantage of the native data of its SASE platform.

This coverage provides a more complete view of potential threats by capturing signals across a broader spectrum of network activity.

The Cato SASE platform natively includes a full range of sensors for different security engines, including NGFW, SWG, ATP, DNS protection, ZTNA, CASB, DLP, RBI and EPP, making any third-party integration unnecessary and enabling immediate deployment.

Working with data that has not been reduced by normalisation increases detection effectiveness and lowers false positives.

The quality and richness of the data are reflected in the incidents, which contain all the information needed for a thorough and effective investigation.

This leads to shorter investigation times and, above all, a rapid response can be delivered through a single management platform.

XDR Pro stands out for its ability to detect threats broadly, thanks to advanced AI/ML algorithms processing a wide spectrum of security data.

The threats identified are prioritised and organised to make investigation easier and minimise analysis time.

Cato's unified management console allows security teams to remediate quickly and effectively, without depending on external integrations.

XDR Pro categorises threats into three main groups to optimise alert handling by security teams: prevention, threat hunting and anomalies, covering a variety of scenarios, from blocked attacks to suspicious behaviour that may indicate malicious actions.

The unified management console enables a rapid incident response, allowing a compromised component to be isolated or malicious sources to be blocked across the network in under a minute, by setting filtering rules.

In addition, searching for indicators of compromise (IoC) is fast and built in, giving security teams a complete and detailed view of events.

Cato XDR Pro is thus part of a broader trend towards consolidating and optimising cybersecurity processes. By capitalising on the convergence of security and network tools within a SASE platform, it aims to provide more consistent security analysis and more agile threat management.

Conclusion

In conclusion, the combination of XDR and SASE creates an integrated, intelligent security ecosystem that streamlines security and network management and strengthens organisations' ability to anticipate, detect and respond to increasingly sophisticated threats. Embracing this synergy is more than a matter of operational efficiency: it is a fundamental transformation that puts security at the heart of digital strategy, enabling a proactive response to evolving cyber threats and greater protection of digital assets.

About SASETY

SASETY is a Managed Service Provider for networks and cybersecurity, specialising in SASE transformation and automated security validation for organisations.

A pioneer of SASE managed services and Cato Networks' leading partner in France, SASETY supports its clients in deploying and running connectivity, transport and security services day to day.

💡 To see how effective Cato Networks really is, nothing beats a demo!

Book a demo →