Tag: reinforcing data resilience

You don’t need to be born in the cloud to have a cloud operating model.

While organizations embrace a cloud strategy for many reasons, one that stands out is a desire to get IT operations working more efficiently. Companies want to streamline value chains. They want to do more work and do it faster, with less friction.

Cloud-based operating models, done the right way, enable just that. In fact, for many organizations we work with, it is the adoption of the new ways of working that public cloud demands that creates the greatest benefits to business agility, and not merely the technology platform itself.

With this in mind, one of the top initiatives our customers prioritize is the development of cloud operating practices across their IT organizations and their entire IT ecosystem. Ironically, however, the operations domain is also one of the areas in which organizations struggle the most to generate momentum.

Breaking with the past

The biggest challenge organizations face is the need to shed a troublesome piece of baggage: their legacy operating models. Too many companies try to adopt cloud platforms without changing the way they work. They assume they can follow the same procedures they always have and make simple tweaks.

What they end up with is a collection of bad habits, tribal knowledge, and sets of processes, procedures, and tools that don’t respond well to the demands of a modern ecosystem. And, in turn, they fail to leverage operational learnings across their operations, missing opportunities to deliver agility improvements across the entire organization.

Organizations that are born in the cloud sometimes avoid developing these bad habits. They tailor their operating models to the way business is done in the cloud. They set up their operations to other organizational domains, incorporating DevOps, enabling innovation, sustaining applications, and driving strategy and governance.

But companies that have lengthy histories and may not have the luxury of spinning up new models from scratch have work to do to get their operations functioning at such a level. They face steep learning curves, including getting comfortable with new tooling, shared-responsibility models and practices, and job functions.

Please read: New tools boost automation, self-optimization of IT operational services

They have to learn how complex cloud transformations are so they can equip their teams with the resources needed to carry out the necessary work. Rather than relegate the work of getting to a cloud operating model to a side-of-desk task, they need to dedicate a group to adopting the new cloud-everywhere operating model.

If IT operations don’t prioritize the optimization of a comprehensive cloud operating model, some application owners will head to the cloud by themselves.

Where things stand

Based on our engagements with customers, we’ve evaluated enterprise progress in the eight domains making up the HPE Edge to Cloud Adoption Framework .

Figure 1: The Operations domain in the HPE Edge to Cloud Adoption Framework

Operations is a domain that most customers prioritize. It’s a tangible and significant part of most IT organizations, and one where progress is being made overall. Operations is one of the domains where we see the greatest overall progress in capability across our engagements, with an average maturity of 2.1 on a scale of 1 to 5, where a score of 3 indicates a cloud-ready organization.

However, there are some subdomains within operations where organizations are experiencing greater difficulty in achieving traction (see Figure 2):

• Service operations
• Platform operations
• Pipeline operations

Figure 2: Organizational maturity in the Operations domain

Let’s take a look at what’s behind these challenges and what can be done to overcome them.

Service operations: Slow, ineffective incident response

Many of the organizations we engage with have struggled to progress incident response capability to the point where it can work at the velocity of cloud. Though incident response is considered a security function, the operational component is an important measure of a company’s overall success in the cloud.

Companies with immature service operations often fall short in their ability to be proactive and prevent events from happening in the first place. And if a security event takes place, they will often exhibit slow, ineffective incident responses. The time it takes to detect, address, and resolve an issue often places them outside of their service-level agreement (SLA) targets due to a lack of automation and orchestration.

Please read: The fundamentals of security incident response—during a pandemic and beyond

To be proactive, companies need to set up systems to leverage metadata and characteristics from historical events. They start to learn from those events and build out proactive incident responses. Using techniques like comprehensive logging, event curation and correlation, and forensics can determine root causes and prevent issues.

The flip side is when an event has taken place, organizations take a long time to respond. Without automation and orchestration, you can’t scale the volume of elements that need to be remediated during an incident. If you’ve automated their response, it gives you a relatively short window for remediation.

Platforms operations: Lack of clearly defined infrastructure patterns to deliver consistent services

Organizations with a low level of cloud operational maturity lack a set of finite and clearly defined standards for developing applications and corresponding infrastructure. Without these patterns, they struggle to master the art of automating the provisioning of infrastructure and supporting the corresponding services that make applications tick.

This ties back to the legacy hangover issue. Organizations that are used to creating applications outside of cloud-native environments by default model their application architectures to support customized apps that may or may not generate high degrees of value. These architectures can’t scale to satisfy the emerging demands of the business.

As a result, operators find themselves having to provide white-glove service and custom work on an ongoing basis for customized applications. If they started from scratch, they’d be ready to scale. They could focus on those application archetypes that have a certain amount of critical mass. What starts to happen is organizations learn how to establish enterprise standards and policy and leverage cloud-native tools and that newfound operating model. It’s easier to bring others on board because they have that consistency and they generate results.

The new operating model creates its own gravity and starts to attract the attention of application and business owners. They can provide a valuable service as long as organizations play by a set of standards and rules to support scale. Otherwise, organizations are translating bad habits into the new cloud model.

Pipeline operations: Inconsistent management of container Images

Containers have changed the way organizations develop and deploy applications. Their lightweight structures and portable natures make them ideal packaging tools for organizations looking to add new features quickly and cost effectively. Still, a container operation is only as sound as the images that make up the containers themselves.

Organizations that are early in their cloud transformations tend to struggle with image integrity. They haven’t set up systems for hardening container images in a timely and repeatable fashion. They haven’t set up an automated testing and compliance certification process. They haven’t created secure container registries that identify images for use in the continuous integration and continuous delivery (CI/CD) pipeline, retire out-of-state images, and manage artifacts in various states of transit.

Pockets of skill

Some organizations see their cloud operations mature in a scattershot manner. In other words, it’s common to see cloud operations showing up as pockets of individual skills concentrated among certain people and certain groups. This can be helpful. Companies that promote a learning agenda can create first movers that act as a force multiplier. They can become change agents, with an eye toward centralization and supporting federation when the enterprise is ready.

Please read: How to achieve extreme quality with DevOps

But it isn’t always a good thing. If IT operations don’t prioritize the optimization of a comprehensive cloud operating model, some application owners will head to the cloud by themselves. The way these “experts” support their own applications won’t support all of the other application archetypes and the larger ecosystem out there. Costs spike, and the C-suite gets frustrated with the lack of progress. This is a big reason why cloud initiatives fail.

HPE GreenLake’s edge to cloud platform empowers organizations to harness the power of all their data, regardless of location.

Learn more

Where leaders succeed

A deliberate, well-planned approach toward operational maturity is the most effective way to succeed in the cloud. Across Hewlett Packard Enterprise’s base of cloud transformation engagements, leaders display this kind of discipline in these four areas:

• Service operations: The good news is that organizations have grown more sophisticated in their ability to log a wide variety of activities. The more advanced organizations are doing a better job curating and identifying the right pieces of metadata to turn into insights. They have meta-models in place, but they need to put intelligence around them to put the data to work for them.
• Architecture and governance: Formal governing bodies have been established, but many organizations still are working to streamline decision-making processes so they can reduce lead time.
• Availability management: Leaders are developing their ability to define business availability requirements in SLAs. They have well-thought-out plans to improve metrics such as RTO (recovery time objective) and RPO (recovery point objective), especially for tier-one and tier-two applications. Where organizations still need help is in meeting those requirements. Many establish partnerships with vendors that can take on management functions to help achieve these objectives.
• Platform operations: Leaders have created a mechanism for meta-data-based visibility across their ecosystems. This is important when they integrate with CI/CD pipelines; they know which components to pull from their repositories and where to put them. Infrastructure patterns and standards are important here too. A major bank we worked with was looking to increase adoption of its own internal private cloud. By using well-defined infrastructure patterns and corresponding storage standards, it was able to reduce infrastructure provisioning time, which in turn improved the reputation and buy-in for its initiative.

Getting your house in order

Moving to the cloud presents significant opportunities for companies to transform their operations—to make them more efficient and more focused on delivering business value. But to mature to the point where they’re accomplishing meaningful transformation, organizations need to get their own houses in order.

They need to commit to a new operating model, assess their strengths and weaknesses, and forge a plan to set their operations up for success. This operating model will yield benefits not only for the portion of operations that move to public cloud but across the entire enterprise, edge to cloud.

Extended detection and response (XDR) is a security solution that delivers end-to-end visibility, detection, investigation and response across multiple security layers. Core components of an XDR architecture include federation of security signals, higher-level behavioral and cross-correlated analytics, and closed-loop and highly automated responses. This creates a truly unified experience supported by a solutions architecture that equals more than the sum of its parts. Security teams are able to get more value from an XDR that meets the following criteria:

• Supports open standards
• Delivers advanced analytics
• Provides a simpler, unified analyst experience
• Streamlines operations
• Enhances response through automation

An XDR solution can achieve improved visibility across an organization’­­s networks, endpoints, SIEM and more via open-system integration. Open source standards can help move the industry away from expensive and wasteful ‘rip and replace’ programs. Instead, an open approach helps organizations get more out of their existing investments.

An XDR solution can also offer more automation and AI enrichments at all levels of detection, analytics, investigation and response. Automation throughout the threat life cycle can dramatically reduce mean time to detect (MTTD) and mean time to recovery (MTTR). Not only does reducing these metrics have a direct relationship to mitigating the cost of a data breach, it also frees up time for analysts to do more human-led activities like investigation. An XDR solution also bolsters investigation with a unified view of threat activity, a single search and investigation experience and consistent enrichment with threat intelligence and domain expertise.

Is XDR Just Another Acronym or a Fundamental Market Shift?

For many decades now, emerging threats have put organizations at risk. As the IT landscape evolved and threat actors found new ways to attack, security teams needed to find new ways to detect and respond to threats.

Today, this evolving theme of complexity continues. And the list of point solutions being deployed to overcome these burgeoning threats goes on and on — from SIEM, to cloud workload protection, to endpoint detection and response (EDR), to network detection and response (NDR) and more. While these investments each do their part to solve immediate and dire issues, in combination they’ve created a bigger challenge: how to use and get value from them together.

This is why we call them point tools; they were made to address specific challenges. Now that security teams face a myriad of challenges, it’s never been more critical to have them work in concert. Without doing so, limited security operations resources will continue to be spread thin, total cost of ownership will continue to increase and the process of pinpointing and responding to threats will continue to be time-consuming and inefficient.

Extended detection and response (XDR) is the beginning of a shift towards uniting multiple siloed solutions and reducing the complexity that impedes fast detection and response. As stated in the blog Gartner Top 9 Security and Risk Trends for 2020: “The primary goals of an XDR solution are to increase detection accuracy and improve security operations efficiency and productivity.” Gartner identified XDR as the number one security and risk trend at the end of 2020, suggesting now is the moment when all this complexity — too many tools, too many alerts, too little time — is coming to a head, with XDR as a response.

What Are The Different Approaches to XDR?

Industry analysts have outlined two different approaches to extended detection and response: native and hybrid. Native XDR is a suite that integrates with a vendor’s other solutions to collect telemetry and execute response actions. Hybrid or open XDR is a platform that integrates with various vendors and third parties to collect telemetry and execute response actions.

Vendors have been taking different approaches to what is under the hood of XDR, so to speak. For instance, does XDR = EDR plus additional capabilities? Or is it EDR plus NDR, or some other combination? It might be too soon to tell where the market will land as the technology is nascent, but the delineation between native and hybrid XDR is one thing the industry seems to agree on.

How Does XDR ‘Extend’ SIEM?

For some readers, SIEM may have immediately come to mind as you perused the qualities of XDR. There are some key differences between the two. Correlation and alerting tend to be fully automated, employing use cases that are provided and tuned by the vendor. Lastly, incident response tends to focus on highly repeatable actions that can be automated, such as sending a suspicious file to a sandbox for detonation, enriching an alert with threat intelligence or blocking an email sender tied to phishing emails. This approach differs from SOAR, which can be broadly customized with custom playbooks and used to unite people in addition to technology.

XDR in many ways can extend the detection and response capabilities that are today enabled by SIEM. In fact, SIEM can play an integral role to support an XDR architecture in gathering, organizing and assessing massive amounts of data for SOC analysts. In this capacity, XDR builds on the data and events flowing through your SIEM solution. By bringing together the capabilities of multiple point solutions, XDR can take SIEM analytics one step further and amplify the outcome. As an example, when you receive analytics from a SIEM, endpoints and networks separately, it can be like having three different witnesses to an attack. XDR helps you immediately bring all three witnesses together and create one complete story — helping an analyst see more clearly across multiple sources.

XDR is not just a place where you consolidate security signals but a place where you can run more advanced, correlated analytics. As The Forrester Wave for Security Analytics Platforms, Q4 2020 asserts, security analytics and endpoint detection and response have been on a “collision course” for some time. Bringing together these capabilities with XDR can provide “highly enriched telemetry, speedy investigations, and automated response actions.” Behavioral analytics or machine learning analytics can also enrich content, increase accuracy and lead to automated response actions.

How Does XDR Compare to MDR?

Even though XDR vendors are striving to untangle the complexity problem, it will take time to make inroads. Compounding this challenge is the skills shortage. The dire need for talent to run security analysis and investigations leads many organizations to utilize a partner for managed detection and response (MDR) services.

MDR is an approach to managing sophisticated detection and response tools — whether via endpoint, network or SIEM technology. Some MDR providers include proactive threat hunting to reveal undetected threats faster. Research from EMA conducted in 2020 found that 94% of respondents not already using an MDR service were currently evaluating or had plans to evaluate MDR services over the next 18 months.

MDR services can provide critical skills and advanced threat intelligence, plus rapid response with 24/7 SOC coverage. As Jon Oltsik, senior principal analyst at ESG, stated, “XDR success still seems to be based on human expertise,” making MDR an invaluable companion to XDR for customers who could use a helping hand.

How Does XDR Support Customers With Zero Trust Aspirations?

If you set up a game of security buzzword bingo, there’s no doubt you’d come across both zero trust and XDR. There’s industry chatter around these powerful security frameworks with good reason — one concept can help enforce the other.

Zero trust is a framework that starts with an assumption of compromise, then continuously validates the conditions for connection between users’ data and resources to determine authorization and need. XDR provides an essential function to zero trust by continuously monitoring for incidents and responding in the most targeted way possible to avoid disruption to the business.

How so? XDR enables analysts to determine if their organization is under attack and figure out as quickly as possible what’s happening, what will happen next and how to prevent that from unfolding. Instead of placing blind trust in a system and saying the controls are enough, with XDR you constantly monitor the places where things could go wrong.

In this way, XDR is ensuring that zero trust security controls are working. The ‘never trust, always verify’ zero trust methodology is supported by verification. When it comes to detecting and responding to threats, as well as improving protection policies based on insights, a zero trust framework and an XDR solution can work hand in hand. And it’s exactly why identity tools, such as identity and access management (IAM), will play a critical role tying into XDR solution architectures to ensure the appropriate user-centric context is being employed for threat detection and response.

What Should Customers Look for in an XDR Solution?

Your XDR should be an open, extensible solution that enables your organization to get more from its existing investments. Look for integrations with third parties that will save your organization from a costly and unrealistic rip-and-replace approach. Cloud-native solutions are also critical for extending cloud visibility.

XDR goes far beyond being an improved EDR solution; it should instead be your end game for threat detection and response activities — as part of a unified platform. Reaching that level of maturity is a goal that takes time, with the basics in place and a clear strategy as prerequisites for how to get started with XDR. With powerful automation, artificial intelligence and expert-built detection and prescribed response actions available through a unified user experience, security teams can counter attacks across silos — mitigating risk and resolving threats fast.

Ultimately, XDR makes it easier for the people managing and responding to threats on a daily basis to do the work. Open standards mean we can better serve customers and the community, preventing time and dollars lost to ripping and replacing technology. Advanced analytics, constantly updated threat intelligence and a streamlined user workforce empower analysts to be more efficient and spend their valuable time on investigations — not gathering the data.

People and culture are the keys to the SOC. By uniting threat detection data and tools and strengthening ability and context for fast incident response, XDR enables the collaboration and openness that helps teams thrive.

Learn more about realizing a vision for XDR in ‘Beyond Endpoints: A Case for Open XDR’, presented at the RSA Conference 2021.