Securely accelerating threat detection and response

Palo Alto Networks recently announced that Palo Alto Networks Government Cloud Services, including Cortex XDR SaaS-based extended detection and response, has ac...

February 11, 2021 3:39 pm

5 min read

This content is provided by Palo Alto Networks.

Continued, highly targeted cyberattacks on the U.S. government raise the stakes for agencies to quickly detect and respond to threats anywhere in their environment. We are in a particularly challenging time of remote work, which brings an increase in user dependence on many (sometimes personal) endpoint devices to get work done. Those devices create more vulnerability to a breadth of threats like ransomware, in-memory attacks and exploits. With so many assets in play, security operations center (SOC) teams are often left overwhelmed with too many alerts to investigate.

Any solution that can successfully address this challenge must provide the depth and rigor that government missions deserve. To that end, Palo Alto Networks recently announced that Palo Alto Networks Government Cloud Services, including Cortex XDR SaaS-based extended detection and response, has achieved Federal Risk and Authorization Management Program (FedRAMP) Moderate Authorization.

Comprehensive Security Operations in the Cloud

Agencies often use dozens of cybersecurity tools as part of a defense-in-depth approach. Unfortunately, getting a cohesive view of cyberthreats from multiple sensors, including many different types of endpoints, is difficult and resource-intensive, resulting in threat analysis that stretches over hours or days.

Instead, aggregating threat-related data from multiple sources into one cloud-based platform allows for a more holistic enterprise data set and better incident visibility. That includes data from endpoints, security incident and event management (SIEM) platforms, network devices and more.

Using advanced automation, the aggregate data can be quickly analyzed to assess stealthy threats, such as from nation-state actors, to a high degree of certainty and enable SOC teams to see the full scope of complex attacks, then guide suitable remediation.

Behavioral and heuristic techniques powered by artificial intelligence can be used to learn which types of anomalies may enter the environment, flagging what might otherwise be overlooked. For instance, if a new process that is out of normal operations is detected, automated behavioral analysis can quickly flag it so that exploratory action can be taken. When left to manual verification, the new process may receive a cursory scan but then be authorized if it is not exhibiting suspect behavior. Given that many threats lay dormant for months before executing their payload, the manual process simply may not catch what is actually malicious.

AI-based solutions will learn more threat signatures over time, not only recognizing them but prioritizing them for the SOC team to accelerate investigation and response, pre- or post-execution. That is especially helpful for preventing zero-day exploits, which would otherwise remain unknown until it’s too late. That’s also very helpful for detecting ransomware, which still makes up the majority of malware incidents in public administration. Since most ransomware attacks compromise endpoints in seconds, automated response is critical to matching the speed of the threat.

Coordinating incident response and reducing false positives due to well-qualified threat intelligence will help significantly focus potentially lengthy remediation efforts when a breach does occur. Prioritizing in this way is important to managing the alert fatigue that many security analysts experience.

How Palo Alto Networks Solves This Problem

Palo Alto Networks delivers the only comprehensive, integrated platform for addressing these security operations challenges within a FedRAMP Authorized environment. Cortex XDR spans key security data sources to stop modern attacks. Delivering endpoint protection, AI-driven threat detection and an enterprise-ready console for investigations, Cortex XDR helps agencies cut investigation times and lower the mean time to respond.

Uncover stealthy threats

Cortex XDR is a leader in uncovering stealthy attacks. Using machine learning, Cortex XDR continually profiles endpoint, network and user behavior to uncover nation-state attacks by skilled threat actors. It also integrates with WildFire malware prevention, another FedRAMP Authorized service, to analyze suspicious files in the cloud and coordinate protection from the latest malware, malicious URLs and more across Palo Alto Networks security products. Once you’ve detected a threat, Cortex XDR helps your security team eliminate it from a single console.

If you need expert help, the Cortex XDR Managed Threat Hunting service offers round-the-clock monitoring from US-based Unit 42 analysts to discover attacks anywhere in your agency. Our threat hunters work on your behalf to discover advanced threats, such as state-sponsored attackers, cybercriminals, malicious insiders and malware.

Harness data to power SOC investigations

Cortex XDR reduces data silos that slow down investigations. It stitches together endpoint, network, cloud, identity and other types of data from Palo Alto Networks and third-party products to deliver full visibility and eliminate blind spots. It provides a complete picture of any threats in your environment through an incident management view that groups together related alerts and displays threat intelligence. Cortex XDR performs analysis in the cloud and shows both the root cause of any threat and a timeline of all related activity. With this context, security teams can respond within seconds or minutes, without requiring a great deal of analyst expertise.

Thwart ransomware

Cortex XDR includes anti-ransomware and anti-malware protection modules, which target encryption-based activities associated with ransomware and other malicious file behaviors. The Cortex XDR agent blocks every step of endpoint attacks, while the cloud native Cortex XDR service provides enterprise-wide visibility to detect and stop the spread of ransomware across an environment.

Leverage your existing next-generation firewalls

U.S. federal agencies have long trusted Palo Alto Networks Next-Generation Firewalls to help secure their on-premises environments. More recently, as agencies move to the cloud, they have been deploying VM-Series virtual firewalls to secure their public cloud environments. Now, they can harness these existing investments to gather valuable threat data that automatically feeds into Cortex XDR, resulting in better visibility and more accurate analytics.

For more information on FedRAMP Authorized services from Palo Alto Networks, visit https://www.paloaltonetworks.com/security-for/government/fedramp.