In recent years, breaches via servers exposed to the outside world account for 60-70% of serious incidents in Japan and overseas. For this reason, it has become extremely important to thoroughly understand and appropriately manage servers exposed to the outside world, including those at overseas offices and subsidiaries related to your company, using Attack Surface Management (ASM). On the other hand, many people may feel that there are limits to being able to fully understand and manage servers related to their company that are exposed to the outside world on their own. Also, even if you want to utilize a solution, there may be people who are worried about which one to choose from among the many ASM solutions available in the world. In this session, we at Macnica, which has accumulated knowledge through handling multiple products and in-house developed services related to ASM, will discuss the issues and trends in tackling ASM that we have learned through conversations with various global companies. Let me introduce you. In addition, while comparing these, we will also introduce the key points for selecting a solution that we know from Macnica, which handles multiple solutions, along with the characteristics of each solution.

We will also explain the threat trends, what methods attackers use, and also explain the difference between "ITDR", which can be one of the solutions, and other security products such as EDR, IAM, and IGA. will be introduced.

We will technically explain points that are likely to be issues when introducing XDR products, detection capabilities and visibility when compared to security products alone, points of operation, necessary skills, etc.

Why is XDR, which is attracting the most attention in future security measures, necessary? What is the expected effect? After talking about these points, I will tell you about the XDR image that we are aiming to provide.

The scope to be protected by security is expanding in the increasingly complex IT environment, such as cloud computing and remote work. Advanced skills are required to grasp the full picture of attacks from multiple products, such as endpoints and networks, and to deal with them. In addition, it is necessary to respond to alerts issued by multiple security products on a daily basis, which is a problem for security personnel. We will explain the overview, components, and expected effects of the solution called XDR, which throws a hand in such a situation.

In response to the diversification and complexity of IT environments, such as the introduction of remote work, migration to the cloud, and the realization of zero trust, security personnel need not only EDR, but also individual alerts from security countermeasure products such as NDR and UEBA. I think that they are worried about how to deal with it, how to gather people with enough skills to deal with it, and how to handle it. Regarding XDR, which is currently attracting attention as a solution to solve them, I will explain how alert response and incident response can be made more efficient and advanced, and what security operations will not change even if XDR is introduced. increase.

I think that the opportunity to see the keyword "XDR" has increased a lot. However, we often hear from our customers that they are worried about where to start. In this session, we will first explain the definition of XDR and the steps that are easy to work on, divided into scenes. Among them, we will mainly introduce the approach to proceed from EDR of the endpoint part as a sensor and NDR of the network part when detecting and responding to multiple products and layers.

Recently, poorly managed servers and network devices exposed to the outside have become a major cause of a rapid increase in security incidents both in Japan and overseas. It's not just your servers that are at risk. There have been many reports of security incidents that have a significant impact on the organization due to poorly managed overseas bases, subsidiaries, business partners, etc. While recognizing supply chain risks in cybersecurity, many people say that they don't know how to deal with them. Therefore, in this session, we will explain the importance of understanding assets exposed to the outside that may be misused and deal with them in advance, and introduce solutions and countermeasures.

With each passing day, the expectations placed on security personnel grow, as do their responsibilities. Despite this, many companies may feel uneasy about continuing to operate without the necessary skill sets and business design being ambiguous. In this session, we will focus on the "analysis" work, which is the key to flexibly responding to various incidents. We will provide hints for taking a step forward, such as an example of analysis work that is currently being performed.