Cisco is introducing automated recovery into the ransomware response process of its Cisco Extended Detection and Response (XDR) solution.
In what Cisco describes as AI-powered "first-of-its-kind capabilities", the vendor significantly enhances its XDR offering by adding near real-time recovery for company operations after a ransomware attack.
The update marks Cisco's next stage in building towards a fully secure Cisco Security Cloud — a unified, AI-powered, cross-domain security platform.
Jeetu Patel, Executive Vice President and General Manager of Security and Collaboration at Cisco, commented:
The exponential growth of ransomware and cyber extortion has made a platform approach crucial to effectively counter adversaries. Our objective is to build a resilient and open cybersecurity platform that can withstand ransomware assaults and recover with minimal impact, ensuring uninterrupted business operations."
Cisco XDR was first launched at the RSA Conference this year, providing comprehensive telemetry and visibility across the network and its endpoints. The XDR's functionality has been dramatically enhanced by minimising the critical time between the beginnings of a ransomware outbreak and capturing a snapshot of business-critical information to almost zero. Cisco XDR empowers new, unprecedented degrees of business continuity.
"As a global infrastructure provider that built the network, Cisco is redefining what a security product should deliver," Patel added. "Our innovations with automated ransomware recovery are a significant step towards achieving truly unified detection and response data, turning security insights into action."
Cisco's Talos Incident Response (IR) team trialled the solution during the second quarter of 2023. They responded to the highest number of ransomware engagements in more than a year. The new features in Cisco XDR enable Security Operations Center (SOC) teams to automatically detect, snapshot, and restore the business-critical data at the initial signs of a ransomware attack. This means SOC teams can even isolate the attack before it moves laterally through the network to find high-value data.
Exciting New Third-Party XDR Integrations Around Data Backup and Recovery
Cisco is also expanding its set of third-party XDR integrations to encompass industry-leading infrastructure and enterprise data backup and recovery businesses, with Cisco announcing a partnership with Cohesity and its DataProtect and DataHawk solutions.
"Cybersecurity is a board-level concern, and every CIO and CISO is under pressure to reduce risks posed by threat actors. To this end, Cisco and Cohesity have partnered to help enterprises around the world strengthen their cyber resilience," explained Sanjay Poonen, CEO and President, Cohesity. "Our first-of-its-kind proactive response is a key piece of our data security and management vision, and we're excited to bring these capabilities to market first with Cisco."
For systems assigned to a Cohesity protection plan, its products offer configurable recovery points and mass recovery. Cisco XDR's new features enhance that core feature set by preserving possibly infected virtual machines for forensic investigation while securing data and workloads in the rest of the environment.
