The EDR, Firewall, & XDR: Security Tools in Tandem

MDM. EDR. XDR. SIEM. DLP. IAM. CASB. SOAR.

If you follow anything cybersecurity-related, you know we have a little acronym problem. There are so many security tools with three and four-letter names that half the time you're nodding along in meetings while internally thinking, "I should probably know what that is by now."

I had a similar thought when I was flooded with newsletter emails regarding XDR. Extended Detection and Response. I thought, "Welp, another thing I need to learn. But wait, how is this different from EDR? Are these competing tools, or is one replacing the other?"

That question morphed into a recall of the function of each. I thought "If EDR monitors endpoints and firewalls monitor the network, aren't they basically doing the same job in different places?" But then I got even more curious about whether there is an intersecting point where their functions overlap? Turns out, my assumption was way off.

What Each Tool Actually Does

Firewalls are the security checkpoints that sit at the network perimeter. Their goal is to control which traffic comes in and which goes out based on allow and deny rules. If you add an IP address to a deny rule, the firewall is responsible for blocking incoming/outgoing traffic. If you explicitly allow traffic on port 443, traffic from the HTTPS protocol will flow in and out of the network. The firewall collects information during traffic inspection and makes these decisions based on the access control list.

The EDR does its work on the endpoints themselves, e.g., laptops, desktops, servers. While the firewall is watching traffic at the border, the EDR is monitoring the activity on each device. It is on the lookout for any process behaving strangely and behaviors that are abnormal based on patterns. The goal of the EDR is to catch the threats that make it past the perimeter or those that originate from within the network.

I imagined a scenario where the firewall sees a connection request from an external IP. It will check its rules and find nothing suspicious, so it then allows that connection. However, that connection drops malware onto a laptop. The firewall actually did its job correctly because the connection did not appear malicious based on the information it had. But that's where the EDR takes over, because its objective is to watch that laptop's behavior, and it should catch the malware when it tries to execute.

Why You Need Both

This is a simple version of defense in depth. Defense in depth isn't about having one flawless security tool. It requires layering protections so that when one layer misses something, another layer catches it, like in the example above.

Let's say an employee clicks a phishing link on their work laptop. The firewall might not block it if the phishing site looks legitimate and uses HTTPS, so the connection would go through. As a result, malware might be downloaded during the user's browsing session. When that malware tries to execute on the laptop, the EDR sees the unusual behavior, identifies it as a threat, and will likely isolate the device before the malware can spread across the network.

Let's consider another example. Let's say an attacker compromises an employee's login credentials and signs in from an unusual location. If the firewall rules don't take geographic restrictions into account, that login attempt will be successful. The EDR on that employee's computer would notice unusual file access patterns, lateral movement, or other suspicious behavior that may indicate a compromise.

The XDR Question

So what about XDR? The thing that started this whole rabbit hole for me. Extended Detection and Response basically tries to connect data from all your security tools, i.e., EDR, network detection, cloud security, and email security, into a single unified system. Instead of each tool working separately, the XDR would correlate data across all of them to spot attacks that spread across multiple layers.

The XDR aims to extract more value from the existing detection tools by connecting the dots between what the firewall sees during traffic inspection and what the EDR sees during endpoint monitoring.

What I Wish I'd Known

When I first encountered all these security tools, I thought they were competing solutions where you pick the best one for your needs, but after a bit of research, I found that's not exactly how effective enterprise security is designed. These tools are built to work together, with the goal of one covering blind spots the others have.

The firewall can't see what's happening inside your endpoints. The EDR can't block malicious traffic before it reaches your network. But together, they create overlapping defensive layers that make it significantly harder for attacks to succeed.

Don't get intimidated by the alphabet soup of security acronyms. Once you understand what each tool actually does and where it fits in the security architecture, the confusion quickly turn into knowledge.