IDC Technology SpotlightSponsor: Kaspersky
Authors:
Mark Child
Frank Dickson

Integrated Cybersecurity Delivers Efficiency andEffectiveness in a Challenging Environment

July 2020

Lack of Integrated Security Puts Organizations at Risk
According to IDC research, the majority (75%) of organizations worldwide
recognize that the security team's time is wasted due to a needless lack ofintegration in its security environment.

Security teams must beable to operate efficiently
and effectively with thetools they have.
Otherwise, theirorganizations risk
damaging cyberattacks
that can impact theiroperations, businessstrategies, andreputations, as well as
potentially leaving themliable to regulatory
penalties.

Organizations are already struggling with two major security challenges. First, an
intense multifaceted cyberthreat landscape. The environment is characterized by a
growing number of commercially available threat kits on the Dark Web, creating alower barrier to entry for unsophisticated attackers. Second, motivatedcybercriminal gangs and nation-state attackers can create volumetric attacks (suchas DDoS) and very specifically targeted attacks through blended threats.
The recent COVID-19 pandemic makes most cyber-risks more relevant. After
April 3, IDC saw a dramatic rise in concern over threats such as ransomware,phishing, and business email compromise (Figure 1):

Figure 1
Views on Risk Evolving with the Pandemic — Leaning More on Existing Security
Products
Please rate the relevance of endpoint security products in mitigating thefollowing risks (1 = irrelevant to 5 = very relevant)20,0%Ransomware

37,5%
22,0%

Phishing

37,5%
25,0%

Business email compromise (BEC)

32,3%
38,0%

Malware infection and propagation

38,7%

40,0%

Leaked personally identifiable
information (PII)

35,1%
0%

5%

10%

15%

20%

25%

30%

35%

40%

45%

Percentage of SMBs selecting "5" (very relevant)March 23–April 2 (n = 60)

April 3–April 13 (N = 248)

Source: IDC 2020 North America SMB Security Survey, N=308

IDC #EUR246697420

INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

Additionally, security professionals are in short supply globally. IDC’s Worldwide
Technology Employment Impact Guide for H2 2018 projected that 10.5 million
additional full-time employees would be needed over the 2018–2023 period toprovide specialized IT skills, of which 9.6% would be in security. A recent studyby (ISC)2 found more than 4 million unfilled security positions worldwide in
2019. Of these, 561,000 were in North America.
This combination of factors makes it paramount that security teams operate
efficiently and effectively with the tools they have. Otherwise, their organizations
face significant and growing risks of damaging cyberattacks that can impact theiroperations, business strategies, and reputations, as well as potentially leaving themliable to regulatory penalties.
Achieving effective security operations remains a major challenge. Frankly put,
North American security respondents comment that impediments to security
include insufficient tool capabilities, existing tools being too hard to use,
insufficient staffing, and existing security professionals having insufficient skills. IT
purchase criteria reflect this reality. Customer satisfaction and customer service are
becoming increasingly important (Figure 2):

Figure 2
Non-feature IT Product Selection Criteria
Which of the following technology buying criteria will be the mostimportant in your next technology purchase decision?
Customer satisfaction

38,9%

Customer service

26,1%

Speed of implementation

24,1%

Ability to deliver remotely

22,6%

Ease of use in doing business

18,9%

Vendor's ability to deliver offering

14,8%
0%

5%

10%

15%

20%

25%

30%

35%

40%

Respondents

Source: COVID-19 IMPACT ON IT SPENDING Survey (Survey conducted during 4th June to 15th June
period), IDC, June, 2020, N = 162 North American Respondents

Substantial time can be lost on the manual processes of investigation and analysis
and on alternating between unintegrated systems during a security incident triage.
The rationalization and integration of the security portfolio can therefore deliverconsiderable benefits to the organization in terms of man-hour efficiency andincident response times.
Improved integration also enables more of the incident response process to be
automated, reducing the potential for errors that may occur as analysts correlate
data from different systems. According to IDC's 2020 Data Security Survey,
complexity is the biggest barrier to adoption/implementation in the organization,ahead of a lack of budget and a lack of staff.

IDC #EUR246697420

2

INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

Reducing the burden on security staff to manage disparate tools and solutions
within the estate frees them for higher-value tasks (e.g., in-depth incident forensics
and analysis and the investigation of higher severity incidents). Increased
automation reduces the likelihood of alert fatigue or analyst burnout due to too
many mundane tasks. The overall improved efficiency and effectiveness enabled byintegration and automation allows security teams to operate more strategically,rather than just managing day-to-day operations.
Organizations also gain from accelerated and more effective responses. The overallcyber-resilience of the organization is boosted by the sharing of insights and threat
intelligence from different security tools and functions.

Endpoint Security Key to Improving Security Posture
Endpoint security investments in 2019 constituted the second biggest share of theNorth American security market (28.1%), closely following the security analytics,
intelligence, response, and orchestration category. The endpoint security market isprojected to expand at a compound annual growth rate (CAGR) of 4.5% over the
next five years. The vast majority of growth is found in the corporate sector.
Endpoint devices are a primary target for cybercriminals seeking to gain access tocorporate networks. This vulnerability has intensified in the post-perimeter era due
to both digital transformation initiatives and a surge in work-from-home policies
triggered by the COVID-19 pandemic. Simply put, IDC regards endpoints as a key
control point of protection in the post-perimeter era.
The COVID-19 pandemic has accelerated the importance of the endpoint as a key
control point. U.S. IT executives were asked to predict the past, present, and future
percentages of remote workers. The results were startling. Simply put, even after
the pandemic, workers will not necessarily return to the office.

Figure 3
What will the new normal be? Five times more employees will work fromhome in 2021.
What percentage of your organization's employees were working fromhome before COVID-19? What percentage are working from homenow? And what percentage do you anticipate will be working from homein 2021?
Before COVID-19

6,4%

Now

52,7%

In 2021

29,8%
0%

10%

20%

30%

40%

50%

60%

U.S. (n = 101)

Source: COVID-19 IMPACT ON IT SPENDING Survey (conducted during 21st May to 28th May period), IDC,
May 2020

IDC #EUR246697420

3

INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

Traditional signature-based detection methods are open to criticism, but theyremain an efficient means to scan large volumes of files and block known threats.
Relying on signature-based protection alone, however, would be pure folly. To
provide complete protection, a signature defense requires augmentation bysignatureless detection within an integrated endpoint protection platform (EPP).
The platform enables signature-based detection to protect against commodity
malware, while signatureless detection guards against new and unknown complex
threats that may otherwise evade detection.
Attention in the market to endpoint detection and response (EDR) is increasing asorganizations seek to enhance protection capabilities and detect advanced threats
and targeted attacks. EDR has armed security professionals with an arsenal offorensics tools beyond the historic log-based or alert-based security informationand event management (SIEM)-centric variety. It also provides a host of endpoint
telemetry, enabling security professionals to discover hard-to-find malware.
Adopting an integrated multi-layer approach to endpoint security is fundamental
to building a resilient security program. This approach requires the tight bonding of
the stack and should include EPP (reactive), EDR (proactive), and threat intelligence(TI), which can be both preventive and proactive. EPP should be expected to protect
endpoints as an independent solution. Together, EPP and EDR provide crossplatform visibility and response, stopping maliciousness that cannot possibly bedetected with endpoint activity and telemetry alone. Both are important to thecomplete security program.
TI can significantly improve an organization's security posture. On the preventive
side, TI feeds have long been used for blacklisting known threats. Proactively, TI
data and reports enable threat hunting, provide greater context during
investigations, and can help mitigate risk. From an endpoint security perspective,
the additional context that TI provides can guide security controls, increasing theeffectiveness of the solution.

The Challenges of EDR
EPP remains critical. EDR has brought many benefits, but it has two major
shortcomings:••

IDC #EUR246697420

EDR requires a human to operate it. Security professionals are in
short supply, and their time is very valuable. As a result, expectations
relating to EDR and its usability have grown exponentially. EDR tools
need to be easy to use. They also need to quickly correlate alerts torender a conviction or a benign verdict. They need to provide guided
search to enable security professionals to perform at a higher level thanthey traditionally could. Essentially, EDR tools must evolve to makesecurity professionals more efficient and effective.
The “ransomware effect" is an Achilles’ heel. The "ransomware"moniker is an oversimplification, but the reality is that the importance oftime in breach detection has risen dramatically: Malware attacks havebeen measured in milliseconds. Depending on EDR to detectransomware is a fool's errand. A manual tool cannot respond quickly

4

INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

enough to stop an attack that happens in minutes, seconds, or
milliseconds. Even solutions that use automated cloud-based analytics
are not fast enough. A round trip of 200–500ms can be punishing in aransomware scenario. Thus, EPP must address use cases for which EDR
is insufficient.
For EDR to add value to EPP in the ransomware era, EDR tools must do thefollowing:
1.
2.

Find malware that cannot be detected using telemetry on the endpoint
alone
Provide forensic information that will illuminate how malware got past
the other layers of security before it was stopped by EPP

These use cases have similar implications: The data that fuels EDR needs to comefrom more than just the endpoint. Telemetry needs to come from the network,
messaging, the web, and other infrastructure components and processes. Vendors
are starting to call this expansion "XDR," in which the "X" can stand for "crosslayer," for example.

EDR creates value byextending the view
beyond the initialboundaries of theendpoint. The "manifest
destiny" of EDR is to be atool that provides crossplatform visibility andresponse, stopping
maliciousness that evades
endpoint detection andtelemetry.

PowerShell scripts are not necessarily malicious. However, if a PowerShell script
were launched from a macro embedded in a Word file and that Word file wasfound in a recently delivered email, the chances of the script being malicious arehigh. This example is simplistic but very real. The response must go beyond
sequestering the individual endpoint. The security analyst must be able to sweep all
email accounts for similar files, block communications with command-and-control
IP addresses, update firewall rules, and force a password reset. In sensitiveenvironments, evaluating other individuals who received the same email may
provide forensic insights.
In evaluations of EDR, the conversation is very much about EPP. Expectations for
EPP have grown dramatically, and the use of an EDR is not regarded ascompensation for the possible shortcomings of EPP. EDR creates value byextending the view beyond the initial boundaries of the endpoint. The "manifest
destiny" of EDR is to be a tool that provides cross-platform visibility and response,
stopping maliciousness that evades endpoint detection and telemetry.

One Size Does Not Fit All
On a certain level, all companies’ security needs are the same: They need protection
from threats and the ability to maintain business operations. But that is where mostcomparisons end.

IDC #EUR246697420•

Although the need for protection is the same, the security resources of asmall or medium-sized business do not match those of a multinational
enterprise.

•

Security maturity varies considerably.

•

Assets within organizations are not uniform. These differences need to behandled using a risk-based approach.

5

INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

From a security provider’s perspective, a comprehensive, structured offering isrequired, one that provides appropriate levels of protection to end users across the
spectrum. Offerings need to:•Provide granularity of controls to secure heterogeneous infrastructure•

Scale to accommodate the expansion or fluctuation of infrastructure andoperations•

Provide protection in hybrid environments•

Address all fundamental components of infrastructure and processes(endpoints, network, messaging, web, mobile, cloud, and operational
technology)•

Achieve the above while minimizing the burden on the system andorganizational resources•

Be manageable through a unified and integrated solution

A Multi-Level Approach from Kaspersky
Kaspersky’s extensive experience in providing cybersecurity solutions and services
to a broad spectrum of clients has enabled it to shape an integrated approach thatmeets the needs of the mainstream market and larger, more security-mature,
customers.

Figure 4
Kaspersky’s Multi-Stage Cybersecurity Conceptual Framework

Source: Kaspersky

The bedrock of Kaspersky’s integrated platform is Security Foundations. This
includes the core features that every organization, large or small, must have toprotect itself. According to the vendor, Security Foundations can defend against
threats (including fileless malware) that comprise 90% of the overall threat
landscape.

IDC #EUR246697420

6

INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

Kaspersky Security Foundations includes Kaspersky Endpoint Security for Business(KESB), Kaspersky Secure Mail Gateway, Kaspersky Web Traffic Security, andKaspersky Hybrid Cloud Security. The full set of components is shown in Figure 2.
Kaspersky customers can selectively deploy the components and modules theyrequire to secure their infrastructures and processes. All modules benefit from
native integrations, enabling clients to rapidly gain full value from theirdeployments. The more they deploy, the more cumulative benefits accrue.
The key benefit of Security Foundations is that it offers protection against 90% of
threats. The next category of threats, evasive threats, comprises 9.9% of the threat
landscape. These complex threats are often able to evade preventive technology
and can, in the long term, do considerable damage to an organization.
Addressing these threats requires a more proactive and sophisticated set of tools.
This is represented by Kaspersky Optimum Framework, the next level of the
pyramid. Kaspersky Optimum Framework includes Kaspersky EDR, Kaspersky
Sandbox, and Kaspersky Threat Intelligence Portal. Customers can deploy
components individually. However, the vendor also offers bundles, such as KESB
with EDR Optimum (i.e., EDR for midmarket clients).
Organizations that have deployed or adopted Security Foundations and Optimum
Framework have acquired protection against the vast majority of cyberthreats. They
can consider themselves at the higher end of the security maturity spectrum.
That leaves the 0.1% of targeted attacks. It is here that organizations need the elite
protection of Kaspersky Expert Framework to support their security operations
center (SOC) teams.
A comprehensive evaluation of this most advanced offering is beyond the scope of
this report. More detail is available in this companion publication1.
All Kaspersky customers benefit from being able to select and deploy specificmodules that directly address their security requirements or to take advantage ofbundled offerings. Native integrations ensure that all components operate together
seamlessly, giving the security team the advantage of operating a unified platform.
However, Kaspersky has conceived its cybersecurity framework as a maturity
spectrum through which organizations can plan strategically, elevating theirsecurity postures over time through the deployment of additional integrated
components and services. Two key elements are Optimum Framework and Expert
Framework.

Kaspersky’s Optimum Framework for the Mainstream Market
Optimum Framework is aimed at organizations that have limited IT security
capabilities but need to protect themselves against advanced threats. The corecomponents of Optimum Framework are KESB, Kaspersky Sandbox, and EDR
Optimum, all run from a single console, providing protection to all endpoints,
including servers and virtual machines. The vendor cites two key benefits to
deploying KESB and Kaspersky Sandbox together. First, using dynamic threat
1

IDC #EUR246697420

IDC Technology Spotlight: Battle for the Modern Security Operations Center

7

INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

emulation, Kaspersky Sandbox automates "cross-endpoint" incident response
scenarios. Second, no action is required from the IT security team. This isparticularly important for companies that have limited security resources.
The EDR Optimum offering adds an additional level of protection on top of EPP. It
includes indicators-of-compromise (IoC) scanning, the possibility to generate
custom threat indicators, tools for root cause analysis (e.g., attack spread pathvisualization), and some automated response and threat containment capabilities.
For organizations that do not have in-house resources to take full advantage ofKaspersky EDR, the vendor offers a managed detection and response (MDR)
service, MDR Optimum. This provides a mature information security function thatcan be rapidly deployed via a fast turnkey. The service covers both endpoint andnetwork security, with a Kaspersky team managing security data collection andanalysis, incident qualification and investigation, and incident alerts and guidance.
The company offers a flexible approach to response. The hands-off option leaves
the response fully to the customer. At the next level, the Kaspersky team provides
response recommendations. The full-service option puts incident response in thehands of the Kaspersky team.
A summary of the key elements of the Kaspersky EPP, Kaspersky Sandbox, and EDR
Optimum offerings is shown in Figure 3.

Figure 5
Kaspersky Optimum Framework Tools and Capabilities

Source: Kaspersky

Kaspersky’s Expert Framework for IT Security-Mature Clients
Kaspersky's Expert Framework targets organizations with mature IT security
postures and established security teams and resources. At the broadest level, it
offers a single console to centrally manage all security functions — endpoint,
network, mail, and web defense — against targeted attacks and advanced
persistent threats. It covers monitoring, visualization, notification, and reporting;advanced threat discovery; deep investigation and threat hunting; and incident

IDC #EUR246697420

8

INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

response. As with Optimum Framework, in-house tools and capabilities arecomplemented by Kaspersky's MDR offering (in this case, MDR Expert). As might be
expected, this provides even greater depth of service, adding items such as accessto a Kaspersky SOC analyst, extended raw data storage, access to curated featuresof the Kaspersky Threat Intelligence Portal, and custom response playbooks. A
comprehensive overview of Expert Framework is beyond the scope of thisdocument, but more in-depth information can be found here.2

Detection and Response for All: EDR and MDROver the last couple of years, the North American market has seen a rapid rise in
the use of EDR tools and MDR services. EDR tools enable threat hunting, forensic
analysis, anomaly detection, and incident response. The analytical capabilities of the
EDR toolset help security analysts detect stealthy or evasive threats, extending thedetection horizon beyond that which an EPP suite can deliver. Some North
American organizations have invested in EDR to complement and enhance theirendpoint protection suites. But benefiting from these tools requires dedicatedanalysts. This raises the questions of security headcount and skills shortages —issues that impact all but the most affluent organizations or those whose assets,
activities, and/or regulatory obligations demand the most stringent security.
However, endpoint security affects all organizations. In April 2020, IDC surveyed
308 North American companies with up to 2,500 employees about cybersecurity.
On average, each company (based on estimates given in the survey) runs 337
endpoint agents to analyze its endpoint equipment (workstations, laptops,
detachable tablets, and other mobile devices).
The situation has created a ripe market for MDR services, one in which EDR tools
are run on behalf of clients by managed security services providers (MSSPs). This
segment has grown rapidly, with players coming from the security solutions side(e.g., Kaspersky) and the services side. Most MDR providers offer tiered services
with multiple levels of dedicated support, reporting, threat hunting, and incident
response to meet the needs of all customer groups. Because not all organizations
have the resources to run EDR themselves, these services fulfill a market need. IDC
expects demand to continue to rise in 2020 and beyond.

Challenges
Kaspersky has developed a comprehensive and complex portfolio and mapped out
detailed frameworks to guide organizations in addressing endpoint security andsecurity integration. Nevertheless, the vendor faces challenges in executing its
vision.
The MDR market is growing rapidly in the U.S. and Canada and is home to a largepool of players. These comprise both strong EDR solution providers and vendoragnostic MSSPs, which have teams of highly skilled and experienced analysts. It will
be a challenge for any vendor to differentiate themselves in this space. Doing so
will require an appropriate investment of resources to ensure clients feel they are

2

IDC #EUR246697420

IDC Technology Spotlight: Battle for the Modern Security Operations Center

9INTEGRATED CYBERSECURITY DELIVERS EFFICIENCY AND EFFECTIVENESS IN A CHALLENGING ENVIRONMENT

getting the service they have paid for. Of course, the ultimate measure of success iswhether a company is protected from breaches. CISOs, however, may also need tojustify to the board that their investments are delivering returns. It is important that
Kaspersky is ready to support its MDR clients with the metrics they need.

The breadth ofKaspersky’s cybersecurity
solutions and services andthe wide spectrum ofclients it serves haveenabled the vendor toshape an integrated
cybersecurity approach tomeet the needs of boththe mainstream market
and larger, more securitymature, customers.

Kaspersky's graduated approach and its Optimum Framework show that the vendor
is well positioned to help midmarket companies that have a strategic outlook on
improving their security postures. However, at the high end of the market, thevendor faces entrenched enterprise security players with established clients. A
major benefit of Kaspersky's platform is the native integrations of its modules andcomponents — from the security foundation level to the integrated cybersecurity
level — and the cumulative benefits that accrue from deploying more modules. The
more extensive a deployment is, however, the more legacy products must be
displaced.
Kaspersky's offering is an extensive stage-by-stage approach (see Figure 2) thatfeatures both numerous standalone components and services within the Security
Foundations, Optimum Framework, and Expert Framework layers and the dual tierof EDR and MDR, as well as providing further options around regular EDR and
automated EDR and MDR. The vendor must ensure that customers and prospects
receive a clear message that Kaspersky can help them find the most effective
combination of solutions and services to meet their needs.
Finally, germane to the global economic consequences of COVID-19, the economic
drag is heavier than the technical benefit lift for companies purchasing
cybersecurity solutions. In February 2020, the National Bureau of Economic
Research said the U.S. fell into recession, ending a 128-month economic expansion.
The practical effect is that all industries are hurt, but cybersecurity investments may
be more resistant to cuts in some sectors.

Future Outlook
Facing an extensive and intense threat landscape and struggling to manage
security operations with limited teams and fragmented security infrastructure,companies need integrated and unified cybersecurity solutions. The breadth ofKaspersky’s solutions and services and the wide spectrum of clients it serves haveenabled the vendor to shape an integrated cybersecurity approach to meet theneeds of both the mainstream market and larger, more security-mature, customers.
Kaspersky regularly scores highly in independent tests of its products against
known, unknown, and advanced threats. The vendor is also well-regarded for its
security research, which it publishes regularly. Kaspersky has the vision, theapproach, and the frameworks. Its task is to communicate these strengths to themarket and lead its clients on the journey to improved cybersecurity.

IDC #EUR246697420

10

IDC UK

About IDC

5th Floor, Ealing Cross,
85 Uxbridge Road
LondonW5 5TH, United Kingdom
44.208.987.7100
Twitter: @IDC
idc-community.com
www.idc.com

International Data Corporation (IDC) is the premier global provider of market
intelligence, advisory services, and events for the information technology,
telecommunications and consumer technology markets. IDC helps IT
professionals, business executives, and the investment community make factbased decisions on technology purchases and business strategy. More than
1,100 IDC analysts provide global, regional, and local expertise on technology
and industry opportunities and trends in over 110 countries worldwide. For 50
years, IDC has provided strategic insights to help our clients achieve their key
business objectives. IDC is a subsidiary of IDG, the world’s leading technology
media, research, and events company.

Copyright and Restrictions:
Any IDC information orreference to IDC that is to be
used in advertising, press
releases, or promotional
materials requires priorwritten approval from IDC. For
permission requests contact
the Custom Solutions
information line at 508-9887610 or permissions@idc.com.
Translation and/or localizationof this document require an
additional license from IDC.
For more information on IDC
visit www.idc.com. For more
information on IDC Custom
Solutions, visit
http://www.idc.com/prodserv/custom_solutions/index.jsp.
Global Headquarters: 5 Speen
Street Framingham, MA 01701
USA P.508.872.8200
F.508.935.4015 www.idc.com.
Copyright 2020 IDC.
Reproduction is forbidden
unless authorized. All rights
reserved.

IDC #EUR246697420