Sooner or later, every company faces the need to upgrade its infrastructure \u2014 whether to accommodate expansion, optimize processes, or keep up with the latest trends in IT. When such a decision is made, company management typically thinks first and foremost about broad changes at the platform level \u2014 assuming that applications can simply be reinstalled and everything will work as before. And to a certain extent, that\u2019s actually true. In an era when corporate security could be ensured solely by antivirus software on workstations, that would have worked; however, modern cyberthreats require protection at a fundamentally different level.<\/p>\n
In this post, we explore why platform migration should be discussed with the security team as well, and why simply \u201cinstalling a program\u201d isn\u2019t enough to ensure modern-day protection.<\/p>\n
In the past, securing endpoints was enough to prevent most attacks. In today\u2019s environment, endpoint protection is just one layer of cybersecurity. A modern extended detection and response (XDR) solution isn\u2019t a single application installed on a computer; it\u2019s a set of components that work in conjunction. They provide protection for workstations and servers, event logging and storing, infrastructure-level threat detection mechanisms, investigation tools, automated response, reporting, and asset management. Each component serves a specific purpose and places different demands on the hardware and platform.<\/p>\n
For the event storage system<\/em>, disk speed is the most critical factor. In a large company, the security system generates millions of records per day, and all of them must be written quickly and then retrieved just as quickly when needed. The bottleneck here usually isn\u2019t processor capabilities, but rather how fast the system can read and write data.<\/p>\n Threat detection <\/em>requires computing power. The system compares events in real time and determines what can be a sign of an attack, and what is normal operational activity.<\/p>\n Response time is critical for investigation tools<\/em>. When an analyst investigates an incident and pieces together what happened, they work in real time, and every second of waiting adds to the overall response time to the attack.<\/p>\n What does this mean? When a company switches platforms, it\u2019s not enough to simply verify that the company\u2019s existing cybersecurity solutions support the new architecture. The answer \u201cyes, it\u2019s supported\u201d is too vague. It\u2019s essential to clearly understand exactly which parts of the cybersecurity architecture are supported \u2014 starting from which version, and what is still under development.<\/p>\n To avoid unexpected complications during implementation and operation, we recommend asking the right questions in advance \u2014 during the planning phase. Here are those questions:<\/p>\n The question shouldn\u2019t be phrased as \u201cIs the platform supported?\u201d; the compatibility of each part of the system should be verified. Different components of a modern information-security solution operate under different rules, which is why their compatibility is tested separately. A one-word \u201cyes\u201d answer should raise a red flag: a reputable vendor will always provide a detailed response \u2014 including a list of components and any caveats (where applicable).<\/p>\n \u201cIt will run\u201d and \u201cit will handle needed data volume\u201d are two fundamentally different statements. The former is verified in a lab on a test bench; the latter depends on how many events specific infrastructure generates per day, and how long the company is required to retain them under regulatory or internal policies. It makes sense to ask the vendor for recommendations on calculating resources based on specific data volumes rather than relying on general minimum resource requirements when planning.<\/p>\n It\u2019s always important to clearly understand which version of the cybersecurity solution supports the new platform. It\u2019s not uncommon for different parts of the infrastructure to be protected by different builds of the same solution. Sometimes this is because new features didn\u2019t seem particularly critical; other times it\u2019s because the IT security team was waiting for a convenient time to update so as not to disrupt business processes. If the security team won\u2019t verify right away that all builds already support the new platform, the IT department may suddenly find itself having to make urgent changes to the migration schedule because updating the security solutions will require its own maintenance window and approvals. It\u2019s better to find this out at the start of the project rather than deep into the process.<\/p>\n Sometimes the availability of certain features depends not only on the product version but also on the specific licenses the company has purchased. It\u2019s more cost-effective to clarify this during the design phase.<\/p>\n None of these questions require in-depth technical knowledge; a project manager can easily ask them. But when asked at the right time, they eliminate most of the unpleasant surprises that usually surface during the implementation of a new platform.<\/p>\n We\u2019re constantly expanding the list of platforms supported by our solutions, and strive to describe their compatibility in as much detail as possible \u2014 like versions, component composition, and honest disclaimers where applicable. For example, the latest versions of Kaspersky NEXT XDR Expert<\/a> and Kaspersky NEXT EDR Expert<\/a> now support the Nutanix 7.3 hypervisor.<\/p>\n For companies planning to build their infrastructure on this platform (or migrate over to it) this means one thing: the compatibility issue goes from being a roadblock to being resolved. There\u2019s no need to postpone securing the infrastructure until the migration is complete, or to deploy cybersecurity solutions in an untested configuration \u2014 cybersecurity is now integrated into the migration project on a par with other systems.<\/p>\nWhat to ask before it\u2019s too late<\/h2>\n
Which specific components have been tested on the new platform?<\/h3>\n
Will there be sufficient resources to handle the company\u2019s workload?<\/h3>\n
Is the security solution up to date?<\/h3>\n
Are there any licensing restrictions?<\/h3>\n
How do we help?<\/h2>\n