How secure are the devices that access your company networks? Can you rest easy, knowing that something is monitoring threats that exploit people's laptops and smartphones? Most organisations are not as secure as they believe. Phishing in particular diminishes most endpoint security measures, including antivirus and endpoint protection platforms.
This is why more organisations are adding Endpoint Detection & Response (EDR, but many still misunderstand this security concept or mistakenly think it's part of their other security services. What is EDR and its purpose, how does it differ from other security services, and what should you consider if you plan to invest in EDR?
Endpoints are at risk
Business environments need to trust endpoint devices, yet these come with serious security risks. Due to productivity and device owner dynamics, they often don't enjoy as much security control as other business systems. There are many different types of endpoint devices from countless manufacturers, and endpoint devices represent everything from low-risk users to high-value targets.
Criminals exploit these uncertainties, and it's no surprise that endpoint devices are by far the most common targets to start an attack. All it takes is one email or website masking malware for the bad actors to find a way in.
"These attacks are sophisticated, blending different techniques to avoid triggering the signature-sensors of antivirus software," says Gerhard Swart, Chief Technology Officer at Performanta. "Modern attacks often sneak snippets of software and configurations into the environment, turning standard services into criminal tools."
This subterfuge makes it much harder to spot an attack in progress and explains why standard endpoint security is no longer effective. And the monitoring systems that keep other business areas safe don't have the correct focus to effectively catch clandestine endpoint attacks. Hence the growing appeal of EDR, a more modern way to detect and tackle endpoint attacks.
The new generation of device security
EDR was first coined in 2013 by Gartner, referring to a set of tools that continually capture and study device data to spot any strange activities. An EDR system checks for threats 24/7, using data and forensic features to analyse device traffic and behaviour. Unlike signature-based systems, it can detect unknown threats. EDR forensics are also very useful to determine the root cause of an attack.
Adding EDR to security provides a massive edge to spot and stop advanced attacks. But EDR is not a simple addition. If you believe EDR will add value to your business, Swart suggests some adoption considerations to take into account:
● EDR represents a bundle of different services, which can be deployed in several ways. You can add EDR as a standalone service or as an add-on to a larger security platform.
● Managed security service providers (MSSPs) are often the best choice for EDR, because worthwhile MSSPs should have the prerequisite services, integrations and skills to run such EDR solutions.
● EDR systems work particularly well when integrated with a security operations centre (SOC) and security information and event management (SIEM) service.
● A thriving EDR environment needs specific security and technology skills, which may be expensive to keep in-house.
● EDR systems require careful configuration to match business and user requirements. It's a continual investment, not an install-and-forget project.
● Scaling EDR can be tricky since different parts of the business (and their devices) often have unique needs.
An important security investment
Adding EDR is not a simple task. But the investment for security and lowering risks make it worthwhile, providing advanced and proactive protection, deep logging, and centralised oversight over the most vulnerable part of every business network: the endpoint devices.
"Adding EDR can be tricky, which is why some places avoid it and others end up with EDR solutions that don't work," says Swart. "There are many reasons why EDR can go wrong or cost too much. But it is a vital piece of security because it focuses on the spaces that the bad guys target most often with the newest attack techniques. I recommend talking to a trusted security provider with a track record in deploying and maintaining EDR systems."
It's a reality that attacks on endpoint devices will only become worse. But that's why EDR exists; it keeps an eye on the most vulnerable parts of our digital world.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version