The Current Threat Landscape and Endpoint Security
Over 7 billion global devices in an always on and continuously connected world create a soft target for today’s attacker. Whether working to monetize data or make a political statement, adversaries are well funded and staffed in the battle for endpoint access and control. Traditional endpoint security methods such as anti-virus software are no match for the growing sophistication and volume of advanced threats found in the current threat landscape. According to the Ponemon Institute, over 52% of businesses have experienced a security incident that has bypassed traditional defenses. Modern cybersecurity threats evade signature-based detection and are useless against advanced threats such as insider risks, zero-day attacks, and file-less malware. This growing security gap is the catalyst for Endpoint Detection and Response solutions.
What is EDR?
Data breaches take an average of 197 days to be uncovered, and organizations often receive notification via law enforcement or card holder merchant services instead of detecting the breach themselves. Reducing the time attackers spend in an organization – called dwell time – and detecting incidents sooner can have a dramatic improvement in data breach costs and protecting brand reputation. Gartner Research defines Endpoint Detection and Response (EDR) solutions as those that record and store endpoint-system-level behaviors, use various data analytics techniques to detect suspicious system behavior, provide contextual information, block malicious activity, and provide remediation suggestions to restore affected systems. There are usually two product approaches to EDR: self-managed EDR software or a managed service. Organizations of all sizes and verticals are embracing EDR and anomaly detection as a crucial way to prevent, detect, respond to, and predict cybersecurity attacks. In addition, Gartner Research is forecasting a 3x increase in EDR adoption through 2020.
What Are Considered Critical EDR Capabilities?
The EDR market is still evolving with solutions and providers varying widely in features and scope. However, the majority of EDR solutions encompass these five primary capabilities:
From insights into unfolding endpoint attacks to root cause analysis and blocking of actual threats, rapid detection is essential to stop threats early. While many small and mid-sized businesses (SMBs) understand the need for better security effectiveness, they may not be familiar with all the options for advanced threat detection or know where to start. All too often, overworked IT teams opt to re-image a laptop without a full investigation into root cause and a forensic investigation of the scope of the compromise. The result? A loop of re-compromise as the adversary capitalizes on systemic weaknesses in people, processes, and technology that negatively impacts business resiliency.
What Limitations Exist with Traditional Anti-Virus Security?
Anti-virus (AV) software is one traditional security tool that relies on an ever-growing library of signature-based recognition. Attackers adapt to the evolving threat landscape by changing and mutating their tactics, often reverse engineering anti-virus tools to learn how to bypass detection, according to “Endpoint Protection and Response: a SANS Survey” from June 2018. With the disclosure of more and more data breaches, SMBs realize that anti-virus software has some sizable drawbacks. Some anti-virus limitations include:
While anti-virus and next-gen anti-virus (NGAV) tools offer some level of protection, layered security defenses are needed to mitigate stealthy and mutating threats. Endpoint detection and response (EDR) is one such approach. Organizations can accelerate cybersecurity effectiveness when integrating EDR and security information and event management (SIEM), all with a managed service and 24/7 security operations center (SOC). These three components, when properly integrated and managed, provide a SMB with powerful and efficient advanced threat protection.
Conclusion
Security incidents are inevitable. Organizations of all sizes must also adapt to the changing threat landscape and further invest in detection and response capabilities. With their finite IT and security teams and resources, SMB organizations must focus on reducing the attack surface that makes them vulnerable to attackers and enabling integrated solutions such as co-managed SIEM and managed EDR service that provide defense-in-depth security.