Endpoint security

Endpoint Detection & Response

/in /by

Endpoint Detection & Response (EDR) is a complex endpoint security system that combines real-time monitoring and collection of endpoint data with rules-based automated response and analysis capabilities.

The main functions of an EDR security solution are:

  • To monitor and collect data from endpoints that could indicate a threat;
  • To analyze this data to identify threat patterns;
  • To automatically respond to identified threats to remove or contain them, and notify the IT security team;
  • Forensics and analysis tool to research identified threats and search for any suspicious behavior.

Adoption

The EDR adoption will only increase over the next few years. According to Stratistics MRC’s Endpoint Detection & Response: Global Market Outlook (2017-2026), sales of EDR solutions, both on-premises and cloud-based are expected to reach $7.27 billion by 2026, with an annual growth rate of about 25%.

One of the factors pivoting the EDR adoption is the rise in the number of connected endpoints. Another important factor is the increased sophistication and complexity of modern cyberattacks, which usually focus on endpoints as some of them are easier targets for breaching networks.  Insurance carriers are also beginning to require an EDR solution to be able to provide cyber insurance.

Endpoint Attacks

The average IT department has thousands of endpoints under management. These endpoints are desktops, servers, laptops, tablets, smartphones, smart watches, and digital assistants.

The SANS Endpoint Protection and Response Survey reveals that 44% of IT teams manage between five thousand and five hundred thousand endpoints. Each of these endpoints is susceptible to become an open door for cyberattacks. Endpoint visibility is therefore crucial.

Modern antivirus solutions can identify and block many new types of malware. However, cybercriminals are constantly adapting their methods. Many types of malware are untraceable by standard solutions. For instance, polymorphic malware which is a type of malware that constantly changes its identifiable features to avoid detection, or fileless malware, a recent development that operates in the computer’s memory and avoids malware signature scanners.

To improve cybersecurity, an IT department may implement several endpoint security solutions, as well as other security applications, over time. However, multiple self-sufficient security tools can overcomplicate the threat detection and prevention process, especially if they overlap and produce similar effects. The better approach is an integrated endpoint security solution.

EDR Security: Components

EDR security integrates the collection, correlation, and analysis of endpoint data, as well as alerting and responding to imminent threats.

EDR tools have three major components:

Data collection software agents. These agents handle endpoint monitoring and collect relevant data about certain processes, connections, and data transfers.

Automated response. Pre-configured rules in an EDR system can identify known types of security threats and can trigger automatic responses, such as logging off the user or alerting a team member.

Analysis and forensics. An endpoint detection and response solution can incorporate real-time analytics, for fast diagnosis of threats, and forensics tools, for threat hunting or conducting post-attack analyses.

Forensics tools enable IT security personnel to investigate breaches to better understand how an exploit managed to penetrate security. The IT security staff also uses forensics tools to identify threats within the system, such as malware or other exploits that might pass undetected to an endpoint.

EDR Capabilities

New features and services are expanding EDR systems’ capabilities to detect and investigate threats.

Threat intelligence services provide organizations with large pools of information on current threats and their characteristics. That collective intelligence helps increase an EDR’s ability to identify exploits, especially multi-layered and zero-day attacks.

In addition, new investigative capabilities in some EDR solutions leverage artificial intelligence and machine learning to automate the investigative process. These capabilities will allow the EDR solutions to learn more about the baseline behavior of an organization, and it will use this information, along with a variety of other threat intelligence sources, to defend the organizations’ systems.

Information such as IP addresses and registry keys change frequently. However, identifying patterns and characteristics that remain unchanged is therefore crucial. An EDR solution can use the common behavior to identify threats that may have been altered in other ways.

IT security teams face steadily more complex cyberattacks, as well as increased diversity in the number and types of endpoints accessing networks, so an advanced solution to deal with this situation is recommended, and sometimes required.