What is Endpoint Detection and Response (EDR)?

Talk to any security expert in the field who has a few years of experience under their belt, and they will tell you the current threat landscape is ever-evolving and it takes a lot of effort and expertise to stay on top of the continual development and attacks of malware. There are approximately 86,000 new malware products produced every day. To make matters worse, security provider FireEye says that “82 percent of all malware it detects stays active for a mere hour, and 70 percent of all threats only surface once, as malware authors rapidly change their software to skirt detection from traditional antivirus solutions. The function signature-based AV serves has become more akin to ghost hunting than threat detection and prevention.”

What is Endpoint Detection and Response?

Traditional measures like antivirus and a firewall are not cut out to defend against the constant onslaught of malware attacks and must be supplemented with Endpoint Detection and Response (EDR) to develop a layered network defense. EDR looks deep into your system, analyzing and recording all activity. Network Intrusion Detection/Prevention Systems (IDS/IPS) and Security Information Event Managers (SIEM) have been using similar techniques for years now in that they record, correlate, and analyze. The difference is that EDR has a more focused dataset toward endpoints and different metadata. This allows for different types of correlations and detection techniques.

Why do I Need Endpoint Detection and Response?

With cyber security, there is no one solution that will stop all threats, so a layered security approach is necessary to protect against the many different attack vectors facing your endpoints. Good protection might start with a good anti-malware program followed up with vulnerability management, configuration management (OS hardening) and application whitelisting. However, all of these solutions can be difficult to manage due to the rate at which new threats are released each day and the fact that cybercriminals are constantly updating and changing their attack vectors.

Because most of these traditional means of network protection have been failing, we have been left with the conclusion that it’s not a matter of if an attacker will breach our defenses, but when. This presents the question, “What will happen when an attacker gets by my defenses?”

You can start putting those questions to rest using EDR. EDR is very focused and goes beyond malware and detects what other mechanisms can’t. It continuously monitors activity, looking for Indicators and Patterns of Compromise (IoC/PoC). Beyond detection, EDR also offers response capabilities. This means that when you do get hit, you’ll be able to isolate the activity and remove the threat.

Why do I need WatchPoint?

Having the tools necessary to properly detect and respond to threats is certainly important; however, it’s only half the battle. Learning to use the toolset comes with its own challenges and can quickly overwhelm even seasoned technicians. Beyond learning the skillset of becoming a Security Analyst and Forensics Expert, you must also continuously stay on top of the current threat landscape. As new threats and techniques are unmasked, you must then apply this knowledge to hunt for threats inside your network. WatchPoint specializes in these techniques and can take the hassle out of deploying and administering EDR. We offer the ability to quickly and easily deploy the toolset by just downloading and installing a sensor. The security analysts and forensic experts at WatchPoint will take care of the rest. 

Further Reading:

Three Common Ways Ransomware Enters Your Network

WatchPoint - Tip of the Week - Lessor Known File Extension Tricks Used By Hackers

Best Ransomware Protection

Steps to Protect Your Network From Ransomware Attacks

Why Didn’t My Antivirus Detect Ransomware?