If the term endpoint security still evokes images of signature-based antivirus software, it’s time for a refresher on how critical this technology is to your organization.
Time seemed to speed up over the past 18 months, with so many changes taking place in such a short period. For example, within the business world, digital transformation initiatives accelerated by seven years, according to a survey from McKinsey & Company. Besides the massive shift to remote work and new collaboration technologies, many companies had to update their security strategies.
One technology that’s evolved significantly over this period is endpoint security. If this term only evokes memories of signature-based antivirus, here’s a much-needed refresher to help get you up to speed.
What is endpoint security?
Like other kinds of security, endpoint security is a critical part of a company’s multi-layered defense strategy. This type of security includes protecting the points at the end of a network connection—from workstations, laptops, physical servers, and virtual machines to smartphones and tablets, and Internet of things (IoT) devices, such as IP cameras and medical equipment.
User endpoints such as laptops and workstations are particularly vulnerable because they are sometimes loosely hardened and unpatched. Plus, laptop and workstation users typically use email applications and the web, which are primary threat vectors. Once an attacker gains access to an endpoint device, they like to move laterally to servers to look for sensitive data to steal. Attackers rarely target network security devices such as routers and switches, but they will target endpoints, which are considered lower hanging fruit, like laptops and workstations.
How endpoint security has evolved in recent years
Years ago, endpoint security was primarily composed of antivirus software, which relied on installing “signatures” identified by security vendors to defend against known threats. However, as zero-day threats became more common, signatures became less and less effective.
Next-generation antivirus (NGAV) introduced an approach where it could identify malware without using signatures with the help of machine learning (ML) and artificial intelligence (AI). While this technology continues to improve, it’s not always effective at detecting fileless malware. Also, hackers are now using AI to engineer malware that intelligently evades NGAVs, lowering their effectiveness.
A complementary technology to NGAV, endpoint detection and response (EDR), refers to tools used to detect, provide visibility, monitor and investigate suspicious activities within endpoints. EDR solutions allow security departments to perform console alerting and reporting, advanced response to security incidents, broader geographic support over large regions, managed detection and response (MDR) and third-party integration.
There are additional endpoint security tools and services that work with NGAV and EDR. Here are a few examples of these tools and a short description of their functionality:
- Application control can block unwanted software (i.e., malware) from running on a point-of-sale system that processes credit card data, for example.
- Device control can prevent unwanted USBs (potentially infected with malware) from being plugged into a high-value database server but allow controlled USBs to be used by authorized system administrators.
- Data loss prevention (DLP) looks for data exfiltration, whether it’s malicious, intentional or unintentional. For example, DLP can be configured to block sensitive information from being exfiltrated, such as social security numbers (SSNs). So even if a user unintentionally tries to copy a file containing SSNs to a USB, the DLP could stop the process.
- Insider threat monitoring tools look at user behavior by examining their activity and monitoring them for threats. For example, why did a receptionist log into the database? That activity isn’t a regular part of a secretary’s job description. DLP and insider threat tools exhibit some similar capabilities.
- Host-based firewalls have been around for a long time, but today’s tools are used to manage the operating system’s (OS’s) native firewall for last-ditch protection. The same management principle applies to full disk encryption, which is highly recommended to prevent data theft should a laptop be lost or stolen.
- Client management and mobile device management (MDM) go hand in hand to ensure traditional endpoints and mobile endpoints are patched to address the latest vulnerabilities and are securely configured.
Avoid these endpoint security pitfalls
The primary mistakes companies make with endpoint security technology are operational. For example, it’s critical to keep the tools up-to-date, especially with NGAV. It’s acceptable for a tool to have signatures. Still, it must also incorporate more advanced detection methods (e.g., machine learning algorithms, static/dynamic analysis) to identify modern threats such as ransomware, memory attacks, and Power Shell attacks.
When going through the testing cycle for proofs of concept for the tools, it is crucial to ensure that the software is compatible with your operating system and applications. I recall a customer who had a custom Linux implementation that exhibited performance problems that even the vendor could not resolve. Another customer didn’t size the endpoint tool server per the vendor’s recommendations, which caused issues with the tool. Consulting services may have helped these customers.
Best practices and final thoughts
Choosing the best endpoint security tools and solutions for your company starts with knowing what data is stored, processed, transmitted or otherwise “touched” by your endpoints. Next, perform a risk assessment for the data and decide which tool(s) you should employ to mitigate the risk. Bear in mind not all endpoints are created equal; a point-of-sale system will typically be more “locked down” than a user’s laptop. Additionally, a point-of-sale lockdown mechanism wouldn’t necessarily be appropriate for a high-performing database server.
In a nutshell:
- Know your data and your compliance requirements
- Define the use cases for the endpoints in your organization
- Size the tools for the job following the vendor’s recommendations
- Configure everything to best practices
- Test the tools on all your operating systems and ensure they don’t interfere with one another and with key applications
- Perform malware/exploit/penetration testing on the endpoints outfitted with the tools
- Record the findings and compare the results
- Get training on the tools
And finally, be realistic. No single product perfectly covers all aspects of endpoint security; more often, a combination of tools is required. Contact Presidio for assistance if you don’t have the bandwidth (or interest) to evaluate and pilot various tools and solutions.
