How Should We Think About Endpoint Security?
Along with promoting Zero Trust Architecture for cybersecurity, I see more and more discussion about EDR, MDR, and XDR. But before going into details about the pros and cons, I want to set the common field and introduce the basics about their differences.
In May, the US government released an executive order that requires federal agencies to deploy endpoint detection and response (EDR) tools. Apart from that, on the 8th of October, the Office of Management and Budget (OMB) from the Whitehouse issued a memo that clarifies how agencies should move forward on deploying EDR tools.
The memo was not just beneficial for federal agencies. It also helps organizations to assess their current endpoint capabilities. Then, as agencies adopt EDR, we could use them as a reference for other industries and explore the possibility and necessity of extending the EDR to XDR. But, first, let’s go through the basics —The definition of EDR, MDR, and XDR.
What is EPP — Endpoint Protection Platform?
According to a post on McAfee Enterprise, a long-term endpoint solution provider,
“An endpoint protection platform provides a framework for data sharing between endpoint protection technologies. This provides a more effective approach than a collection of siloed security products that lack the ability to communicate.”
Endpoint protection platforms aim to prevent traditional threats like known malware and advanced threats like fileless attacks, ransomware, and zero-day vulnerabilities. An EPP detects malicious activity using several techniques:
- Signature— detecting threats using known malware signatures
- Static analysis — analyzing binaries and searching for malicious characteristics before execution using machine learning algorithms (also known as “pre-execution analysis”)
- Behavioral analysis — EPP solutions can determine the baseline of endpoint behavior and identify behavioral anomalies, although there is no known threat signature (also known as “post-execution analysis”)
- Allowlisting and blocklisting — blocking access or only permitting access to specific IP addresses, URLs, applications, and processes.
- Sandbox — testing for malicious behavior of files by executing them in a virtual environment before allowing them to run
EPPs typically provide passive endpoint protection employing the following tools:
- Data encryption, potentially with some data loss prevention capabilities
- Antivirus and Next-Generation Antivirus (NGAV)
- Host-based firewall protecting the endpoint
Extra: Desirable EPP Characteristics
According to Gartner, robust EPP solutions are primarily cloud-managed, allowing the continuous monitoring and collection of activity data, along with the ability to take remote remediation actions, whether the endpoint is on the corporate network or outside of the office.
In addition, these solutions are cloud-data-assisted, meaning the endpoint agent does not have to maintain a local database of all known IOCs but can check a cloud resource to find the latest verdicts on objects that it cannot classify.
What is EDR — Endpoint Detection and Response?
Anton Chuvakin suggested the term “EDR” at Gartner to describe emerging security solutions that detect and investigate suspicious activities on hosts and endpoints, using a high degree of automation to enable security teams to quickly identify and respond to threats.
This name reflects the endpoint (as opposed to the network), threats (as opposed to just malware and officially declared incidents) and tools’ primary usage for both detection and incident response. While some may argue that “endpoint” label may be seen as applicable to workstations and not to servers, this minor loss of precision seems acceptable for the sake of brevity (others will say that four words is already too long).
Also, according to the OMB memo, EDR platforms combine:
“real-time continuous monitoring and collection of endpoint data (for example, networked computing devices such as workstations, mobile phones, servers) with rules-based automated response and analysis capabilities.”
The primary functions of an EDR platform are:
- Continuous monitor and collect activity data from endpoints that could indicate a threat,
- Analyze this data to identify threat patterns,
- Automatically respond to identified threats to remove or contain them,
- Notify security team or SOC team when threat is recognized, and
- Act as a forensics and analysis tool to research identified threats and search for suspicious activities.
With that in design, EDR provides increased visibility compared with traditional cybersecurity solutions and responds to advanced forms of cyber-threats, such as:
- Polymorphic malware,
- Fileless Attack,
- Advanced persistent threats (APTs), and
- Phishing or Social Engineering Attack.
Extra: New Capabilities of EDR
EDR is also recognized as an “essential component” for transitioning to zero-trust architecture. “No blindspot” is one of the reasons organizations deploy EDR to ensure they can monitor activities running inside workloads.
Additionally, new investigative capabilities in some EDR solutions can leverage AI and machine learning to automate the steps in an investigative process. These new capabilities can learn an organization’s baseline behaviors and use this information with various other threat intelligence sources to interpret findings.
Another type of threat intelligence is the MITRE ATT&CK framework. It is a knowledge base and framework built on the study of millions of real-world cyberattacks. An EDR can correlate these common behaviors to identify threats that may have been altered in other ways.
Comparing EPP and EDR Solutions
Traditional EPP tools provide essential security capabilities like anti-malware scanning, while EDR tools implement more advanced security incident detection and investigation features.
However, EDR requires active investigation and analysis by security experts to respond to threats appropriately. In contrast, EPP software runs with minimal supervision needed after its initial installation and configuration.
EDR does not make EPP an unnecessary tool, although people may think EDR is more powerful. Instead, organizations that need robust endpoint security measures should take a holistic approach covering traditional and advanced security threats.
Nowadays, the endpoint protection market has become somewhat problematic. For example, EPP vendors add EDR capabilities to their products and vice versa.
Those products’ offering blurs the line and makes it the customer more challenging to distinguish between them. Luckily, we now have the MITRE D3FEND Framework to help organizations map product capabilities into a common language of “countermeasure techniques.”
EPP and EDR require characters of each other to be considered a holistic endpoint security solution. These two types of endpoint protection systems complement and do not replace each other. Organizations should combine both in their cybersecurity strategy.
What is MDR — Managed Detection and Response?
EDR platform provides excellent insights and visibility to the security team to actively monitor what’s happening inside their infrastructure. However, security teams often spend too much time watching and validating alerts, limiting their ability to address other security needs.
Even more concerning, when attacks happen, security analysts are limited by the tools and data available for analysis in their environment. Thus, adding a managed component to EDR, makes the captured data more robust.
MDR — managed detection and response extend a human component that augments EDR platforms, ideally by a team of security experts. As VMware Carbon Black notes on its website, MDR provides:
“24x7x365 continuous threat monitoring, detection and response activities — security experts proactively validate alerts and send email notifications, helping to assure that your team doesn’t miss the alerts that matter.”
Although there are different types of MDR service offerings, some key capabilities should be in place, such as:
- Resource augmentation aids SecOps teams in tasks that require specialized skill sets, such as threat hunting, forensic investigations, and incident response
- Increased security maturity to proactive and available 24x7 threat management
- Faster time to value delivers a curated technology stack, security experts, and operational best practices to reduce detection and response times to days, not years
- Reduced mean time to detect (MTTD) and mean time to respond (MTTR) guarantee faster detection of and response to advanced threats inside a fixed, time-based service level agreement (SLA)
XDR — Extended Detection and Response
As the name hints, XDR tools represent an extension of traditional EDR platforms. Coined by Nir Zuk, Palo Alto Networks CTO, in 2018, XDR aims to break down conventional security silos and deliver detection and response across all data sources.
As such, according to Palo Alto Networks:
“XDR provides a far more robust view across networks, cloud workloads, servers, and endpoints. One of the limitations that we see with focusing solely on EDR (endpoints) versus XDR (endpoints, cloud, networks, etc.) is that it requires the security team to do the work manually that XDR automates.”
While its competitor, Checkpoint, defined XDR in a post on its website:
“XDR solutions integrate security visibility across an organization’s entire infrastructure, including endpoints, cloud infrastructure, mobile devices, and more,”“This single pane of glass visibility and management simplifies security management and enforcement of consistent security policies across the enterprise.”
Palo Alto Networks and Checkpoint described XDR as an extension of EDR in an integrated operation. Interestingly, analytic firms look at XDR from another angle; Gartner described XDR as:
“a SaaS-based, vendor-specific, security threat detection and incident response tool that natively integrates multiple security products into a cohesive security operations system.”
While Forrester Research described XDR as a more extensive way:
XDR unifies security-relevant endpoint detections with telemetry from security and business tools, such as NAV, email security, identity and access management (IAM), cloud security, and more. It is a cloud-native platform built on big data infrastructure to provide security teams with flexibility, scalability, and opportunities for automation.
All in all, XDR tools focus on security integration and aggregating data from across organizations to provide the context needed to detect sophisticated and distributed attacks. Still, XDR products are limited today on the capabilities they can deliver.
Most of the solutions can extend their endpoint capabilities to varying extents, but in most cases, they cannot wholly replace security analytics platforms (SIEM or SOAR). That said, XDR is on a journey, and soon we will see XDR and analytics platforms collide.
Final Words
Endpoint security will exist as long as we use computers. But the definition would change — from EPP and EDR to a more hybrid and comprehensive set of capabilities to counter the constantly evolving cyber-threats.
EDR was designed to provide perimeter-wide protection for a system, improved the traditional method as it provided coverage for a primary component in an attack: endpoints. The result was proactive endpoint protection that covered many security gaps and blind spots from EPP.
However, effective use of EDR still requires collaboration with other tools and processes. It cannot protect your system on its own. It also cannot provide complete visibility of your system. Instead, it can provide limited visibility into what actions attackers are taking on your endpoints.
If you want to know what happened throughout the attack, you need to bring in other monitoring and detection tools, such as network threat analysis (NTA) or network detection and response (NDR).
This integration of detection systems helps us determine a more accurate picture of past attacks as well as attacks in progress which is especially critical as networks become more distributed and more external services are incorporated and provide system access.
Therefore, the cybersecurity industries are looking into XDR, which was designed to fill this information gap. Unlike EDR, it can provide visibility into every phase of an attack, from the endpoint to the payload. By integrating XDR into your security platform, you can examine the information from across your systems.
Thank you for reading. May InfoSec be with you🖖.
Previously published behind a paywall here.