Security + Endpoint Detection and Response (EDR)

Frequently Asked Questions

• What is Endpoint Detection and Response (EDR)?

  EDR (Endpoint Detection and Response) is an active, endpoint security solution that does real-time continuous monitoring correlating different events that happen on an endpoint level to detect malicious activity, compromised processes and suspicious behavior on end-user devices. The purpose is to identify in-progress attacks, potential security incidents, compromises or breaches – and then acting as a response system, providing capabilities to remediate it.
  
  The primary EDR capabilities as defines by Gartner are:

  • Detect security incidents
  • Contain the incident at the endpoint
  • Investigate security incidents
  • Provide remediation guidance

• Who needs endpoint detection and response?

  The endpoint protection strategy of any company that is a potential target of cyber threats and/or that stores valuable endpoint data should include advanced endpoint threat detection capabilities and response tools.
  
  SMB and mid-market organizations are under increased risks of advanced cyber threats due to limited internal capabilities and budget constraints, affecting their access to advanced endpoint security solutions, historically targeted at emprises due to costs and complexity.
  
  Moreover, for businesses of all sizes operating in industries with high regulatory requirements and increased cyber risks such as Finance, Healthcare, Legal, Online Retail, Public Sector, EDR is a must for the organization’s cybersecurity strategy to enable compliance and ensure sensitive endpoint data is out of reach of cyber threats.
  
  With Security + EDR you can ensure that organizations of varying size and complexity are protected with high-value services, scalable across multiple clients.

• How Security + EDR lowers your OpEX compared to other EDR solutions?

  Existing, best-of-breed EDR tools and solutions are oriented at enterprises due to costs and complexity and require large security teams to operate. Moreover, security analysts need to manually perform threat hunting activities by scanning hundreds lines of logs with hours of investigating suspicious activities. But even then, a cross-NIST protection, ensuring business continuity, requires additional solutions and software agents to achieve, increasing the complexity and solution sprawl even further.
  
  Security + EDR performs continuous data collection based on security related events, similar as other EDR tools, but then the solution streamlines your analysis capabilities by raising alerts on any potential incidents and aggregating data in guided attack interpretations mapped to MITRE ATT&CK®. This helps security analysts to rapidly investigate suspicious activities across multiple clients, cutting investigation times from hours to minutes to achieve better scalability.
  
  Moreover, Security + EDR is an integrated endpoint security solution in Acronis Cyber Protect Cloud, unlocking unique benefits for administrators such as a single-click response across the NIST, including recovery. This removes solution sprawl and enables you to deliver comprehensive endpoint protection via a single Acronis agent and console.

• What are some types of threats that EDR protects against?

  There’re multiple types of advanced cyber threats, capable of bypassing other endpoint protection layers like existing antivirus software, some of the most common ones include:

  • Zero-day malware and ransomware – Malware and/or ransomware that infiltrates the system through a zero-day vulnerability (a vulnerability that is exploitable, but the software vendor has not released a patch for it yet – the vulnerability can be known or unknown). Can bypass some behavior-based detections.
  • Advanced persistent threats (APTs) - Attacks that use continuous, sophisticated and highly evasive hacking techniques to gain unauthorized access to system and stay undetected for a prolonged period of time, with potentially destructive consequences. They usually consist of a few phases, including system infiltration, escalation and lateral movement within the system, and exfiltration of sensitive data. Advanced persistent threats commonly depend on “living off the land” techniques that refer to attacker-behavior that uses tools that already exist in the targeted environment – making it harder to detect, on considerably cheaper to carry out.
  • Fileless attacks - Fileless malware is a type of malicious software that uses legitimate programs to infect a computer. It does not rely on files and leaves no footprint, making it challenging to detect attacks and remediate them.
  • Hacking - Hacking is the act of identifying and then exploiting vulnerabilities in a computer system or network, usually to gain unauthorized access to personal or organizational data. Depending on the used techniques, hacking can be hard to detect, as it might leverage stolen credentials or other techniques that make it look like a perfectly normal process until exfiltration happens and it’s already too late to respond.

  
  Detecting and responding to these and other advanced threats requires more Security controls like EDR.