WHAT IS ENDPOINT SECURITY?
Endpoint security or endpoint protection is an approach to the protection of computer networks that are remotely bridged to client devices.
Endpoint security is the practice of securing endpoints or entry points of end-user devices such as desktops, laptops, and mobile devices from being exploited by malicious actors and campaigns. Endpoint security systems protect these endpoints on a network or in the cloud from cybersecurity threats. Endpoint security has evolved from traditional antivirus software to providing comprehensive protection from sophisticated malware and evolving zero-day threats.
Organizations of all sizes are at risk from nation-states, hacktivists, organized crime, and malicious and accidental insider threats. Endpoint security is often seen as cybersecurity’s frontline, and represents one of the first places organizations look to secure their enterprise networks.
As the volume and sophistication of cybersecurity threats have steadily grown, so has the need for more advanced endpoint security solutions. Today’s endpoint protection systems are designed to quickly detect, analyze, block, and contain attacks in progress. To do this, they need to collaborate with each other and with other security technologies to give administrators visibility into advanced threats to speed detection and remediation response times.
Endpoint security protects these points of entry from risky activity and/or malicious attack. When companies can ensure endpoint compliance with data security standards, they can maintain greater control over the growing number and type of access points to the network.
The 11 Types of Endpoint Security
1. Internet of Things (IoT) Security
IoT devices are becoming more ubiquitous in enterprise infrastructures as they help facilitate communications and business processes. Unfortunately, IoT devices generally inherent endpoint security. Manufacturers don’t prioritize IoT security in their products or place poor protections on those devices.
To combat this issue, providers offer IoT security as one of the types of endpoint security for enterprises. In fact, these solutions work to improve visibility in IoT devices, provide a consistent and easily upgradable layer of cybersecurity, and close security vulnerabilities into the network.
2. Antivirus Solutions
Perhaps one of the most popular and well-recognized types of endpoint security, antivirus solutions still provide critical capabilities. These include anti-malware capabilities. As such, enterprises can protect themselves against signature-based attacks, which still arise on occasion. Additionally, antivirus solutions can scan files for malicious threats via consulting against threat intelligence databases. Enterprises can install antivirus solutions directly onto their endpoints to identify unknown signatures.
However, antivirus solutions often prove limited in defending against more advanced cyber threats. Moreover, enterprises often rely too much on antivirus alone for their digital perimeter. Of the types of endpoint security, this one certainly needs the support of others.
3. Endpoint Detection and Response
A darling among the other endpoint security tools, EDR offers a capability that fits with the detection-mitigation model of modern cybersecurity. Indeed, EDR solutions continuously monitor all files and applications entering your enterprise’s endpoints. Additionally, EDR solutions can offer granular visibility, threat investigations, and detection of fileless malware and ransomware. Also, EDR provides your investigation teams with alerts for easy potential threat identification and remediation.
4. URL Filtering
URL filtering works to restricts web traffic to trusted websites; in turn, this prevents users from accessing malicious websites or websites with potentially harmful content. As an added bonus, URL filtering can prevent surreptitious downloads on your network, granting you more control over what gets downloaded where and by whom.
5. Application Control
Unsurprisingly, application control does exactly what it says on the tin; it controls applications’ permissions, ensuring strict restrictions on what they can or cannot do. To accomplish this, it uses whitelisting, blacklisting, and gray-listing to prevent malicious applications from running and compromised applications from running in dangerous ways. As enterprises continue to embrace the cloud and the potential of third-party applications in their business processes, this proves incredibly important.
6. Network Access Control
Surprisingly, network access control overlaps with identity and access management. After all, its primary focus is on securing access to network nodes. As a result, network access control determines what devices and users can access and do what on your network infrastructure. Among the types of endpoint security listed here, this one emphasizes the importance of firewalls and data limitations the most.
7. Browser Isolation
The threat facing web browsers can prove overwhelming to comprehend on a first look: surprise downloads, zero-day attacks, ransomware, cryptojacking malware, and malicious browser-executable code. Moreover, these merely skim the surface of potential cyber attacks. Browser isolation works to execute browsing sessions in isolated environments where it cannot reach valuable digital assets. Therefore, activity remains restricted to isolated environments and safe interactive media streams. Additionally, the tool destroys web browser codes after the user finishes browsing.
8. Cloud Perimeter Security
Endpoint security can no longer merely concern itself with your users’ devices. In addition, it must form a protective perimeter around your cloud environments and databases. Cloud providers are not responsible for your enterprise’s cybersecurity; hackers can target your cloud-stored assets with impunity unless you intervene.
Cloud perimeter security allows your enterprise to harden its cloud infrastructure against incoming threats.
9. Endpoint Encryption
Among the types of endpoint security, encryption often suffers from the most neglect. Yet its capabilities contribute meaningfully to any business’s digital perimeter. It prevents issues such as data leaks (whether intentional or not) via data transfer by fully encrypting that data. Specifically, it encrypts data stored on endpoints.
10. Secure Email Gateways
Email constitutes the main means of data traffic entering and exiting your digital network. Thusly, hackers exploit emails to conceal and transmit their attacks through emails more than any other attack vector. In fact, they could use email as their malware-delivery system as much as 90% of the time if not more.
Secure email gateways monitor incoming and outgoing messages for suspicious behavior, preventing them from being delivered. They can be deployed according to your IT infrastructure to prevent phishing attacks.
11. Sandboxing
A “sandbox” serves as an isolated and secure digital environment that perfectly replicates your typical end-user operating system. As such, it can contain potential threats for observation. Your IT security team can then determine their intentions before allowing them into the network. This tool can help contain zero-day threats and works well against zero-day attacks.
How endpoint protection works
Endpoint security is the practice of safeguarding the data and workflows associated with the individual devices that connect to your network. endpoint protection platform work by examining files as they enter the network. Modern EPPs harness the power of the cloud to hold an ever-growing database of threat information, freeing endpoints of the bloat associated with storing all this information locally and the maintenance required to keep these databases up to date. Accessing this data in the cloud also allows for greater speed and scalability.
The EPP provides system administrators a centralized console, which is installed on a network gateway or server and allows cybersecurity professionals to control security for each device remotely. The client software is then assigned to each endpoint—it can either be delivered as a SaaS and managed remotely, or it can be installed directly on the device. Once the endpoint has been set up, the client software can push updates to the endpoints when necessary, authenticate log-in attempts from each device, and administer corporate policies from one location. EPPs secure endpoints through application control—which blocks the use of applications that are unsafe or unauthorized—and through encryption, which helps prevent data loss.
When the EPP is set up, it can quickly detect malware and other threats. Some solutions also include an endpoint detection and response component. EDR capabilities allow for the detection of more advanced threats, such as polymorphic attacks, fileless malware, and zero-day attacks. By employing continuous monitoring, the EDR solution is able to offer better visibility and a variety of response options.
EPP solutions are available in on-premises or cloud based models. While cloud- based products are more scalable and can more easily integrate with your current architecture, certain regulatory/compliance rules may require on-premises security.
Endpoint security components
Typically, endpoint security software will include these key components:
- Machine-learning classification to detect zero-day threats in near real time
- Advanced antimalware and antivirus protection to protect, detect, and correct malware across multiple endpoint devices and operating systems
- Proactive web security to ensure safe browsing on the web
- Data classification and data loss prevention to prevent data loss and exfiltration
- Integrated firewall to block hostile network attacks
- Email gateway to block phishing and social engineering attempts targeting your employees
- Actionable threat forensics to allow administrators to quickly isolate infections
- Insider threat protection to safeguard against unintentional and malicious actions
- Centralized endpoint management platform to improve visibility and simplify operations
- Endpoint, email and disk encryption to prevent data exfiltration
Endpoint Security and the Network
Endpoint security software uses encryption and application control to secure devices accessing the enterprise network, thereby better controlling security on those avenues of access to monitor and block risky activities. Encrypting data on endpoints and removable storage devices helps to protect against data leaks and loss. Application control prevents endpoint users from executing unauthorized applications that could create vulnerabilities in the network.
Endpoint security solutions often use a client-server model of protection, employing both a centrally managed security solution to protect the network as well as client software locally installed on each endpoint used to access that network. Some work on a SaaS (Software as a Service) model, by which both central and endpoint security solutions are maintained remotely.
Endpoint Security and Anti-Virus Software
Anti-virus software is central to endpoint security; it does not always protect individual devices and servers. Implementing endpoint protection creates a two-pronged approach to security by also securing individual devices that connect to the network. Using an endpoint security approach makes endpoints more heavily responsible for security than anti-virus software that protects the network alone.
What is an Endpoint Security Tool?
An endpoint security tool is software dedicated to tracking, monitor, and managing the myriad of endpoint devices used by the organization. While some tools are similar to conventional corporate security software like antivirus and internet security software, endpoint security tools integrate additional features specifically designed for endpoint devices. These can include mobile device management, mobile security, device or memory encryption intrusion detection, or remote wipe capabilities.
Some of the threats that endpoint security tools are designed to deal with include:
Human error:
- Phishing attempts
- Suspicious websites
- Malware ads
- Ransomware
- Drive-by downloads
- Outdated patches
- Data loss and theft
Sophisticated attacks:
- DDoS
- Macro and script exploits
- Botnet attacks
- Memory-based or fileless attacks
- Advanced persistent threats
Top 7 Endpoint Security Tools
Not all endpoint security products are created equal. Some EPPs are better than others at detecting threats, while some EDR platforms offer more capabilities either built-in or as optional extras.
Here are the top seven endpoint security tools for 2020, along with their unique features and capabilities:
1. Crowdstrike Falcon
Type: EDR
One of the most widely used EDR platforms, Crowdstrike boasts unmatched detection abilities compared to other EDR products. It also has a robust cloud-based management interface and excellent Linux and technical support. However, it lacks web content filtering and VPN, while services like automated remediation, threat hunting and vulnerability assessment cost extra.
Pros:
Top-level detection capabilities
Easy cloud-based management
Linux and technical support
Optional services like vulnerability assessment and threat hunting
Cons:
Premium pricing
Automated remediation costs extra
No web content filtering or VPN
2. F-Secure Rapid Detection & Response
Type: EPP + EDR
Another popular product, F-Secure boasts some of the highest ratings in MITRE ATT@CK tests. In addition to advanced features like real-time behavioral, reputational and big data analysis, it uses an intuitive interface to visualize security incidents. It offers strong EPP capabilities, only lacking encryption. For EDR, it uses big data and behavioral analysis, but lacks black/whitelisting and prioritization options.
Pros:
High independent test ratings
Good price
Prioritization of response actions by criticality and risk level
Advanced machine learning for real-time behavioral, reputational and big data analysis
Cons:
Advanced features like custom rules, rogue device discovery, rollback and VPN cost extra
3. Palo Alto Networks Cortex XDR
Type: EDR
A contender with F-Secure when it comes to highest independent test scores, Palo Alto’s product is able to stop even handcrafted attacks, with solid machine learning and behavioral monitoring that covers the spectrum, from endpoints to the network to the cloud. However, NSS testing found it lacking when it comes to file-embedded social exploits, with a score of 60%
Pros:
Top marks in MITRE and NSS evaluations
Solid threat tracking across endpoints, networks and the cloud environment
Able to stop targeted handcrafted attacks
Cons:
No web content filtering, vulnerability monitoring, rogue device discovery, and patch management
No rollback ability
Designed for Palo Alto firewalls and security products, so integration and implementation can be complicated
4. Trend Micro Apex One
Type: EPP + EDR
Apex One is an EPP/EDR combo that manages to offer a lot of value at a relatively low price. It boasts top scores in the recent second round of MITRE evaluations, as well as the best total cost of ownership rating in NSS comparisons. However, the bargain comes at a price, with features like device control, patch management, custom rules and rollback costing extra.
Pros:
EPP and EDR combination + low price make it the best bargain
Office 365 and Google G Suite integration
Lowest total cost of ownership
Cons:
Optional costs for device control, full-disk encryption, patch management and VPN
No custom rules or rollback features
Issues reported with deployment
Some user reports of detected malware requiring manual removal
5. Kaspersky Endpoint Detection & Response
Type: EDR
Second only to Trend Micro in terms of the lowest price, Kaspersky’s offering features a lot of capabilities at a relatively good price tag. Prioritization, investigation and automated responses are included in the package, with VPN being the only optional extra. However, it scored below average in the second round of MITRE evaluations, and the software tends to eat up a lot of resources.
Pros:
Good list of features at a low price
Excellent implementation
Good tech support
Cons:
Below average score in MITRE evaluation
Resource-intensive according to user reports
Additional cost for VPN
6. Symantec Endpoint Security
Type: EPP + EDR
One of the market leaders in EDR, Symantec’s combined product scored a solid 85% in MITRE’s second round of evaluations. The basic offering includes device control and patch management for EPP, and vulnerability assessment, advanced threat hunting, rogue device discovery and custom rules for EDR. Other options include web content filtering, threat intelligence integration, and full-disk encryption. The only missing feature is rollback capability.
Pros:
Good MITRE raw performance
More standard features than other products
Good implementation and ease of use
Cons:
Price tag can be high depending on extras like web content monitoring and encryption
No rollback
Can eat up quite a bit of endpoint resources depending on configuration
7. Bitdefender GravityZone
Type: EPP + EDR
This unified security offering boasts good NSS and MITRE scores at a relatively low price, making it a good choice for SMEs. Most of the heavy lifting can be outsourced to the cloud thanks to its machine learning, behavioral monitoring and automated remediation features. However, advanced capabilities like patch management, rogue device discovery and encryption cost extra.
Pros:
SME-friendly price tag
Good independent scores
Robust AI and behavioral monitoring
Cons:
Additional cost for patching, full-disk encryption and rogue device discovery
No custom rules or guided investigation
No threat intelligence feed
What’s the Difference between EPP and EDR?
In general, an EPP solution acts as an endpoint’s frontline defense, much in the same manner an antivirus software does for viruses.
On the other hand, EDR solutions are designed to deal with threats that the EPP software did not catch. These may include new malware strains, newly discovered zero-day exploits, and other vulnerabilities that are not yet included in the EPP’s threat database.
| EPP | EDR |
| Prevent conventional threats, as well as some unknown threats (by behavioral or machine learning) | Used to respond to threats that make it past the EPP filter |
| First-line threat prevention | Secondary defense: Contain, investigate and respond to breaches |
| Passive software that guards against known risks | Active software used by IT to hunt threats within the system |
| Endpoint protection is done through device isolation | Aggregates incident data from several endpoints to provide context for quarantine and remediation |
Key Features of an EPP Solution
EPP is all about prevention. As your first line of defense, it should guard against commodity threats like malware, basic phishing, and non-targeted attacks.
Here’s what to look for:
- Signature matching: It should be able to detect threats by matching them with known malware signatures.
- Sandboxing: The software should be able test for malicious behavior by executing files in a virtual environment, before allowing them to run in production.
- Behavioral analysis: A good EPP solution can determine the baseline of endpoint behavior and identify behavioral anomalies, despite having no known threat signature.
- Static analysis: Using machine learning it should be capable of analyzing binaries and searching for malicious characteristics before execution.
- Whitelisting and blacklisting: This basic function either blocks or permits access to specific IP addresses, URLs and applications.
Key Features of an EDR Solution
Where EPP fails, EDR serves as the backstop to catch threats that make it past the initial defense. This allows IT security to isolate the endpoints of entry, quarantine affected areas of the system, and initiate automated response and remediation.
- Threat detection: Just like EPP, it should be able to detect malicious activity and anomalous processes on endpoints, instead of just looking for file-based malware.
- Security incident containment: Effective EDR solutions block security incidents at network endpoints to isolate attacks and stop them from spreading across the network.
- Incident response: Flagged incidents should be ranked by threat level to help IT prioritize response, especially in the face of fast-propagating threats.
- Incident investigation: It should make forensic investigation easier and faster by collecting necessary endpoint and traffic data in a central space for analysis.
Increasingly, enterprises and their employees are incorporating practices to make access to data more fluid. The increase in BYOD(Bring your own device) policies, in addition to threats targeting mobile device access and networks, create multiple endpoint vulnerabilities. In addition, employees working from home or connecting to Wi-Fi networks to work on-the-go means that the enterprise network security perimeter is more porous than ever.
In the past, most security breaches came in through the network. Today, however, threats are increasingly coming in through endpoints, which means centralized network protection does not go far enough. Shifting security perimeters that lack clear definition require new layers of security through endpoint protection. Security must maintain greater control over access points to prevent the vulnerabilities that can arise through the use of remote devices.
Drop your comment
