Today, Endpoint Detection and Response (EDR) is approached as an essential part of EPP. Central to EDR is the detection of attackers that evaded the prevention layer of an EPP solution and are active in the target environment.
In this article, we’ll provide an overview of the endpoint security market and offer insight into EDR security capabilities. We’ll also address 6 top EDR tools, covering their solution scope, delivery, and EDR features.
EDR tools are technology platforms that can alert security teams of malicious activity, and enable fast investigation and containment of attacks on endpoints. An endpoint can be an employee workstation or laptop, a server, a cloud system, a mobile or IoT device.
EDR solutions typically aggregate data on endpoints including process execution, endpoint communication, and user logins; analyse data to discover anomalies and malicious activity; and record data about malicious activity, enabling security teams to investigate and respond to incidents. In addition, they enable automated and manual actions to contain threats on the endpoint, such as isolating it from the network or wiping and reimaging the device.
According to Gartner:
“An Endpoint Protection Platform (EPP) is a solution deployed on endpoint devices to prevent file-based malware, to detect and block malicious activity from trusted and untrusted applications, and to provide the investigation and remediation capabilities needed to dynamically respond to security incidents and alerts.”
In 2018, the endpoint security market was valued at $11.18 billion, and it is predicted to reach a value of $19.69 billion by 2024. The market is characterized by:
Endpoint Detection and Response (EDR) is today considered an essential part of EPP. EDR focuses on detecting attackers that evaded the prevention layer of an EPP solution—legacy antivirus and Next-Generation Antivirus—and are now active in the target environment.
EDR can detect an attack has taken place, take immediate action on the endpoint to prevent the attack from spreading, and provide real-time forensic information to help investigate and respond to the attack.
EDR tools have three key mechanisms:
Below is a quick review of our top 6 endpoint protection tools that include an EDR component: FireEye, Symantec, RSA, CrowdStrike, Cybereason, and our own Cynet Security Platform. For each vendor we explain the context of the EDR module within the broader security solution, and list EDR features as described by the vendors.
Solution scope: The 360 Security Platform is an integrated security solution that goes beyond endpoint protection, offering NGAV, EDR, UEBA, deception, network monitoring and protection.
Click here to learn more about Cynet’s Extended Detection and Response (XDR) capabilities.
Delivery: On-premise, cloud, hybrid
EDR solutions exclusively pay attention to the process behavior that prompts alerts. Organizations can use EDR tools in response to specific parts of common Tactics, Techniques, and Procedures (TTP) attackers use. However, EDR products are blind to other forms of attacks.
Let’s consider the example of credential theft. The default method used by attackers involves dumping password hashes from memory using customized tools or an open source tool. The attack method includes anomalous behavior, thus an EDR tool should recognize these types of attacks. However, an attacker can obtain the same hashes by scraping the network traffic between two hosts, a process that doesn’t involve anomalous activity.
Another example involves the attack technique of lateral movement. In this scenario, the attacker may manage to compromise many user account credentials and logs, related to many hosts in the network. In this example, the anomaly is the user activity and not the process behavior. The EDR would thus not detect the attack at all or would see the attack but without sufficient context, thus triggering false positives. Therefore, process data is essential, but organizations cannot rely on it as the only source of their security data.
Another limitation of EDR tools is that they are limited to endpoints and cannot help mitigate attacks or restore operations at the network or user level.
Cynet 360 platform is a comprehensive cyber solution that is created to run in the entire environment of an organization and not only its endpoints. To do so, Cynet 360 safeguards all attack surfaces by tracking the three planes; network traffic, process behavior, and user activity. Attackers often manifest themselves on one or several of these three planes.
Continuous monitoring to detect and stop threats across this triad offers increased threat visibility. Organizations can have the chance to monitor more stages in the attack’s lifecycle so they can more effectively identify and block threats.
Cynet 360 threat protection is not restricted to attack detection and prevention. Using Cynet organizations can proactively monitor their internal environment, including endpoints, files, network, and hosts. This can help them reduce the attack surface and the possibility of multiple attacks. The response of an organization to active attacks must work to enclose the capabilities of the attacker to eradicate the presence of the attacker entirely. This involves deleting malicious processes and files, disabling compromised users, isolating infected hosts and blocking traffic controlled by the attacker.
Solution scope: Symantec’s endpoint solution includes legacy antivirus, NGAV with emulator for detecting hidden packages, memory exploit prevention, deception technology, device network firewall and intrusion prevention, and EDR.
Product page: https://www.symantec.com/products/endpoint-protection
Delivery: Virtual or physical appliance
Solution scope: RSA NetWitness Endpoint is a solution focused on EDR capabilities. Malware protection, network monitoring, log analysis and other capabilities are offered as part of the broader NetWitness Platform.
Delivery: Physical or virtual appliance
Solution scope: Falcon Insight is an EDR module as part of the Falcon Endpoint Protection Enterprise solution, which also includes NGAV, threat intelligence, USB device protection, and threat hunting.
Solution scope: A module within the Cybereason Defense Platform, which also includes NGAV and Managed Detection and Response (MDR).
Delivery: Cloud or on-premises
Solution scope: Endpoint solution including an agent with four detection engines, NGAV capabilities, and EDR.
Delivery: Appliance or cloud
Ready to extend visibility, threat detection and response?