What Is Endpoint Security? Endpoint Protection, EDR, Antivirus and Device Security

In the corporate cyber security architecture there are many different security layers such as the firewall, e-mail security, the SIEM, DLP and Identity Security. However, one of the most critical points at which the attacker interacts directly with the user is most often the user's device.

The user working on a laptop, desktop, mobile device or workstation opens e-mail every day, visits websites, downloads files, connects to corporate applications and performs operations with sensitive data.

For this reason endpoint devices form an important attack surface for attackers.

When a phishing e-mail succeeds a malicious attachment can be opened on the endpoint. If the user downloads a fake software update malware can run on the endpoint. Over an exploited application the attacker can obtain code execution. An infostealer can try to collect browser credentials and session information.

At this point:

Endpoint Security

comes into play.

Modern Endpoint Security does not mean only running antivirus on the device.

Today an effective endpoint security approach:

Prevention + Detection + Investigation + Response + Hardening + Monitoring

requires these layers to be applied together.

For this reason it is no longer enough for organizations to ask only:

"Is there antivirus on the computers?"

this question.

The question that really needs to be asked:

"When an attack takes place on the endpoint, how quickly can we see it, understand it and stop it?"

is this question.

What Is Endpoint Security?

Endpoint Security is the security approach that provides protection for the user devices that reach the corporate network or corporate services against malware, ransomware, exploits, unauthorized access, credential theft and other cyber threats.

Within the scope of Endpoint Security:

a laptop,

a desktop,

a workstation,

a server,

a mobile device

systems such as these can be evaluated.

However, in terms of end user security, employee workstations and laptops in particular are of critical importance.

Because many of the interactions between the user and the attacker take place on these devices.

What Is an Endpoint?

An endpoint is the end device or workload that communicates with a network or a corporate information system.

In a corporate environment an employee's Windows laptop is an endpoint.

Similarly a macOS workstation, a Linux device, a mobile device and in some use scenarios servers can also be evaluated as endpoints.

Because the endpoint concept is broad, security policies may need to be customized according to device type.

Why Is Endpoint Security Important?

For the attacker to reach the corporate network they do not always have to find a vulnerability on the network perimeter.

When the user's endpoint is compromised the attacker can work inside with a valid user context.

This situation can cause the attack later to progress to the stages of:

credential theft,

privilege escalation,

lateral movement,

data exfiltration,

ransomware

these stages.

Therefore an endpoint compromise is most often not the end of the attack but:

the starting point.

What Is the Endpoint Attack Surface?

The endpoint attack surface expresses all the access and execution areas on the device that can be abused by the attacker.

Among these:

the operating system,

installed applications,

the browser,

browser extensions,

local services,

remote access tools,

USB devices,

user privileges

can be found.

As the number of unnecessary applications and services on the endpoint increases the attack surface can also widen.

For this reason Endpoint Hardening is an important defense method.

What Is Endpoint Hardening?

Endpoint hardening is a secure configuration being applied in order to reduce the attack surface of the user device.

Hardening is not only antivirus installation.

For example:

unnecessary services can be disabled,

local administrator rights can be limited,

application execution can be controlled,

disk encryption can be applied,

USB devices can be managed,

security policies can be applied centrally.

The aim is to reduce the options the attacker can use on the endpoint.

What Is Antivirus?

Antivirus is the security technology that tries to detect and block malicious files and known malware on the endpoint.

Traditional antivirus systems have for many years largely been based on:

signature-based detection

this approach.

The aim has been for known malicious files to be recognized through particular signatures or patterns.

This approach is still valuable.

However, in the face of modern attack techniques it is not sufficient on its own.

What Is Signature-Based Detection?

Signature-based detection is a threat being detected through a characteristic pattern or fingerprint belonging to known malicious content.

For example the security vendor can create a detection signature for malware it has analyzed before.

When the same or a similar pattern is seen on the endpoint the file can be blocked.

This approach can be quite effective against known malware.

However, threats not seen before or modified threats can escape signature detection.

What Is Hash-Based Detection?

A file hash is the digital fingerprint calculated from the content of the file.

If the hash value of a known malicious file is present in threat intelligence or a malware database the endpoint security solution can evaluate the file as malicious.

However, when the attacker makes a small change on the file the hash can change completely.

For this reason modern endpoint protection does not rely only on hash-based detection.

What Is Next-Generation Antivirus?

Next-Generation Antivirus or NGAV is the modern endpoint protection approach that tries to provide threat detection using behaviour, machine learning and different security signals in addition to traditional signature-based detection.

NGAV in particular:

unknown malware,

fileless attacks,

script abuse,

suspicious behaviour

can provide more advanced detection against threats such as these.

However, NGAV and EDR are not the same thing.

What Is EPP?

EPP:

Endpoint Protection Platform

is the platform class that provides preventive security controls on the endpoint.

Inside EPP:

antivirus,

anti-malware,

a host firewall,

exploit protection,

web protection,

device control

different features such as these can be found.

The fundamental goal of EPP is to prevent the attack from succeeding on the endpoint as far as possible.

What Is EDR?

EDR:

Endpoint Detection and Response

is the security technology that helps to detect, investigate and respond to suspicious behaviours by continuously monitoring the activities taking place on the endpoint.

One of the most important differences of EDR is that it does not only ask:

"Is this file malicious?"

this question.

At the same time:

"Why did this process run, what did it do, which process did it create, where did it connect and what did it change on the system?"

it seeks answers to these questions.

For this reason EDR is one of the most important telemetry sources of modern SOC operations.

What Is the Difference Between Antivirus and EDR?

Antivirus is largely focused on threat prevention and malware detection.

EDR, alongside detection:

visibility,

investigation,

response

provides these.

For example antivirus can block a malicious executable.

EDR, in the same event:

where the file came from,

which user ran it,

which parent process started it,

which network connections it created,

on which other endpoints it was seen

can help to answer questions such as these.

For this reason:

Antivirus = weighted towards prevention

EDR = weighted towards Detection + Investigation + Response

it can be simplified in this form.

Modern security products can combine these features inside the same platform.

Why Can a Computer With Antivirus Installed Still Be Taken Over?

This is an important question.

The presence of antivirus does not mean that the endpoint is protected against all attack techniques.

The attacker:

unknown malware,

legitimate tools,

scripts,

memory-based techniques,

stolen credentials,

social engineering

can use these.

Particularly if the attacker abuses legitimate tools already present in the operating system a classic malware signature may not be formed.

For this reason modern endpoint security needs behaviour-based detection.

What Is Behavioral Detection?

Behavioral detection looks not at the reputation of a single file but at the activity sequence carried out on the system.

For example a normal Office application unexpectedly starting a script interpreter and then creating a suspicious connection over the internet can be important in terms of security.

Here each process on its own can be legitimate.

However, the behaviour chain is suspicious.

One of the areas in which EDR is strong is exactly this:

contextual behaviour analysis.

What Is a Process Tree?

A process tree shows the parent-child relationship of processes on the operating system.

For example:

User opens document

↓

Office process starts

↓

Script interpreter launches

↓

Suspicious network connection occurs

This chain provides important investigation context for the SOC analyst.

A network connection or a process name on its own may not be enough.

The process tree helps to understand how the attack developed.

What Is a Fileless Attack?

A fileless attack is the general attack class that expresses attack activity being carried out over memory, scripts or legitimate system tools without leaving a traditional malicious executable.

For this reason a security approach that only scans the malicious files on disk may not be sufficient.

Behaviour monitoring and memory-related telemetry are important in terms of modern endpoint security.

What Is Living off the Land?

Living off the Land is the attacker abusing legitimate tools and capabilities already present in the operating system or the organization's environment.

This approach can reduce the attacker's need to use a new malicious binary.

For this reason the security team must not only ask:

"Is the program trustworthy?"

this question.

At the same time:

"Is this program being used for a normal purpose right now?"

it must also evaluate this question.

What Are LOLBins?

LOLBins comes from the expression Living off the Land Binaries.

These are system binaries that are normally legitimate but can be abused by the attacker for malicious activity.

For this reason the use of a legitimate binary does not automatically mean trusted behaviour.

For detection:

the user context,

the command behaviour,

the parent process,

the network activity

must be evaluated together.

What Is a Script-Based Attack?

PowerShell, JavaScript or similar script execution mechanisms can be used for administration and automation.

However, the attacker can also abuse these technologies.

For this reason script activity visibility is important in corporate endpoint security.

The aim is not to block scripting technology completely but to be able to see the difference between legitimate administration and suspicious execution.

Why Is Command-Line Monitoring Important?

Many attack techniques can be carried out over the command line.

While the process name on its own looks normal the arguments used or the execution context can be suspicious.

For this reason EDR telemetry can provide command-line information.

This information is quite valuable for threat hunting and incident investigation.

What Is Endpoint Telemetry?

Endpoint telemetry is the data collected about the security-relevant activities taking place on the device.

For example:

Process Creation

File Creation

Registry Change

Network Connection

User Logon

Script Execution

can be parts of this telemetry.

EDR provides the security team with visibility by sending this data to a central platform.

What Is an EDR Agent?

An EDR agent is the software component that runs on the endpoint and collects security telemetry.

The agent can also apply a prevention or response action according to the security policy.

For example a malicious process can be terminated or the endpoint can be isolated from the network.

Agent health is for this reason a critical security metric.

What Is EDR Coverage?

EDR coverage shows how much of the endpoints inside the organization are under active EDR protection.

For example if the EDR agent is active on 950 of 1,000 endpoints the coverage is at the level of 95%.

However, installation alone is not enough.

The agent needs to be:

online,

healthy,

updated,

policy-compliant

it needs to be these.

For this reason Healthy EDR Coverage can be a more meaningful KPI.

What Is Endpoint Isolation?

Endpoint isolation is the network communication of a compromised or high-risk device being limited through EDR.

The aim is to prevent the attacker from continuing activities such as:

lateral movement,

C2 communication,

data exfiltration

these activities.

Certain communications such as the security management channel can continue.

When Is Endpoint Isolation Used?

Confirmed malware,

ransomware,

an active compromise,

credential theft malware

in situations such as these isolation can be an important containment method.

However, since isolation can create a serious operational impact on business-critical endpoints it must be applied according to the incident response policy.

What Is Kill Process?

EDR can terminate a suspicious or malicious process remotely.

This provides quick containment.

However, if the attacker has created persistence, only closing the process may not be enough.

The root cause and persistence mechanisms must also be investigated.

What Is Quarantine?

Quarantine is a malicious or suspicious file being isolated from the normal usage area.

The file can be made unable to run or unreachable by the user.

Quarantine is valuable in terms of prevention but incident investigation may still be needed.

What Is Ransomware?

Ransomware is the malware/attack model that demands payment from the victim by making systems or data unreachable.

Modern ransomware incidents may not be limited to file encryption only.

The attacker can first obtain access inside the network, can perform privilege escalation and can carry out sensitive data exfiltration.

Then they can move to the encryption stage.

For this reason ransomware protection is not only:

"Preventing files from being encrypted"

it is not this.

How Does Endpoint Security Prevent Ransomware?

Endpoint Security can come into play at different stages of the ransomware attack chain.

EDR:

suspicious process behaviour,

mass file modification,

credential access,

unusual administrative tool use

can detect activities such as these.

Application control can prevent an unknown executable from running.

Least privilege can limit the attacker's authority.

Patch management can reduce the initial exploitation risk.

For this reason ransomware defense:

Defense in Depth

requires this.

Is Backup Enough for Ransomware Protection?

Backup is a critical recovery control.

However, on its own it is not ransomware prevention.

The attacker can also try to reach the backup infrastructure or can carry out data exfiltration before the encryption.

For this reason:

Endpoint Security + Network Segmentation + Identity Security + Backup Security + SOC Monitoring

must be handled together.

What Is Patch Management?

Patch management is the controlled application of the security updates published for the operating system and applications.

Endpoints with a known vulnerability can form an easy target for the attacker.

For this reason patch management is one of the most fundamental cyber hygiene controls of endpoint security.

Are Vulnerability Management and Patch Management the Same?

No.

Vulnerability Management is a broader process.

The aim is to:

discover,

assess,

prioritize,

remediate,

verify

the vulnerabilities.

Patch Management, on the other hand, is one of the remediation methods.

Not every vulnerability can be solved with a patch alone.

A configuration change or a compensating control may be needed.

How Should Patch Prioritization Be Done?

Not all vulnerabilities have the same risk level.

During prioritization:

vulnerability severity,

exploit availability,

asset criticality,

internet exposure,

active exploitation intelligence

factors such as these can be evaluated.

For this reason ordering patches according to the CVSS score alone is not always sufficient.

What Is Endpoint Vulnerability Management?

Endpoint Vulnerability Management is the central identification of risks found on user devices such as:

missing patches,

outdated software,

known vulnerabilities,

unsafe configurations

risks such as these.

EDR/XDR or dedicated vulnerability management platforms can provide visibility on this subject.

Why Is Unsupported Software Risky?

Software that no longer receives security updates from the vendor can remain defenceless in the face of new vulnerabilities.

For this reason software lifecycle management is an important part of endpoint security.

End-of-Life and End-of-Support applications must be tracked over the inventory.

Why Is Asset Inventory the Foundation of Endpoint Security?

You first need to know the device you cannot protect.

If how many endpoints there are in the organization, which operating systems are running and which security agents are installed is not known, security coverage cannot be measured correctly.

For this reason:

Asset Inventory → Security Coverage → Risk Management

this chain is important.

What Is a Shadow Endpoint?

Devices that are not in the inventory of the IT/security teams but reach corporate resources can be evaluated as shadow endpoints.

These devices:

without EDR,

without patches,

unmanaged

can be in these states.

Controls such as NAC, MDM/UEM and Conditional Access can help to reduce the unmanaged device risk.

BYOD Endpoint Security

BYOD, that is Bring Your Own Device, is employees using their personal devices for work purposes.

BYOD can provide a productivity advantage but:

corporate data being mixed with personal data,

unmanaged software,

device security,

privacy

it creates risks such as these.

For this reason the BYOD policy must be defined clearly.

What Is MDM?

MDM:

Mobile Device Management

makes it possible for mobile devices in particular to be managed centrally.

With MDM:

device configuration,

encryption,

screen lock,

application policies,

remote wipe

controls such as these can be applied.

What Is UEM?

UEM:

Unified Endpoint Management

is the broader device management approach that aims for different endpoint types to be managed over a central platform.

Different devices such as laptops, desktops, smartphones and tablets can be managed within the same policy framework.

What Is Device Compliance?

Device compliance is the evaluation of whether the endpoint conforms to the organization's security requirements.

For example for a compliant endpoint conditions such as:

disk encryption active,

EDR healthy,

operating system updated,

screen lock enabled

can be looked for.

This information can be combined with Conditional Access.

What Should Happen to a Non-Compliant Device?

A non-compliant device's access to sensitive corporate resources can be limited.

In this way even if the attacker has obtained a valid credential, access over an unmanaged or insecure device can be made more difficult.

This approach is important in terms of Zero Trust Endpoint Security.

What Is Disk Encryption?

Disk encryption is the data inside the endpoint storage being protected with cryptographic protection.

When a laptop is lost or stolen the attacker can try to read the storage over another device.

Full Disk Encryption reduces this risk.

It is a fundamental endpoint security control particularly for a mobile workforce.

Why Is Encryption Key Management Important?

Encryption being applied is not sufficient on its own.

The recovery keys need to be stored securely and to be reachable only by authorized administrators.

Otherwise the recovery process can turn into a separate security risk.

Why Is Screen Lock Important?

When the user leaves the workstation the open session can remain unattended.

Auto screen lock locks the device automatically after a certain period of inactivity.

Despite looking simple it is an effective security control that reduces the physical access risk.

Why Are Local Administrator Rights Risky?

The user continuously working with local administrator privileges can cause malware or the attacker to be able to use the same high privileges.

For this reason local admin rights on daily user accounts must be limited as far as possible.

This approach:

Least Privilege

is the application of this principle on the endpoint.

What Is Least Privilege?

Least privilege is only the minimum permission necessary for a user or process to do their work being given to them.

The aim is to limit the resources the attacker can reach when a compromise takes place.

In terms of endpoint security local administrator removal is one of the important least privilege applications.

What Is Privilege Elevation?

Some users can from time to time require administrative privilege.

Instead of giving permanent local admin, controlled and temporary privilege elevation can be used.

This approach:

Just-in-Time Access

or Endpoint Privilege Management

can be supported with these.

What Is Endpoint Privilege Management?

Endpoint Privilege Management is the security approach aimed at controlling users' use of local administrative privileges centrally.

While certain approved applications can be run with elevated privileges, the user having general administrator privilege can be prevented.

This approach can help to reduce the ransomware and unauthorized software installation risk.

What Is Application Control?

Application control is the security mechanism that determines which applications can run on the endpoint.

In the allowlisting approach only approved applications can be permitted to run.

This can reduce the unknown executable and unauthorized software risk.

What Is Application Allowlisting?

Allowlisting is the principle of applications defined as trusted being permitted to run.

While traditional blocklisting says:

"Block the known bad ones."

allowlisting:

uses the

"Run only the permitted ones."

approach.

For high-security environments it is a strong endpoint hardening control.

Is Application Control Easy in Every Organization?

No.

In very dynamic software environments an incorrect policy can block business applications.

For this reason discovery, testing and staged deployment are needed.

The security control and operational usability must be balanced.

What Is Device Control?

Device control manages how USB storage and other peripheral devices will be used on the endpoint.

With policy:

allow,

block,

read-only,

approved device only

rules such as these can be applied.

This control can reduce both the malware ingress and the data exfiltration risk.

Why Is USB Security Part of Endpoint Security?

USB devices create a two-way risk.

The first is that a malicious file can be carried to the endpoint.

The second is that sensitive data can be copied from the endpoint to the USB.

For this reason USB security:

Malware Prevention + Data Protection

must be evaluated together in these terms.

What Is Removable Media Encryption?

If authorized USB storage needs to be used, encrypted removable media can be preferred.

In this way when the device is lost the data exposure risk can be reduced.

However, encryption does not solve the unauthorized copying problem on its own.

DLP and device control may still be needed.

What Is Endpoint DLP?

Endpoint DLP controls sensitive data being carried to unauthorized channels over the endpoint.

For example:

USB copy,

clipboard,

print,

browser upload,

a local application

actions such as these can be monitored or blocked according to policy.

For this reason endpoint security is important not only in terms of malware but also in terms of data security.

Is the Browser Part of the Endpoint Attack Surface?

Definitely.

The greater part of modern employees' work takes place over the browser.

E-mail,

SaaS,

CRM,

ERP,

cloud storage

many business applications such as these are used over the web browser.

For this reason the browser has now become an important endpoint security boundary.

What Is Browser Hardening?

Browser hardening aims for the browser to be used with a secure configuration.

For example:

extension control,

download policy,

safe browsing,

update management,

password storage policy

can be applied.

Managed browser policies are an important part of corporate endpoint security.

Why Is a Browser Extension Risky?

A browser extension can request broad permissions.

For example an extension can reach the visited web pages or clipboard data.

A malicious or compromised extension can create a risk for sensitive corporate information.

For this reason allowing users to install any extension they want may not be correct.

Why Is Software Installation Control Important?

Unauthorized software:

vulnerability,

malware,

licensing,

data leakage

can create these risks.

Software inventory and application control are for this reason important in terms of cyber hygiene.

The Relationship Between Shadow IT and Endpoint Security

The user can use software or a cloud application that is not approved on their own.

This situation is called Shadow IT.

Endpoint telemetry, application inventory and web security logs can provide shadow IT visibility.

The aim is not only to block the user but to find the secure solution for the business requirement.

What Is EDR Threat Hunting?

Threat hunting is compromise indicators and suspicious behaviours being searched for proactively inside the environment instead of only waiting for an alert.

Because EDR provides broad endpoint telemetry it is an important data source for threat hunting.

For example the security team can investigate whether a particular suspicious process behaviour is seen on all endpoints.

Are Threat Hunting and Alert Monitoring the Same?

No.

Alert monitoring examines the alerts the security product creates.

Threat hunting, on the other hand, proactively investigates suspicious patterns that may not yet have produced an alert.

For this reason in mature SOC operations both approaches can be used together.

What Is IOC Search?

IOC search is known malicious:

hash,

domain,

IP,

file name

indicators such as these being searched for inside the endpoint telemetry.

For example when threat intelligence publishes a new malicious file hash the security team can check whether it has been seen on any endpoint in the past.

Why Is Historical Search Important?

A threat may have been defined as malicious today but may have been seen inside the organization a week ago.

EDR telemetry retention can make it possible to perform retroactive investigation on past activity.

For this reason telemetry retention is important in terms of incident response.

What Is XDR?

XDR:

Extended Detection and Response

is the detection and response approach that aims to analyze security telemetry sources outside the endpoint together as well.

XDR:

Endpoint

Identity

Email

Network

Cloud

can collect signals from different sources such as these.

The aim is to be able to see the attack chain within a broader context.

What Is the Difference Between EDR and XDR?

EDR is largely focused on endpoint telemetry and response.

XDR, on the other hand, tries to combine the traces of the attack across different security domains.

For example:

Phishing Email

↓

Credential Theft

↓

Cloud Login

↓

Endpoint Malware

↓

Network Connection

can be associated under a single incident.

What Is MDR?

MDR:

Managed Detection and Response

is security monitoring, detection, investigation and response capabilities being delivered with a service model managed by an expert security team.

MDR can be evaluated particularly for organizations that have difficulty creating a 24/7 internal SOC capability.

MDR and EDR are not the same thing.

EDR is a technology.

MDR, on the other hand, is a managed security service approach that contains technology + analyst + process.

The Relationship Between Endpoint Security and the SOC

EDR can produce alerts from hundreds or thousands of endpoints.

These alerts need to be evaluated within the business context.

The SOC analyst:

alert severity,

asset criticality,

user identity,

the process tree,

network activity,

threat intelligence

tries to determine whether it is a real incident by analyzing information such as this.

For this reason a strong EDR deployment may not produce full value without a SOC process.

SIEM and EDR Integration

When EDR events are sent to the SIEM the endpoint activity can be correlated with other security data.

For example:

an EDR suspicious process

an identity risky login

NDR unusual outbound traffic

if these are seen on the same device/user the incident confidence increases.

This structure is the basis of modern Detection Engineering.

What Is Detection Engineering?

Detection engineering is the design, testing and continuous development of reliable detection logic for attacker behaviour and threat scenarios.

Although the EDR default detections are important, according to the organization's:

technology stack,

business environment,

threat model

characteristics, custom detections may be needed.

For this reason endpoint security means not only buying a product but developing detection capability.

How Is MITRE ATT&CK Used in Endpoint Security?

MITRE ATT&CK is the knowledge base widely used for adversary tactics and techniques.

Endpoint security teams can use ATT&CK mapping to evaluate which attacker techniques the detections cover.

In this way:

coverage gaps,

detection priorities,

threat hunting scenarios

can be determined.

However, a high number of ATT&CK mappings on its own is not proof of security effectiveness.

Detection quality must also be tested.

What Is Endpoint Detection Coverage?

Detection coverage shows to what extent the organization has detection capability in the face of the expected attack techniques.

Only the EDR agent being installed does not mean detection coverage.

Policy configuration, telemetry quality and SOC capability also affect the result.

Why Is Endpoint Security Testing Necessary?

The security product being installed does not prove that it works.

With authorized security testing and controlled attack simulation:

prevention,

detection,

alert generation,

SOC response

these capabilities can be verified.

This approach can be used in purple team and detection validation exercises.

How Is Endpoint Incident Response Performed?

When suspicious activity is detected on an endpoint the first aim is to understand the scope of the event.

The basic questions that can be asked:

Which user is affected?

What was the initial vector?

Which process ran?

Did a network connection occur?

Is there a sign of credential theft?

Are other endpoints affected?

According to these the containment and recovery plan is created.

The Endpoint Incident Response Lifecycle

The basic lifecycle can be thought of in this way:

Detect

↓

Validate

↓

Contain

↓

Investigate

↓

Eradicate

↓

Recover

↓

Monitor

The aim is not only to delete the malicious file.

The attack root cause must be determined.

Is an Endpoint Reimage Always Necessary?

Not for every incident.

The risk, compromise depth, evidence and organization policy must be evaluated.

In some cases targeted remediation can be enough.

In some high-risk compromise events a trusted rebuild can be a safer approach.

What Is Endpoint Forensics?

Endpoint forensics is the systematic examination of the digital evidence on a compromised device.

The file system,

memory,

logs,

the registry,

browser artifacts

sources such as these can be analyzed.

It is important particularly in serious security incidents for creating the root cause and attacker activity timeline.

Is EDR a Forensic Tool?

EDR can provide important forensic telemetry but it does not in every case take the place of a full digital forensic platform.

EDR visibility is limited by:

agent deployment,

telemetry retention,

sensor capability

these.

Where necessary dedicated forensic acquisition and analysis can be performed.

Endpoint Security and Zero Trust

In the Zero Trust approach not only the user identity is verified.

Device trust is also evaluated.

A user can authenticate with the correct password and MFA.

However, if the device is:

malware infected,

unmanaged,

unpatched,

non-compliant

the access is risky.

For this reason the Zero Trust access decision:

User Trust + Device Trust + Context + Resource Risk

must be made over these.

What Is Zero Trust Endpoint Security?

Zero Trust Endpoint Security is the device not being accepted as automatically trusted because it is inside the network.

The device's:

identity,

security posture,

EDR health,

patch level,

encryption status

information such as this can be used in the access decision.

This approach is important particularly for remote work and cloud applications.

Endpoint Security KPIs

Various KPIs can be used to measure the effectiveness of the endpoint security program.

Important examples:

EDR Coverage

Healthy Agent Rate

Patch Compliance

Disk Encryption Coverage

Local Admin Reduction

Endpoint Isolation Time

Mean Time to Detect

Mean Time to Respond

These metrics provide measurable visibility about the technical security posture.

What Is Patch Compliance?

Patch compliance shows to what extent the endpoints conform to the patch policy defined by the organization.

For example the rate at which critical security updates are applied within a certain SLA can be measured.

Instead of only saying "there is a patch system" the compliance percentage must be monitored.

What Is Mean Time to Detect?

MTTD:

Mean Time to Detect

is the average time between a security incident beginning and being detected.

Endpoint telemetry and 24/7 monitoring can help to reduce MTTD.

What Is Mean Time to Respond?

MTTR:

Mean Time to Respond

is the metric used to measure the time that passes from the detection of the incident to an effective response action.

Endpoint isolation and automated response capabilities can reduce MTTR.

The Most Frequently Made Mistakes in Endpoint Security

The mistakes frequently seen in corporate environments are these:

• Seeing antivirus as sufficient on its own
• Installing EDR and not performing SOC monitoring
• Not checking EDR agent health
• Ignoring unmanaged endpoints
• Not keeping an asset inventory
• Delaying patch management
• Using unsupported software
• Continuously giving users local admin
• Not applying application control
• Not controlling USB devices
• Not using disk encryption
• Not managing browser extensions
• Not creating a security policy for BYOD
• Not including device compliance in the access decision
• Not correlating the EDR telemetry with the SIEM
• Not preparing an endpoint incident response playbook
• Leaving the ransomware defense only to backup
• Not testing the detection capability
• Not planning the EDR retention period according to the incident response need
• Not measuring the endpoint security KPIs

Endpoint Security Checklist

Organizations can regularly evaluate the following controls:

• Is there an up-to-date asset inventory?
• Are all corporate endpoints being managed?
• Is EPP/NGAV active?
• Has the EDR deployment been completed?
• Is EDR agent health being monitored?
• Is EDR tamper protection being applied?
• Is the endpoint telemetry being stored for a sufficient period?
• Are critical alerts being monitored 24/7?
• Is patch management central?
• Is patch compliance being measured?
• Is unsupported software being detected?
• Have local admin rights been limited?
• Has Endpoint Privilege Management been evaluated?
• Is application control being applied?
• Is disk encryption active?
• Are the recovery keys being managed securely?
• Is a screen auto-lock policy being applied?
• Is USB/device control active?
• Is endpoint DLP being applied?
• Are the browser policies being managed centrally?
• Are browser extensions being controlled?
• Is a BYOD policy available?
• Is MDM/UEM being used?
• Is device compliance being measured?
• Is there an access policy for non-compliant devices?
• Is EDR integrated with the SIEM?
• Are identity and endpoint events being correlated?
• Has the endpoint isolation capability been tested?
• Is a ransomware response playbook available?
• Is threat hunting being performed?
• Is detection coverage being tested regularly?

Endpoint Security Maturity Model

Level 1 - Basic Antivirus

There is antivirus on the endpoints but central visibility and response capability are limited.

The security approach is largely based on known malware detection.

Level 2 - Managed Endpoint Protection

EPP/NGAV, centralized patch management, disk encryption and basic hardening are applied.

The endpoint inventory and security policy are managed centrally.

Level 3 - EDR and SOC Monitoring

The EDR deployment has been completed and the endpoint telemetry is being monitored by the SOC.

Process behaviour, suspicious activities and endpoint incidents can be investigated centrally.

Level 4 - Integrated Detection and Response

EDR;

Identity,

SIEM,

NDR,

Email Security,

Threat Intelligence

is integrated with these.

The attack chain is correlated across different security domains.

Level 5 - Adaptive Zero Trust Endpoint Security

Device risk is included in the real-time access decision.

EDR health, device compliance, user identity and behaviour are evaluated together.

High-risk endpoints can be isolated automatically or their access to sensitive resources can be limited.

Frequently Asked Questions

What is Endpoint Security?

Endpoint Security is the protection of endpoints such as laptops, desktops, workstations and mobile devices against threats such as malware, ransomware, exploits, credential theft and unauthorized access.

Why is endpoint security important?

The devices on which users interact directly with e-mail, the web, applications and corporate data form an important attack surface for the attacker. An endpoint compromise can be the starting point of a broader network attack.

What is EDR?

Endpoint Detection and Response is the security technology that monitors the security-relevant activities taking place on the endpoint, detects suspicious behaviours and provides investigation/response capability.

What is the difference between antivirus and EDR?

While antivirus largely provides malware prevention and detection, EDR offers broader telemetry, behaviour monitoring, investigation and response capability.

What is EPP?

Endpoint Protection Platform is the platform class that brings together preventive endpoint security features such as antivirus, anti-malware, exploit protection, firewall and device control.

What is NGAV?

Next-Generation Antivirus is the endpoint protection approach that uses modern detection methods such as behaviour and machine learning alongside signature detection.

What is XDR?

Extended Detection and Response is the detection and response approach that aims to analyze the signals coming from different security domains such as endpoint, identity, e-mail, network and cloud together.

What is the difference between EDR and XDR?

While EDR concentrates on endpoint telemetry, XDR aims to provide broader incident context by bringing together the attack signals across different security layers.

What is MDR?

Managed Detection and Response is security technologies being delivered as a service model managed together with expert analysts and incident response processes.

If there is antivirus is EDR necessary?

It is evaluated according to the risk and the organization's structure but in the face of modern threats traditional antivirus alone provides limited visibility. EDR provides an important advantage particularly in terms of investigation and response capability.

What is Endpoint Hardening?

It is secure settings being applied on the operating system, applications, privileges and device configurations in order to reduce the endpoint attack surface.

Why is Local Admin risky?

The user continuously working with administrative privileges can make it easier for the attacker to obtain high authority too in the case of a compromise.

What is Application Control?

It is the security control that determines which software and executables can run on the endpoint.

What is Device Control?

It is the security mechanism that manages the use of USB and other peripheral devices on the endpoint with central policy.

What is Endpoint DLP?

It is the DLP control that detects or blocks sensitive data being taken out in an unauthorized way over USB, browser upload, clipboard, print or other endpoint channels.

What is Endpoint Isolation?

It is the response action aimed at preventing the spread of the attack by limiting the network communication of the compromised device.

What is Threat Hunting?

It is suspicious attacker behaviours being investigated proactively inside the environment instead of waiting for security alerts.

What is Zero Trust Endpoint Security?

It is the approach in which the endpoint is not accepted as automatically trusted because it is inside the network; the device identity, security posture, EDR health and compliance state are included in the access decision.

Conclusion: Modern Endpoint Security Is Much More Than Antivirus

At one time when endpoint security was mentioned the first question that came to mind was:

"Is there antivirus on the computer?"

Today this question is still important.

However, it is not sufficient.

Because the modern attacker does not always use known malware.

They can abuse legitimate system tools.

They can use scripts.

They can capture user credentials.

They can target browser sessions.

They can run unknown malware.

Before ransomware they can move inside the environment for weeks.

Therefore the fundamental question of modern endpoint security:

"Did we catch the malware?"

is not this but,

"What is happening on the endpoint that is not normal and how quickly can we understand it?"

it must be this.

For this reason a strong endpoint security architecture can be thought of in this way:

Asset Inventory

↓

Endpoint Hardening

↓

Patch Management

↓

EPP / NGAV

↓

EDR

↓

Application & Device Control

↓

DLP

↓

SIEM / XDR

↓

SOC

↓

Incident Response

However, modern security goes beyond this too.

The endpoint is no longer only a computer that needs to be protected.

At the same time it is a source of:

Identity Context

and

Access Decision

it is a source of these.

A user can log in with the correct password and MFA.

However, if the device is not secure the access can still be risky.

For this reason in the Zero Trust approach:

Who are you?

right after this question:

Is your device trusted?

this question comes.

Modern endpoint security is exactly at the point where these two worlds meet.

There being EDR on the endpoint does not mean that an attack will never take place.

The real value is, when an attack takes place:

to be able to see what happened,

to be able to understand the attack chain,

to be able to isolate the device quickly,

to be able to find the other affected systems

and to be able to prevent the attacker from reaching it again.

For this reason the fundamental formula of modern endpoint security:

Prevent + Harden + Detect + Investigate + Respond + Continuously Verify

is in this form.

And the most important sentence of this chapter is this:

Antivirus looks for the malicious file; modern Endpoint Security, on the other hand, tries to understand the behaviour and the attack chain the attacker creates on the device.