researchHQ’s Key Takeaways:
- For organisations to ensure optimum security of their systems and data they must find the right balance between prevention and detection.
- Endpoint Detection and Response (EDR) allows organisations to detect and respond to threats in real-time.
- EDR platforms help companies protect their sensitive data, offering advanced security, increased visibility and superior protection compared to traditional anti-malware.
Endpoint detection and response (EDR) tools are built to supplement endpoint security with increased detection, investigation, and response capabilities. However, the hype surrounding EDR tools can make it difficult to understand how exactly they can be used and why they are needed. Making matters worse, today’s EDR solutions often struggle to provide value for many organizations as they can be difficult to use, lack sufficient protection capabilities, and are resource intensive.
Sophos Intercept X with EDR integrates intelligent EDR with the industry’s top-rated endpoint and server protection in a single solution, making it the easiest way for organizations to answer the tough questions about security incidents. Here are some additional reasons to consider an EDR solution.
1. Depending on the organization IT operations and IT security staff can either be part of the same team, operate independently or even be the same person. Whatever the setup, the two areas require different use cases from an EDR tool, so that tool should be capable of performing both sets of tasks and remain accessible without compromising on power.
For the IT operations admin keeping their organization’s estate in good health is critical. For example, finding machines with performance issues such as low disk space or high memory usage. Locating devices that have vulnerable programs that require patching. Tracking down endpoints and servers that have RDP enabled unnecessarily or still have guest counts enabled. Sophos EDR gives admins the tools to ask all of these questions and many more, as well as the ability to remotely access the devices to fix security holes by investigating performance issues, installing patches, and disabling RDP and guest accounts.
Cybersecurity specialists need to be able to hunt down subtle, evasive threats that aren’t automatically convicted by their endpoint protection. Their EDR tool needs to be efficient at tracking down indicators of compromise (IoCs) such as: identifying processes attempting to connect on non-standard ports, processes that have edited files or registry keys, processes disguising themselves as something else, and tracking down which employees clicked a link in a phishing email. Sophos EDR makes it easy to quickly perform these types of investigation across an organization’s entire estate. Then, it’s just as easy to remotely access a device of interest to dig deeper, deploy forensic tools and terminate suspicious processes.
Figure 1: Sophos Intercept X with EDR lets users ask detailed questions across their entire estate
2. When it comes to cybersecurity, even the most advanced tools can be defeated given enough time and resources, making it difficult to truly understand when attacks are happening. Organizations often rely solely on prevention to stay protected, and while prevention is critical, EDR offers another layer of detection capabilities to potentially find incidents that have gone unnoticed.
Organizations can leverage EDR to detect attacks by searching for indicators of compromise (IOCs). This is a quick and straightforward way to hunt for attacks that may have been missed. Threat searches are frequently kicked off after a notification from third-party threat intelligence: for example, a government agency (such as US-CERT, CERT-UK, or CERT Australia) might inform an organization that there is suspicious activity in their network. The notification may be accompanied by a list of IOCs, which can be used as a starting point to determine what is happening.
The Threat Indicators feature in Intercept X provides a list of the top suspicious events, so analysts know exactly what they should be investigating. By leveraging SophosLabs machine learning capabilities, a list of the top suspicious events is presented, ranked by their threat score. This makes it easy for analysts to prioritize their workloads and focus on the most important events.
Knowing where to start the analyst can then track down all instances of that suspicious item across their entire estate and quickly take action to clean up. In addition, they can leverage powerful SQL queries to track down other indicators of compromise such as processes editing registry keys and processes attempting to connect on non-standard ports.
Figure 2: Sophos Intercept X with EDR offers the ability to search for indicators of compromise across the network. It also leverages machine learning to determine the top suspicious events that should be investigated
Combining the ability to ask detailed questions with guidance on where to start, as well as curated threat intelligence gives admins the best of all worlds and makes Sophos EDR straightforward to use without sacrificing any power or granularity
3. Once incidents are detected, IT and security teams usually scramble to remediate them as fast as possible to reduce the risk of attacks spreading and to limit any potential damage. Naturally, the most pertinent question to ask is how to get rid of each respective threat. On average, security and IT teams spend more than three hours trying to remediate each incident. EDR can speed this up significantly.
The first step an analyst might take during the incident response process would be to stop an attack from spreading. Intercept X with EDR isolates endpoints and servers on demand, which is a key step to stop a threat from spreading throughout the environment. Analysts will often do this before investigating, buying time while they determine the best course of action.
The investigation process can be a slow and painful one. This of course assumes an investigation occurs at all. Incident response traditionally relies heavily on highly-skilled human analysts. Most EDR tools also rely heavily on analysts to know which questions to ask and how to interpret the answers. However, with Intercept X with EDR, security teams of all skill levels can quickly respond to security incidents thanks to guided investigations that offer suggested next steps, clear visual attack representations, and built-in expertise.
