Every Business Can Have Visibility into Advanced and Sophisticated Attacks

Years ago, senior managers of large organizations and enterprises were primarily preoccupied with growing their businesses, forming strategic alliances and increasing revenue. Security, mostly left to IT departments, was usually regarded as a set-and-forget solution that was in place for either compliance purposes or to prevent permanent damage within the organization's infrastructure.

Fast forward several years, and organizations have woken up to the cold reality of data breaches, malware outbreaks, and hefty financial penalties because of increased sophistication of threats and inadequate security measures implemented by organizations. Since 2013, hacks and data breaches have not only flooded the main stream media, but have also shown just how ill-prepared organizations really are when dealing with them.

Equifax, Yahoo, the US and French election scandals, Wannacry, NotPetya, BadRabbit, and Uber are among the most memorable events in recent cybersecurity history. Equifax lost over 30 percent of its market value, which is about $5 billion. Verizon saved $350 million when buying Yahoo, because of the massive data loss scandal. Cyberattacks are bad for businesses, and their consequences bring cyber risk to the top of the minds of senior executives.

Quantifying the impact of cyberattacks

While decision makers and senior executives prefer hard numbers when quantifying the impact of a cyberattack, it's worth noting that the traditional method of assessing breaches is somewhat flawed. Simply looking at the direct costs associated with the theft of personal information is no longer enough, especially with GDPR threatening heavy penalties for the breach of customer or employee records.

For a complete view on the impact of cyberattacks, organizations need to look beyond the theft of intellectual property, the disruption of core operations, and the destruction of critical infrastructure. They need to start factoring in hidden costs that revolve around insurance premiums, lost value of customer relationships, value of contract revenue, devaluation of brand, and the loss of intellectual property.

Understanding the Change

To understand how things have changed, organizations need to look at the cyberattack kill-chain that most advanced and targeted attacks employ to breach an organization's infrastructure.

Reconnaissance, the first stage, involves threat actors selecting a target, researching it, and attempting to identify vulnerabilities in its infrastructure. Weaponization is the process in which threat actors create or repurpose malware and exploits to breach the target organization. Delivery and exploitation involve transmitting the cyber weapon to the target, either via email attachments or infected websites, and exploiting a vulnerability in a target program on the victim's endpoint. The last three stages usually involve the installation of access tools that allow the malware to connect to a C&C (Command and Control) server to let the intruder gain persistency into the targeted infrastructure, and conclude with data exfiltration, data destruction, or whatever actions on objectives threat actors had in mind when targeting the organization.

The obvious goal is to break the attack kill-chain before it reaches the actions on objectives phase. As such, endpoint protection platforms (EPPs) have predominantly focused on disrupting the first four steps of the kill chain, preventing threat actors from installing malware on the targeted endpoint. However, prevention is never 100% bulletproof.

The most radical change companies have made in recent years to address this, is implementing solutions that improve the ability to quickly detect and effectively respond to these types of targeted attacks. This is where the Endpoint Detection and Response solutions (EDR) come in.

Breaking the Unbreakable Shield

In recent years, EPPs were commonly regarded much like Captain America's shield -- one of the Marvel Universe's most resilient and almost invulnerable objects. However, on rare occasions, the shield—though it was designed to be indestructible—has failed to protect Captain America. Even though villains with such powers are few and far between, it can happen, just like with an advanced, targeted cyberattack breaking through an EPP.

Similarly, no matter how seriously a company takes security and regardless of what state-of-the-art tools it's using to prevent cyber-attacks, prevention doesn't work 100% of the time, especially for sensitive industries or high-profile organizations which are targets of very advanced and persistent attacks. The attacks that manage to elude prevention are typically very insidious, incredibly difficult to detect, and highly damaging to organizations.

Companies need to improve their ability to quickly detect and effectively respond to these types of attacks, investigate incidents for scope and impact, limit damages, and fortify themselves with an enhanced security posture against future attacks.

EDR tools help companies achieve these objectives and are focused on detecting security-related events and incidents, while providing strong instruments for investigation, and capabilities to appropriately respond to incidents. Therefore, in context of the increasing number and sophistication of attacks, the importance of EDR solutions for companies is growing quickly.

Building a Security Ecosystem

Building a strong security ecosystem is about having both the shield and the sword working together to increase the overall security posture of the organization. Integrated EPP and EDR means evolved security over time. A strongly integrated platform will enable security teams to incorporate the threat intelligence into improving the security posture of the organization, by adapting security policies to block identified threats or by eliminating vulnerabilities through security patching. A platform developed from the ground up as an integrated solution enables superior operational effectiveness. It's faster and cheaper to acquire, easier to deploy, consumes less endpoint resources and saves time for the security team.

Having all these built into a single platform can help provide enterprises with prevention, detection, automatic response, threat visibility and one-click resolution capabilities to accurately defend against even the most sophisticated cyber threats and to be prepared even if their virtually invincible shield cracks.