Addressing the CISO’s Key Challenges in 2018 and Beyond with Endpoint Detection and Response

IT security leaders face more hurdles today than ever. From the growing threat landscape to the increasing regulation of the digital economy, information security officers have their work cut out for them.

Research indicates that CISO responsibilities are growing faster than their ability to address security issues. Some of their biggest troubles include evolving threats, tight budgets, lack of skilled staff, complex environments to protect, and even more complex solutions that do little to ease the IT department's load. Coupled with the increasing compliance burdens of GDPR and other regulations like it, CISOs need to meet their responsibilities by working smarter, not harder. One such smart approach includes leveraging effective Endpoint Detection and Response (EDR.)

While there is no shortage of EDR solutions, an evaluation of efficacy among top providers shows these solutions vary widely. But why? Most EDR solutions are: too complex and noisy, they trigger too many false alarms (alert fatigue), offer little to no visibility into the detection and remediation process, and/or lack analytics to automate core processes.

An effective EDR solution should reduce alert fatigue by limiting the number of incidents requiring human analysis, enabling IT departments to focus security resources on real threats, and should never overburden staff or infrastructure resources.

Moreover, IT departments need a security solution that is operationally effective. Instead of piling on disparate solutions from different vendors and achieving inferior results, organizations today have access to technologies that give them the option to deploy a single-agent, single-console solution that greatly reduces the effort to install and manage endpoint security.

An integrated, full-spectrum solution

Combating modern threats requires modern weapons. Traditional security solutions are no longer enough—they only display a warning that a threat was blocked, end of story. They offer no visibility into what happened before, during, and after the attack. This lack of insight does little to prepare security teams for similar attacks in the future.

What IT departments need is integrated EDR and EPP (endpoint protection platform), which offers both protection and visibility across all malicious/suspicious activities throughout the infrastructure, as well as alert triage to let them focus on real threats. This integrated solution also offers effective incident response workflows that help reduce resource requirements.

A proper EDR implementation augments protection, detection and response by working together with the security solution in order to provide a complete picture of how threats target organizations, while also allowing IT and security teams to focus on relevant security incidents. At the same time, a successful EDR/EPP implementation eliminates the need for multiple agents, as everything is delivered under a single solution, manageable from a single centralized console. This simplifies deployment and operations across all enterprise endpoints and operating systems, in complex infrastructures both physical and virtual, and across data centers and public cloud environments.

Furthermore, integrated EDR and EPP provides stack and on-execution detection capabilities, which prevents and stops advanced threats from being executed on enterprise infrastructure, while also helping IT and security teams with forensics and investigations into potential security incidents.

The Best of Both Worlds – Security, Visibility

The evolution of cyberattacks has made anomaly detection an imperative and integral part of EDR. Leveraging Machine Learning, EDR solutions can offer suspicious activity detection that helps with investigation and response, by performing fast security alert triage and focusing on truly relevant security events, usually associated with potential breaches and cyberattacks. Once a potential threat is detected, automatic response kicks-in, enabled by the integrated EPP solution, blocking lateral movement, killing suspicious or malicious processes, and automatically remediating any malicious changes performed by the threat. Finally, pre- and post-compromise forensics, offer by EDR capabilities, provide visibility into past actions covering the entire lifecycle of the attack and creating a full picture of the attacker's objective.

Keeping imminent cyber threats at bay may sound complicated, but it really boils down to just a few key aspects: reducing the attack surface, automating detection and response, gaining insight to mitigate future threats, and avoiding loss of business by rapidly containing and remediating an attack.

Today more than ever, incident response teams need to be given the tools to analyze and investigate suspicious activities, and adequately respond to evolving threats.

About the author: Liviu Arsene is a Senior E-Threat analyst for Bitdefender, with a strong background in security and technology. Reporting on global trends and developments in computer security, he writes about malware outbreaks and security incidents while coordinating with technical and research departments.