Endpoint Security

What is an Endpoint Protection Platform (EPP)? 

EPP是一个平台，它促进了监控代理的部署，以对抗组织网络中每个端点上的恶意软件和其他类型的攻击. EPPs are generally very good at doing what they say: protecting an endpoint. However, 需要进一步的解决方案，以便能够在全网保护方面采取更宏观的立场.

What is Endpoint Detection and Response (EDR)? 

EDR solutions 提供可视性和洞察力，通过识别和报告实时风险来关闭安全漏洞, testing defenses, and – most importantly – detecting endpoint compromise. EDR解决方案应该能够主动识别网络及其用户中的弱点并确定其优先级.

EPP vs. EDR 

EPP和EDR平台和解决方案之间的根本区别在于预防和检测入侵或攻击. EPP利用代理通过下一代防病毒(NGAV)等技术来帮助防止在端点上执行恶意文件。. 

Modern EDR solutions will usually incorporate extended detection and response (XDR) capabilities to go beyond simple detection and response (D&R)通过端点遥测和从外围更广泛的数据收集来提供单窗格的覆盖. 这可以极大地提高组织在攻击链中早期检测事件的能力，并在造成任何或非常小的损害之前关闭攻击.

How Does Endpoint Security Work? 

端点安全通过EPP平台持续监控可疑活动并提醒网络管理员可能的违规行为来工作. 安装在端点上的传感器或代理可以安全地将数据从该端点流式传输到集中式EPP，以便 network traffic analysis can take place and – if necessary – mitigating actions can be taken. Let's take a look at the various types of attacks endpoint data can reveal, thereby determining an appropriate response:

• Malware installation恶意软件的安装方式与正常软件不同. 
• Malware persistence: There are only a finite number of ways that malware can persist on a system. 
• Attacker issues commands攻击者倾向于使用操作系统终端与目标系统进行交互. 
• Attacker steals credentials: Prior to lateral movement, an attacker will need credentials. 
• Attacker downloads additional tools: Attackers typically bring a toolkit with them. 
• Attacker moves laterally to another asset攻击者倾向于跳到网络上的其他资产，希望在到达最终目标资产的途中收集更多的一般数据. 

保护网络系统免受未来攻击意味着在调查期间内部提出入侵后的问题. 

• How did the attacker get in? 
• What tools did the attacker use? 
• Where did the attacker move to? 
• What credentials were used? 
• What data did the attacker have access to? 
• What data was stolen? 
• Is the attacker still in the environment? 
• What specific remediation steps can you take? 
• What can you do to prevent these kinds of attacks from happening in the future? 

Monitoring, D&R行动和调查都在EPP的中心位置或仪表板上进行. If a breach did occur of a type listed above, security personnel can execute tasks like blocking malware, vulnerability detection, remotely disabling assets and/or endpoints to contain any fallout, and much more.

Key Components to Look for in an Endpoint Security Solution 

Each business and its accompanying security organization has different needs, but the big commonality lies in the technology we all depend on to do our jobs. 因此，让我们看一下端点安全解决方案不应该缺少的一些组件. 

Endpoint Visibility 

访问公司数据和应用程序的设备的数量和类型在过去十年中呈指数级增长. This is due in large part to the pandemic, 但技术的普遍采用也使公司能够从他们称之为家乡的直接地理区域以外聘请人才. In this environment, it’s an understatement to say endpoint visibility is critical.

Digital forensics and incident response (DFIR) 工具在帮助安全团队快速收集和查看跨端点的数字取证证据以及主动监控可疑活动方面至关重要. 

Scope Broadening 

With the aforementioned decentralization of the workforce, it's generally accepted that endpoint agents are no longer optional. 安全程序必须能够在任何时间到达任何端点，以有效地应对威胁. Endpoint agents should have EDR capabilities recording key system events, real-time investigative data acquisition, NGAV applications that can terminate threats based on behaviors, active threat prevention, and on-demand mitigation and remediation capabilities.

People must also broaden their capabilities. In this sense, 这意味着终端用户教育应该是安全项目投资策略的关键部分. 与技术成本相比，终端用户安全教育的美元成本微不足道, headcount, and breach-associated costs. Security awareness training 是否可以根据其行业中普遍存在的威胁类型专门为组织量身定制.

Next Generation Antivirus (NGAV)

NGAV goes beyond traditional antivirus to widen the view on an organization’s endpoints. An NGAV solution detects malware and fileless attacks to prevent attacker tactics, techniques, 和程序(TTPs)以及恶意行为，这些恶意行为要么是有意的，要么是无意的, in fact, properly credentialed.

NGAV阻止隐藏在进程中的恶意代码在被识别之前执行. By leveraging artificial intelligence (AI), machine learning (ML), and other capabilities, NGAV can learn from past behaviors of the endpoints on which it is installed. 然后，它可以更有效地阻止整个端点生态系统中的各种攻击.

Why is Endpoint Security Important? 

端点安全性非常重要，因为它有助于查明并降低整个组织的风险. Real-time detection of threats, remote and virtual-infrastructure monitoring, 快速部署代理只是端点安全可以带来的一些好处.

Endpoint security strategy is also changing, 正如上面所讨论的那样，超越了端点，成为更大的XDR程序的关键部分. This is important if security organizations wish to become more proactive, 检测潜在的即将到来的攻击信号，并在造成任何损害之前关闭它.

Every employee interacts with multiple endpoints every day, including personal devices used for work purposes, hopping on and off the corporate network. A robust monitoring and D&R计划有助于保护资产生态系统免受越来越复杂的破坏, lateral movements, and data theft.

Read More on Endpoint Security 

Endpoint Security: Latest Rapid7 Blog Posts 

Use Case: Unify Endpoint Assessment