When prevention mechanisms fail, EDR — Endpoint Detection and Response — tools enable a fast reaction that keeps the damages at a minimum.

In case a cyber attack occurs, every second count. Losses due to an attack can multiply with each passing minute. That’s why early detection is key to minimizing the impact of a cyber-attack. EDR tools are a valuable ally when it comes to quickly mitigate a dangerous cybersecurity incident.

Importance of reacting on time

The more time cyber criminals go unnoticed on a corporate network, the more data they collect, and the closer they get to critical business assets. That’s why companies should curb cyber attacks by reducing exposure time and stop them before the damage is irreparable.

In 2013, the consulting firm Gartner Group defined EDR tools as a new cybersecurity technology that monitors endpoint devices on a network, providing immediate access to information about an attack in progress. According to Gartner, in addition to giving visibility to the attack information, EDR tools help IT security personnel respond quickly, either by quarantining the attacked device, blocking malicious processes, or executing incident response procedures.

What is an endpoint device?

In networking, an endpoint is defined as any device connected to the edges of a data network. This includes everything from computers, telephones and customer service kiosks, to printers, point of sale (POS) terminals and IoT (Internet of Things) devices. Collectively, endpoints pose challenges for network security administrators, since they are the most exposed part of the network and because they create potential penetration points for cyberattackers.

Basic components of EDR

EDR tools are made up of three necessary components:

• Data collection – software components that run on endpoint devices and collect information about running processes, logins, and open communication channels.
• Detection – which analyzes the regular activity of the endpoint, detecting anomalies and reporting those that could mean a security incident.
• Data analysis – which groups information from different endpoints and provides real-time analytics about security incidents throughout the corporate network.

Among the desirable characteristics of an EDR solution is the intelligent identification of Indicators of Compromise (IoCs) on the endpoints. These indicators allow the information of an ongoing incident to be compared with data recorded in previous events, to quickly identify the threat and not waste time with the analysis that would not be useful to stop the attack.

Other key aspects of EDR solutions are forensic analysis and alerts that notify IT staff when an incident occurs, giving them quick access to all information about the incident. An adequate and easily accessible context of the incident is essential so that security personnel has everything they need to investigate it. It is also important that the EDR solution provides tracking functionality, both to identify other endpoints affected by the attack and to determine the endpoint used to penetrate the network.

Automated responses are also a desirable aspect of an EDR solution. Such responses consist of proactive initiatives, such as blocking network access, blocking individual processes, or taking other actions that could contain or mitigate the attack.

Let’s take a look at some of the best EDR tools you can use.

#security