What is EDR?
The acronym stands for Endpoint Detection and Response,
which is increasingly an essential part of any competent cybersecurity strategy.
Over the next few minutes, I'll go through how it works and why it's so essential these days.
I'm Sam Hector from the IBM security team,
and what I think EDR is really doing is endpoint threat detection and response.
After all, the point of EDR is not to go around detecting all of the laptops, phones and servers on your network,
but rather it's to proactively detect threats on those endpoints when they occur
and respond to them in real time.
To do this effectively, it needs to do four things really well.
Collect security data from the endpoints using an agent,
which is a small, lightweight application that runs on each of these devices
to enable data gathering, detection and then response actions to take place.
Even when that endpoint isn't connected to the Internet.
It needs to collect security relevant telemetry, like what processes are running,
what servers are they connecting to, and what files are being accessed.
And lots more information that can be useful to detect the presence of a threat.
Or to use in forensic analysis and investigation after an attack has occurred.
The second thing it needs to do is detect and respond to threats in real time and automatically.
It does this mainly in two different ways.
One, for threats we've seen before and one for threats we've never seen.
When we detect attacks in the wild,
security teams can gather what's called indicators of compromise, or IOCs,
in order to take a unique fingerprint of a piece of malware
like a ransomware tool that's been around for a while, for example.
In this case, the EDL tool can act like the bouncer on the door of a nightclub
denying entry to a list of bad actors before they even get in.
Traditionally, this is what antivirus would have been known for doing.
But what about threats we've never seen before?
Or how wouldn't EDR solution protect against the growing number of fileless attacks?
Ones which never download malicious malware or leave any trace.
Well, even threats we've seen before use similar tactics and techniques to past attacks we're already aware of.
So in order to detect them without a fingerprint, it's a case of using advanced algorithms to look for those behaviors.
For example, a really common method of distributing malware
is by hiding it in the macro code of an innocent looking Microsoft Office file.
An ideal tool could stop this by noticing when the Excel application tries to alter the system's security settings,
something it would never normally need to do.
So the EDR can block the attempt before it's successful.
The third thing it needs to enable is forensic investigation and threat hunting.
Because I'm afraid to say that no EDR tool will stop 100% of attacks.
But by capturing lots of security relevant information,
they can help security teams understand how attacks were successful
and how to change their approach to ensure they're detected and blocked in the future.
This can also enable security teams to perform threat hunting activities,
to go and proactively investigate all of their endpoints at once
for the presence of a new threat that's not yet detected automatically.
so they can manually take action to reduce their risk.
And finally, an ideal tool needs to integrate and report.
For a security analyst, it needs to integrate into their existing workflow.
They're often inundated by alerts they need to triage from lots of different tools.
And EDR should help them prioritize incidents to look at urgently,
present them with all of the potentially relevant information in a friendly interface
and speak the same language as other security tools
by adopting common vernacular like the MITER ATT&CK Framework.
For a security team, an EDR tool needs to integrate with all of their existing capability
and feed additional telemetry into a management platform like a SIEM tool for threat detection,
a SOAR tool for incident response, or an XDR platform that combines these capabilities.
It also needs to enable reporting both on the importance of your organization's mean time to respond to an attack,
but also reporting against compliance to regulatory frameworks.
So to finish, if you're looking for an EDR tool, here's a few things you should really look out for.
The best ones, like IBM's ReaQta, will be highly resilient to attack.
Ideally by being invisible and inaccessible to running malware on the operating system.
They should use advanced AI to learn from the decisions your analysts have made in the past,
and recommend that in future that alert is automatically handled
to drastically reduce the analyst workload by more than 80%.
They should have logging capabilities that use as little data as possible to save money on the cost of bandwidth.
And offer multiple deployment models between SaaS,
on-prem, and even air gapped environments to give you as much flexibility as possible.
To talk to IBM about adopting EDR, or even optimizing your approach,
click the link in the description and get involved in the conversation in the comments below.
Check out our other cybersecurity videos and subscribe to see more in the future.