The use of workstations and servers has become an integral part of our day-to-day life, driving both personal and business objectives. They are very flexible, enhance productivity and overall deliverables. However, many critical vulnerabilities are associated with the endpoints; they are at the core of cybersecurity threats. It is obvious that most of the resources being targeted in cyber-attacks are either host-based, applications or databases which still point to the endpoints. This paper focuses on the security of endpoints.

Each day comes with a new threat; cyber-attacks are evolving in both sophistication and scale. According to IBM Ponemon Institute's May 28th, 2021 report, the global average cost of a data breach is $4.24 million, yet 78% of organizations are still breached: from SolarWinds, FireEye, to Microsoft exchange servers down to the colonial pipeline attacks and still counting. According to IBM, it took an average of 228 days to detect and 80 days to contain a breach in 2020. Another controversy is who should confirm successful attacks or breaches: the internal security teams, the attackers, or third parties. It is a sad fact that 64% of victims of cyber-attacks get to find out they have been breached from third parties. Statistics from Dataprot show that about 560,000 new malicious samples are created globally every 24 hours. Processing malware artifacts efficiently consumes remarkable system resources which affect the overall system performance. Defenders are either overwhelmed by too much noise from security solutions, bothered by incomplete visibility on the endpoints, or incapacitated in their response actions, as most tools practically provide little or no functionality beyond the detection phase.

In the quest for absolute safety, there has been an evolution from the native anti-virus, to endpoint detection and response (EDR), and now extended detection and response (XDR); customers put their faith in seemingly popular vendors’ solutions released yearly, only to be compromised again and again. It is obvious that traditional anti-virus blocks all malware with known signatures. However, the detection engine is circumvented by non-signature-based attacks, such as in-memory or fileless malware. EDRs are expected to enhance endpoint security by providing additional features like pattern matching and behavioural analytics, by assigning reputation (blacklist and whitelist), localizing policy and creating watchlists, by automated sandboxing using artificial intelligence, and the use of machine-learning algorithms among others. But on the contrary, most EDRs end up generating more false positives due to the heuristic detection mechanism, creating the need for security professionals to single out the true positives – a Herculean task of identifying a needle in a haystack.

From a survey, it was observed that customers' choice of EDR was based on the popularity of the vendor. This vendor-bias approach must be eliminated, hence the need for a baseline for endpoint security solutions. These should be the minimum features that EDR solutions should have, to level up with the evolving threat landscape. Some of these checkboxes are a simple interactive API design, with good documentation and excellent support, a robust threat-hunting capability that gives security practitioners control over unfiltered endpoint datasets. It should have a classification engine that separates observed samples into either malicious, suspicious or benign. APT groups sometimes use fileless malware to bypass traditional endpoint security controls, hence the need for memory forensic analysis capability in the EDR. It should also have easy-to-understand and interpretable frameworks integrated into the platform so that Security Operation Centre (SOC) analysts can build on the underlying decision logic in their day-to-day investigations. It should give a deep insight into attackers' motives, the nature of the threats from the result of the analysis, and integrated threat intelligence platforms. It should present a more enriching triage visualization interface and powerful remediation measures that will not end at the quarantine or isolation phase. More actionable steps like directly fetching logs from endpoints, terminating malicious processes and sub-processes, restoring system state to the last healthy snapshot, among others, should be incorporated to achieve maximum security of endpoints.

This checkbox aims to achieve a more precise detection, stealthier mitigation and complete recovery in the shortest possible time with little SOC analyst interaction, without trading off optimal productivity of the resources running on those endpoints.

Got a question about this presentation? To get in touch with the speaker, find Nathaniel on Discord under the nickname ZoomOnIt#1669 or contact him on Twitter at @zoom_on_IT or via his LinkedIn profile.