Posts tagged cyber security

EPP vs EDR: the differences between the two

EPP vs EDR – Know the Difference

An Endpoint Protection Platform (EPP) is an enterprise solution typically comprised of capabilities such as port and device control, a local firewall, and anti-malware software. One of the things which most strongly characterizes an EPP is its ability to provide anti-malware scanning, based on detection methods which rely on known signatures, in other words antivirus software.

Advanced Endpoint Protection Platforms

Some EPP platforms go a bit further than this, providing detailed monitoring of endpoint file activity, as well as the detection of suspicious or malicious behavior from such files, which may be completely missed by other layers of security. Going one step further, when this kind of suspicious activity is detected, some EPPs even provide the means of managing it.

This can be an extremely important part of any security system. The truth is that it’s impossible to be 100% protected from malware attacks, and some will break past your firewall and your antivirus software. When they do, having such monitoring of file activity on your endpoints can provide just the kind of alert that you need to spot an attack, before malware has a chance to do any serious damage.

What is Endpoint Detection & Response?

By contrast, Endpoint Detection & Response is a security system comprised of at least four major capabilities:

  • the detection of security incidents
  • the localization of any incidents right there at the endpoint of detection
  • the ability to conduct a full investigation of any potential security incidents
  • and the restoration of endpoints to their original status prior to infection.

From this it can be seen that the difference between EPP and EDR is that EPP tends to be more of a front-line defense and EDR tends to be more of a second or third line of defense. While the hope is that any Endpoint Protection Platform will detect almost all malware attacks, the EDR security provides many more tools for managing attacks which have been identified, and have already been carried out to at least some extent.

Hybrid EPP and EDR Systems

It was inevitable that security vendors would develop a package that includes elements of both an EPP and an EDR system to provide the ultimate security system. The market for such products is definitely there, because there are many small businesses and large corporations which have woken up to the dangers of ignoring security, and have now swung their security pendulums entirely to the opposite side.

You can never have too much security in place at an organization, and anything which provides a full toolkit of options is a good idea when it comes to security. For that reason, some companies now provide hybrid systems which include features of both an EPP and an EDR, so that threats can not only be identified, they can also be dealt with right on the spot.

Here are some of the features you might find in a hybrid security platform:

  • threat identification using signature-based methods
  • sandboxing’ capabilities that perform on-the-spot analysis of files against hundreds of known behavioral indicators, to detect suspicious activity
  • malware detection and blocking, using techniques such as signature matching and fuzzy fingerprinting at the endpoint prevent network breaches
  • when potentially harmful files slip past the front line of defense, the secondary features can be invoked. That means a continuous analysis of files that enter the network, regardless of what their status is. If later analysis should indicate suspicious behavior, an alert can be sent to the security team, along with the recorded history of file activity thus far. Your team will have a full understanding of where such files came from and what it’s been doing once it entered your network. You’ll then also have the capability of controlling it and deciding what to do with it.

Which is Best for Your Enterprise?

Deciding which approach your company should take to protecting its valuable data assets and network infrastructure will depend on a few things – but one of them should NOT be that you’ve been immune from attacks in the past. That’s the kind of mindset which can easily make your company next on the list for a harmful cyberattack.

Instead, you’ll probably have to take cost into consideration, especially if your security budget is somewhat limited. Then too, you should consider the offerings available from a short list of vendors which you’ve prepared, or which you have been advised about by a security consultant.

Don’t forget to take into account what you already have in place, so that you won’t have to gut the system and completely replace it. Whatever you end up with, make sure to use all the information provided to you, keep it as current as possible, and back up your data files.

Close-up of a phone with different icons branching out: representing the different aspects that small business cyber security will protect.

Why Cyber Security Is Still Important for Small Businesses

Cyber attacks of recent years have grown in number and size, making it crucial to alert the computing world at large of the need to protect data assets and network infrastructure. Large corporations, small businesses, and even private individuals are all subject to attack from criminal-minded hackers who are bent on profiting from illegal penetration into your computing system.  Many of the most high-profile cyber attacks of recent years targeted large corporations, simply because of the potential for extracting more substantial sums of money from them in exchange for the safe return of business assets (ransomware). While attacks against small businesses (SMB’s) have not garnered the headlines nor the high visibility of major attacks against big corporations, that doesn’t mean they aren’t taking place. In fact, small businesses now are being hit much more frequently because hackers have realized that, all those small profits from SMB’s do add up to big money in total. Statistics show that over the past several years, more than half of small businesses have had network security breached in some way by hackers. This alarming development should clearly point out the need for small businesses to be on the alert, small business cyber security should be taken seriously.

Managing the Risk of Cyber Attacks Against Small Businesses

In addition to the cumulative appeal of profits from small business attacks, there is another reason why criminals have been turning their attention to SMB’s. With fewer resources allocated to cybersecurity, and less formalized training and education against the potential for cyber attacks, small businesses often present very inviting targets for the criminal-minded.

It’s also true that limited budgets make small businesses cyber security not as readily accessible. However, even with limited resources, there are at least a few necessary steps that all small businesses can take, which will reduce the likelihood of an attack, and at least provide some measure of security for valuable business assets.

For instance, at least one person in every small business can be designated to stay abreast of all known cyberattack threats, so that it’s at least possible to take preventive measures against specific threats and risks. This would typically be an I.T. person who’s also responsible for keeping system software updated with any security patches made available by vendors. Soon after the newest cyberattacks appear, software gurus are at work developing fixes to patch whatever weakness allowed the attack to take place, and these should be applied to your software system as soon as they are made available.

It’s also imperative to take regular backups of business-critical data so that in the event of an attack like ransomware, there is always a safe and current version of data to fall back on, without surrendering to the demands of a hacker.

A person with a laptop and phone: representing the implementation of small business cyber security.

To implement effective small business cyber security, it’s important to train all employees on different types of cyber attacks and how to resolve them.

Education and Training on Small Business Cyber Security

It’s fair to say that the biggest vulnerability for small business cyber security is the lack of employee education and training. This, of course, is not limited to SMB’s, because even corporate giants are frequently exposed to cyber threats by the weakest point in their networks, which is the actions of employees.

Hackers are naturally aware of this, and much of their time and effort is spent trying to dupe unsuspecting company employees into providing them with crucial information like passwords or account data which will allow them to carry out attacks against the company network. All this should make it clear that one of the top priority investments in small business cyber security is to properly educate and train employees about cyber threats, and how they’re carried out and resolved.

Every employee needs to be aware of the potential for cyber attacks and should treat anything suspicious with extreme caution. At the bare minimum, all employees should be educated about the necessity for safeguarding passwords, credentials, and account information. Such attacks can be carried out through email phishing scams, or possibly social media, where cyber attackers are known to be listening, and waiting to exploit unsuspecting employees to obtain vital security information in a seemingly harmless environment.

Hackers can also obtain business details information from employees via social engineering, wherein cyber attackers manipulate employees by pretending to be clients, banking institutions, or other characters of authority or importance. Some of these attacks are made through phone calls where a supposed colleague requests to know changes made to account information need to be reminded of specific passwords to gain access to system software. Hackers posing as managers from other departments have also exploited unwary employees with phone calls asking for similar information, which can then be used to breach the computing system and hijack valuable company data assets.

Some small businesses in the country have gotten the message, and have taken whatever steps they can to prevent cyberattacks, or at least reduce the potential for them. If awareness is the first big step toward improving your small business cyber security, educating employees about cyber attacks can be said to be an essential second step. Hackers these days are determined to victimize small businesses as well as corporate giants, and that means SMB owners and managers have to be just as committed to preventing those attacks.

 

Go to Top