Instructor: Endpoint analysis. 2 2
Now, endpoint analysis is used when 3 3
we're conducting monitoring, logging, 4 4
and analysis of our endpoints. 5 5
An endpoint is, simply, any device 6 6
that we may use to connect to our network. 7 7
Now, for example, your desktop, 8 8
or your laptop at the office, that's considered an endpoint. 9 9
So is your smartphone, or your tablet. 10 10
As a cybersecurity analyst, you must be able 11 11
to use tools to identify behavioral anomalies, 12 12
and then identify the techniques used by malware 13 13
to achieve privilege, escalation, 14 14
and persistence on your host. 15 15
Now, there are lots of different 16 16
endpoint protection tools out there, 17 17
and, in this lesson, we're going to cover 18 18
five different endpoint security capabilities 19 19
that we can use for analysis. 20 20
These are antivirus, host intrusion detection systems, 21 21
and host intrusion prevention systems, 22 22
endpoint protection platforms, 23 23
endpoint detection response platforms, 24 24
and user and entity behavioral analytics. 25 25
Let's talk about each of these in this lesson. 26 26
First, antivirus. 27 27
Antivirus is a software that's capable 28 28
of detecting and removing virus infections, 29 29
and, in most cases, other types of malware, 30 30
such as worms, Trojans, root kits, adware, 31 31
spyware, password crackers, network mappers, 32 32
denial service tools, and others. 33 33
Often, you'll hear this called antivirus or anti-malware. 34 34
At this point in your career, you should be pretty familiar 35 35
with what antivirus and anti-malware is. 36 36
The next one we're going to talk about 37 37
is host-based IDS and IPS, which is HIDS or HIPS. 38 38
This is a type of IDS or IPS that monitors a computer system 39 39
for unexpected behavior, and drastic changes 40 40
to the system state on a given endpoint. 41 41
Now, most of these are going to use 42 42
signature-based detection, 43 43
using log or file monitoring systems 44 44
to figure out if something bad 45 45
is trying to happen to your endpoint. 46 46
They may use file system integrity monitoring, too, 47 47
to see if your operating system files have been changed, 48 48
or drivers have been changed 49 49
or an application has been changed. 50 50
All of these things are things that 51 51
a host-based intrusion detection system, 52 52
or intrusion prevention system can help you with, 53 53
that a network-based intrusion detection, 54 54
or intrusion prevention system really can't see. 55 55
Now, the next one we have 56 56
is an endpoint protection platform, or EPP. 57 57
This is a software agent and monitoring system 58 58
that performs multiple security tasks. 59 59
It can do things like antivirus, 60 60
it can do host intrusion detection, or prevention systems. 61 61
It can have a firewall, it can have data loss prevention, 62 62
or DLP, and it can have file encryption. 63 63
All of this in a single product, essentially, 64 64
it's your Swiss Army Knife of security tools. 65 65
We call this an EPP. 66 66
Now, there are a lot of EPPs on the market, 67 67
and every year there's a thing called the Magic Quadrant 68 68
that's put out by Gartner. 69 69
Gartner goes and rates all the different systems, 70 70
to see who's the best, which ones are the leaders, 71 71
who are the challengers, who of them are niche players, 72 72
and who of them are visionaries. 73 73
And you can see that here, on the screen. 74 74
As you can see, the top three is Microsoft, 75 75
CrowdStrike, and Semantic, and all three of them 76 76
have great endpoint protection platforms 77 77
that you can choose from. 78 78
The next one we're going to talk about is EDR, 79 79
which is endpoint detection and response. 80 80
Now, where EPP is mostly based on signature detection, 81 81
EDR is focused more on behavioral and anomaly analysis. 82 82
It starts logging the endpoints, observables, 83 83
and indicators, and combines that with analysis, 84 84
and tries to figure out what's wrong. 85 85
So, this is a software agent that's going to 86 86
collect system data and logs for analysis, 87 87
by monitoring the system 88 88
to provide early detection of threats. 89 89
Now, because of that, the aim of EDR 90 90
is not to prevent an initial execution, 91 91
but instead, to provide runtime, 92 92
and historical visibility into a compromise. 93 93
And once you've been detected, 94 94
it can start responding to that, and it helps you, 95 95
as an instant responder, to gather more information, 96 96
and facilitate your remediation, 97 97
to get it back to its original state. 98 98
The final one we want to talk about, here, is UEBA, 99 99
which is user and entity behavior analytics. 100 100
This is a system that can provide automated identification 101 101
of suspicious activity by user accounts and computer hosts. 102 102
Now, this solution is less about endpoint data collection, 103 103
and more about the actual process 104 104
of analyzing the data you're getting. 105 105
The idea here, is to have a baseline of good knowledge, 106 106
and then we're going to compare anything 107 107
that goes outside that baseline, 108 108
and start thinking that might be suspicious, 109 109
and look into it further. 110 110
Now, a lot of UEBA is focused on the analytics, 111 111
and because of that, there's a lot of data 112 112
that has to be processed. 113 113
So, UEBA solutions are heavily dependent 114 114
on advanced computing techniques, 115 115
things like artificial intelligence, and machine learning. 116 116
There's a lot of these different players out there 117 117
in the marketplace that are doing UEBA. 118 118
Two of the big ones out there right now 119 119
is Microsoft and Splunk. 120 120
Microsoft has the Microsoft Advanced Threat Analytics. 121 121
You could see this diagram here on the screen. 122 122
Essentially, we have some unknown threat that comes in. 123 123
It goes into some sort 124 124
of a sandboxed environment for detonation. 125 125
Based on that, 126 126
it does a heuristic behavioral model of what it saw. 127 127
It passes that into machine learning. 128 128
And based on the machine learning models, 129 129
it will decide whether or not 130 130
this is really a threat, or if it's not a threat. 131 131
And based on that, it'll let that message go through. 132 132
Now, on the other hand, Splunk is another one out there, 133 133
and it's called the Splunk User Behavior Analytics. 134 134
This tool will allow you to get all that data 135 135
into a nice dashboard, so your analysts can go through it, 136 136
and they can see what are threats, what are anomalies, 137 137
how many users you have, how many devices you have, 138 138
and all the different statistics, and you can drill down 139 139
into each area of that, and look at all the analytics, 140 140
and make your decisions based on that. 141 141
Now, I know we just covered 142 142
these five different technologies, 143 143
and we try to keep it very clear cut, and say, 144 144
this one does this, and that one does that. 145 145
But, as everything in security, 146 146
things evolve, and things merge together. 147 147
And so now, many companies are starting to market 148 148
advanced threat protection, ATP, 149 149
advanced Endpoint Protection, AEP, 150 150
and NextGen AV, which is NGAV. 151 151
And all of this just becomes, essentially, a hybrid 152 152
of the different technologies we talked about before, 153 153
like the endpoint protection platform, 154 154
the endpoint detection response, 155 155
or the user and entity behavioral analytics.