In this lesson,
we will cover endpoint detection and response.
Endpoint detection and response, or EDR,
is a cybersecurity technology that addresses the need
for continuous monitoring and response to advanced threats.
EDR is a critical component of security operations
for many companies and organizations.
Endpoint detection and response was the original version
of the technology, and it heavily relies
on file integrity monitoring
and has been updated in recent years
to include extended detection and response.
So in this lesson, we will discuss all three
of these technologies, including endpoint detection
and response, file integrity monitoring,
and extended detection and response.
First, let's take a look at endpoint detection and response.
Endpoint detection and response,
also known by its acronym EDR,
is a category of security tools that monitor endpoint
and network events and record the information
in a centralized database where further analysis, detection,
and investigation, reporting and alerting takes place.
The primary purpose of an endpoint detection
and response solution is to provide incident data
to our cybersecurity analysts
to help enhance the security monitoring incident response
and forensic investigations
that they conduct on your enterprise network.
For example, an endpoint detection
and response solution might monitor a network for signs
of malware or other cyber threats.
If a threat is detected, the endpoint detection
and response solution can either alert the security team
or take predefined actions from a playback using automation
and orchestration to mitigate the identified threat.
So how does endpoint detection and response work?
Well, EDR works by continuously monitoring
and gathering data from endpoints
that could indicate a threat by following a six-step process
of data collection, data consolidation,
threat detection, alerts,
and threat response, threat investigation, and remediation.
The first step is data collection.
The endpoint detection and response process begins
by performing data collection from all of the endpoints.
An endpoint can be any device
that is physically an endpoint on a network,
such as a desktop, laptop, and mobile devices.
The data collected includes system processes,
changes to the registry,
memory usage, patterns of network traffic,
and other system activities.
The second step is data consolidation.
Once the data's collected, it is then sent
to a centralized security solution or database for analysis.
This database could be located on premise
or in the cloud,
depending on your specific endpoint detection
and response solution being used by your organization.
The third step is threat detection.
Endpoint detection and response solution
will use various techniques to analyze the data
and detect threats from the data collected
and consolidated from various endpoints across your network.
These threat detection techniques
can include signature-based detection,
which looks for known patterns
of malicious activity and behavior-based detection,
which looks for abnormal behavior
that could indicate a threat.
The fourth step is alerts and threat response.
When a potential attack is detected, the endpoint detection
and response solution can take several actions,
such as creating an alert
or performing some kind of threat response action.
For example, the system could simply send an alert
to the security team that provides them
with detailed information about the identified threat,
or the system could again perform some type
of automated action to contain the threat,
such as isolating the affected endpoint from the network
to prevent the threat from spreading further
across the organization's network.
The fifth step is threat investigation.
Endpoint detection and response solutions
also provide your security teams with the tools required
to investigate threats.
These tools can include detailed timelines
of endpoint activity, forensic data,
and other information that can determine the nature
of the threat, its origin, and its impact on the system.
The sixth and final step is remediation.
After a threat can be properly investigated,
the endpoint detection and response solution can help
with remediating a given threat by removing malicious files,
reversing changes made by the threat
and restoring the effective systems
to their normal state using a secure baseline.
Next, let's take a look at file integrity monitoring.
File integrity monitoring, or FIM,
is used to validate the integrity of operating systems
and application software files using a verification method
between the current file state and a known good baseline.
This comparison can help identify changes to critical files,
including binary files, system application files,
as well as configuration and parameter files.
Usually, a file integrity monitor uses a small piece
of software known as an agent to continuously monitor
your critical system files for changes.
Each file is first hashed in their hashed digest
or stored in a database of known good file hashes.
Then if an unauthorized change is detected,
the file integrity monitor solution
can alert your security team
who can investigate whether the file change
is a true indication of security breach
have incurred or not.
Finally, we need to discuss the latest version
of endpoint detection
and response technology, also known
as extended detection and response.
Extended detection and response, or XDR,
is a security strategy
that integrates multiple protection technologies
into a single platform to improve detection accuracy,
and simplify the incident response process.
Extended detection and response technologies are used
to collect and automatically correlate data
across multiple security layers,
including your email, endpoint, server,
cloud workloads, and networks,
so that any threats can be detected faster,
and security analysts can minimize the time required
to respond to any issues.
By using an extended detection
and response solution, you no longer need
to have separate solutions for your network security,
email security, and endpoint security.
Instead, your organization
can consolidate these separate solutions
into a single consolidated platform.
This simplifies the security infrastructure
while improving your threat detection and response times
because the XDR solution can correlate data
across all your security layers at once.
So I know that sounds like a lot of endpoint detection
and responses, so you may be wondering,
what is the difference between endpoint detection
and response solution and extended detection
and response solution?
Well, endpoint detection and response
is really focused on your endpoints,
things like computers, laptops, and mobile devices.
Endpoint detection and response solutions can collect data
from these endpoints, analyze them for signs of threats,
and respond to those detected threats.
Extended detection and response, on the other hand,
is a more comprehensive solution
that extends well beyond just your endpoints.
Extended detection and response collects
and automatically correlates data
across multiple security layers,
including endpoints, network, cloud, and email to detect
and respond to any identified threats.
So remember, endpoint detection
and response is a security tool that monitors endpoint
and network events for signs of threats
that can either send an alert to the security team
or take predefined actions to mitigate the given threat.
Extended detection and response,
on the other hand, is a security strategy
that integrates multiple protection technologies
into a single platform.
File integrity monitoring is often included as part
of the EDR or XDR solution
because file integrity monitoring is used
to validate the integrity of operating system
and application software files.
By understanding and implementing these tools,
organizations can significantly enhance
their security posture and resilience
against various cyber threats and attacks.