1
00:00:00,000 --> 00:00:00,833
In this lesson,

2
00:00:00,833 --> 00:00:03,360
we will cover endpoint detection and response.

3
00:00:03,360 --> 00:00:06,000
Endpoint detection and response, or EDR,

4
00:00:06,000 --> 00:00:08,310
is a cybersecurity technology that addresses the need

5
00:00:08,310 --> 00:00:11,730
for continuous monitoring and response to advanced threats.

6
00:00:11,730 --> 00:00:14,760
EDR is a critical component of security operations

7
00:00:14,760 --> 00:00:16,770
for many companies and organizations.

8
00:00:16,770 --> 00:00:19,320
Endpoint detection and response was the original version

9
00:00:19,320 --> 00:00:21,600
of the technology, and it heavily relies

10
00:00:21,600 --> 00:00:23,370
on file integrity monitoring

11
00:00:23,370 --> 00:00:25,140
and has been updated in recent years

12
00:00:25,140 --> 00:00:27,600
to include extended detection and response.

13
00:00:27,600 --> 00:00:30,240
So in this lesson, we will discuss all three

14
00:00:30,240 --> 00:00:32,729
of these technologies, including endpoint detection

15
00:00:32,729 --> 00:00:35,310
and response, file integrity monitoring,

16
00:00:35,310 --> 00:00:37,920
and extended detection and response.

17
00:00:37,920 --> 00:00:41,460
First, let's take a look at endpoint detection and response.

18
00:00:41,460 --> 00:00:42,960
Endpoint detection and response,

19
00:00:42,960 --> 00:00:45,420
also known by its acronym EDR,

20
00:00:45,420 --> 00:00:48,390
is a category of security tools that monitor endpoint

21
00:00:48,390 --> 00:00:50,850
and network events and record the information

22
00:00:50,850 --> 00:00:54,360
in a centralized database where further analysis, detection,

23
00:00:54,360 --> 00:00:58,241
and investigation, reporting and alerting takes place.

24
00:00:58,241 --> 00:00:59,970
The primary purpose of an endpoint detection

25
00:00:59,970 --> 00:01:02,850
and response solution is to provide incident data

26
00:01:02,850 --> 00:01:04,230
to our cybersecurity analysts

27
00:01:04,230 --> 00:01:07,680
to help enhance the security monitoring incident response

28
00:01:07,680 --> 00:01:09,510
and forensic investigations

29
00:01:09,510 --> 00:01:12,450
that they conduct on your enterprise network.

30
00:01:12,450 --> 00:01:14,310
For example, an endpoint detection

31
00:01:14,310 --> 00:01:17,250
and response solution might monitor a network for signs

32
00:01:17,250 --> 00:01:19,410
of malware or other cyber threats.

33
00:01:19,410 --> 00:01:21,540
If a threat is detected, the endpoint detection

34
00:01:21,540 --> 00:01:24,810
and response solution can either alert the security team

35
00:01:24,810 --> 00:01:28,890
or take predefined actions from a playback using automation

36
00:01:28,890 --> 00:01:31,830
and orchestration to mitigate the identified threat.

37
00:01:31,830 --> 00:01:34,440
So how does endpoint detection and response work?

38
00:01:34,440 --> 00:01:37,320
Well, EDR works by continuously monitoring

39
00:01:37,320 --> 00:01:39,210
and gathering data from endpoints

40
00:01:39,210 --> 00:01:42,540
that could indicate a threat by following a six-step process

41
00:01:42,540 --> 00:01:45,210
of data collection, data consolidation,

42
00:01:45,210 --> 00:01:46,800
threat detection, alerts,

43
00:01:46,800 --> 00:01:51,390
and threat response, threat investigation, and remediation.

44
00:01:51,390 --> 00:01:53,640
The first step is data collection.

45
00:01:53,640 --> 00:01:56,370
The endpoint detection and response process begins

46
00:01:56,370 --> 00:01:59,490
by performing data collection from all of the endpoints.

47
00:01:59,490 --> 00:02:01,080
An endpoint can be any device

48
00:02:01,080 --> 00:02:03,240
that is physically an endpoint on a network,

49
00:02:03,240 --> 00:02:06,570
such as a desktop, laptop, and mobile devices.

50
00:02:06,570 --> 00:02:09,060
The data collected includes system processes,

51
00:02:09,060 --> 00:02:10,380
changes to the registry,

52
00:02:10,380 --> 00:02:12,840
memory usage, patterns of network traffic,

53
00:02:12,840 --> 00:02:14,970
and other system activities.

54
00:02:14,970 --> 00:02:17,820
The second step is data consolidation.

55
00:02:17,820 --> 00:02:20,190
Once the data's collected, it is then sent

56
00:02:20,190 --> 00:02:23,970
to a centralized security solution or database for analysis.

57
00:02:23,970 --> 00:02:25,950
This database could be located on premise

58
00:02:25,950 --> 00:02:27,000
or in the cloud,

59
00:02:27,000 --> 00:02:28,980
depending on your specific endpoint detection

60
00:02:28,980 --> 00:02:31,920
and response solution being used by your organization.

61
00:02:31,920 --> 00:02:34,350
The third step is threat detection.

62
00:02:34,350 --> 00:02:36,240
Endpoint detection and response solution

63
00:02:36,240 --> 00:02:38,880
will use various techniques to analyze the data

64
00:02:38,880 --> 00:02:40,830
and detect threats from the data collected

65
00:02:40,830 --> 00:02:44,310
and consolidated from various endpoints across your network.

66
00:02:44,310 --> 00:02:45,840
These threat detection techniques

67
00:02:45,840 --> 00:02:47,910
can include signature-based detection,

68
00:02:47,910 --> 00:02:49,620
which looks for known patterns

69
00:02:49,620 --> 00:02:52,620
of malicious activity and behavior-based detection,

70
00:02:52,620 --> 00:02:54,570
which looks for abnormal behavior

71
00:02:54,570 --> 00:02:56,280
that could indicate a threat.

72
00:02:56,280 --> 00:02:59,100
The fourth step is alerts and threat response.

73
00:02:59,100 --> 00:03:01,860
When a potential attack is detected, the endpoint detection

74
00:03:01,860 --> 00:03:04,200
and response solution can take several actions,

75
00:03:04,200 --> 00:03:05,580
such as creating an alert

76
00:03:05,580 --> 00:03:08,220
or performing some kind of threat response action.

77
00:03:08,220 --> 00:03:10,830
For example, the system could simply send an alert

78
00:03:10,830 --> 00:03:12,660
to the security team that provides them

79
00:03:12,660 --> 00:03:15,210
with detailed information about the identified threat,

80
00:03:15,210 --> 00:03:17,430
or the system could again perform some type

81
00:03:17,430 --> 00:03:20,010
of automated action to contain the threat,

82
00:03:20,010 --> 00:03:22,650
such as isolating the affected endpoint from the network

83
00:03:22,650 --> 00:03:24,750
to prevent the threat from spreading further

84
00:03:24,750 --> 00:03:26,670
across the organization's network.

85
00:03:26,670 --> 00:03:29,070
The fifth step is threat investigation.

86
00:03:29,070 --> 00:03:31,050
Endpoint detection and response solutions

87
00:03:31,050 --> 00:03:33,810
also provide your security teams with the tools required

88
00:03:33,810 --> 00:03:35,550
to investigate threats.

89
00:03:35,550 --> 00:03:37,800
These tools can include detailed timelines

90
00:03:37,800 --> 00:03:39,960
of endpoint activity, forensic data,

91
00:03:39,960 --> 00:03:42,270
and other information that can determine the nature

92
00:03:42,270 --> 00:03:45,630
of the threat, its origin, and its impact on the system.

93
00:03:45,630 --> 00:03:47,730
The sixth and final step is remediation.

94
00:03:47,730 --> 00:03:49,590
After a threat can be properly investigated,

95
00:03:49,590 --> 00:03:52,200
the endpoint detection and response solution can help

96
00:03:52,200 --> 00:03:55,140
with remediating a given threat by removing malicious files,

97
00:03:55,140 --> 00:03:57,060
reversing changes made by the threat

98
00:03:57,060 --> 00:03:58,770
and restoring the effective systems

99
00:03:58,770 --> 00:04:01,530
to their normal state using a secure baseline.

100
00:04:01,530 --> 00:04:05,310
Next, let's take a look at file integrity monitoring.

101
00:04:05,310 --> 00:04:07,590
File integrity monitoring, or FIM,

102
00:04:07,590 --> 00:04:10,710
is used to validate the integrity of operating systems

103
00:04:10,710 --> 00:04:14,250
and application software files using a verification method

104
00:04:14,250 --> 00:04:18,149
between the current file state and a known good baseline.

105
00:04:18,149 --> 00:04:21,149
This comparison can help identify changes to critical files,

106
00:04:21,149 --> 00:04:24,180
including binary files, system application files,

107
00:04:24,180 --> 00:04:26,640
as well as configuration and parameter files.

108
00:04:26,640 --> 00:04:29,520
Usually, a file integrity monitor uses a small piece

109
00:04:29,520 --> 00:04:32,220
of software known as an agent to continuously monitor

110
00:04:32,220 --> 00:04:34,530
your critical system files for changes.

111
00:04:34,530 --> 00:04:37,710
Each file is first hashed in their hashed digest

112
00:04:37,710 --> 00:04:40,980
or stored in a database of known good file hashes.

113
00:04:40,980 --> 00:04:43,320
Then if an unauthorized change is detected,

114
00:04:43,320 --> 00:04:45,270
the file integrity monitor solution

115
00:04:45,270 --> 00:04:46,650
can alert your security team

116
00:04:46,650 --> 00:04:48,720
who can investigate whether the file change

117
00:04:48,720 --> 00:04:50,700
is a true indication of security breach

118
00:04:50,700 --> 00:04:52,260
have incurred or not.

119
00:04:52,260 --> 00:04:54,480
Finally, we need to discuss the latest version

120
00:04:54,480 --> 00:04:55,530
of endpoint detection

121
00:04:55,530 --> 00:04:57,330
and response technology, also known

122
00:04:57,330 --> 00:04:59,790
as extended detection and response.

123
00:04:59,790 --> 00:05:02,880
Extended detection and response, or XDR,

124
00:05:02,880 --> 00:05:04,290
is a security strategy

125
00:05:04,290 --> 00:05:06,480
that integrates multiple protection technologies

126
00:05:06,480 --> 00:05:09,510
into a single platform to improve detection accuracy,

127
00:05:09,510 --> 00:05:12,480
and simplify the incident response process.

128
00:05:12,480 --> 00:05:15,060
Extended detection and response technologies are used

129
00:05:15,060 --> 00:05:17,550
to collect and automatically correlate data

130
00:05:17,550 --> 00:05:19,170
across multiple security layers,

131
00:05:19,170 --> 00:05:21,900
including your email, endpoint, server,

132
00:05:21,900 --> 00:05:23,820
cloud workloads, and networks,

133
00:05:23,820 --> 00:05:26,100
so that any threats can be detected faster,

134
00:05:26,100 --> 00:05:28,590
and security analysts can minimize the time required

135
00:05:28,590 --> 00:05:30,180
to respond to any issues.

136
00:05:30,180 --> 00:05:31,770
By using an extended detection

137
00:05:31,770 --> 00:05:33,930
and response solution, you no longer need

138
00:05:33,930 --> 00:05:36,420
to have separate solutions for your network security,

139
00:05:36,420 --> 00:05:38,760
email security, and endpoint security.

140
00:05:38,760 --> 00:05:40,230
Instead, your organization

141
00:05:40,230 --> 00:05:42,090
can consolidate these separate solutions

142
00:05:42,090 --> 00:05:44,550
into a single consolidated platform.

143
00:05:44,550 --> 00:05:46,710
This simplifies the security infrastructure

144
00:05:46,710 --> 00:05:49,200
while improving your threat detection and response times

145
00:05:49,200 --> 00:05:51,990
because the XDR solution can correlate data

146
00:05:51,990 --> 00:05:54,360
across all your security layers at once.

147
00:05:54,360 --> 00:05:57,660
So I know that sounds like a lot of endpoint detection

148
00:05:57,660 --> 00:05:59,940
and responses, so you may be wondering,

149
00:05:59,940 --> 00:06:01,830
what is the difference between endpoint detection

150
00:06:01,830 --> 00:06:03,870
and response solution and extended detection

151
00:06:03,870 --> 00:06:05,100
and response solution?

152
00:06:05,100 --> 00:06:07,530
Well, endpoint detection and response

153
00:06:07,530 --> 00:06:09,570
is really focused on your endpoints,

154
00:06:09,570 --> 00:06:13,500
things like computers, laptops, and mobile devices.

155
00:06:13,500 --> 00:06:15,990
Endpoint detection and response solutions can collect data

156
00:06:15,990 --> 00:06:18,750
from these endpoints, analyze them for signs of threats,

157
00:06:18,750 --> 00:06:21,060
and respond to those detected threats.

158
00:06:21,060 --> 00:06:23,790
Extended detection and response, on the other hand,

159
00:06:23,790 --> 00:06:25,620
is a more comprehensive solution

160
00:06:25,620 --> 00:06:28,410
that extends well beyond just your endpoints.

161
00:06:28,410 --> 00:06:30,660
Extended detection and response collects

162
00:06:30,660 --> 00:06:32,220
and automatically correlates data

163
00:06:32,220 --> 00:06:34,200
across multiple security layers,

164
00:06:34,200 --> 00:06:38,580
including endpoints, network, cloud, and email to detect

165
00:06:38,580 --> 00:06:41,340
and respond to any identified threats.

166
00:06:41,340 --> 00:06:43,800
So remember, endpoint detection

167
00:06:43,800 --> 00:06:47,280
and response is a security tool that monitors endpoint

168
00:06:47,280 --> 00:06:49,500
and network events for signs of threats

169
00:06:49,500 --> 00:06:51,660
that can either send an alert to the security team

170
00:06:51,660 --> 00:06:55,320
or take predefined actions to mitigate the given threat.

171
00:06:55,320 --> 00:06:56,447
Extended detection and response,

172
00:06:56,447 --> 00:06:58,860
on the other hand, is a security strategy

173
00:06:58,860 --> 00:07:01,260
that integrates multiple protection technologies

174
00:07:01,260 --> 00:07:03,090
into a single platform.

175
00:07:03,090 --> 00:07:05,580
File integrity monitoring is often included as part

176
00:07:05,580 --> 00:07:07,860
of the EDR or XDR solution

177
00:07:07,860 --> 00:07:09,990
because file integrity monitoring is used

178
00:07:09,990 --> 00:07:12,327
to validate the integrity of operating system

179
00:07:12,327 --> 00:07:14,670
and application software files.

180
00:07:14,670 --> 00:07:17,280
By understanding and implementing these tools,

181
00:07:17,280 --> 00:07:19,500
organizations can significantly enhance

182
00:07:19,500 --> 00:07:21,390
their security posture and resilience

183
00:07:21,390 --> 00:07:24,243
against various cyber threats and attacks.