What is EDR?

Every endpoint is a potential gateway to an organization’s network. While traditional antivirus solutions are effective tools for blocking threats on singular or small groups of devices, they often don’t provide the visibility needed to see and act on indicators of compromise at the earliest stage possible.

That’s where endpoint detection and response (EDR) comes. EDR tools enable organizations to continuously monitor the target environment and collect valuable telemetry that can be used to triage and investigate incidents, regardless of the number of endpoints in the environment.

In this blog post, we’ll show exactly what EDR is and how it fits into an organization’s broader cybersecurity strategy.

What is EDR?

EDR is a relatively new category of cybersecurity tools designed to give organizations better visibility of their endpoints, automatically detect potential security threats and reduce incident response times.

Whereas many other cybersecurity concepts focus purely on blocking threats, EDR takes a more holistic approach to cybersecurity by capturing large amounts of data and contextual information from each endpoint to detect potential threats that may have never been seen before in the wild.

While enhanced visibility is the primary benefit of EDR, all EDR solutions also include response capabilities to respond to events in real-time. Many EDR tools, including Emsisoft EDR, use behavioral analysis and machine learning to identify suspicious patterns of behavior and contain or eliminate threats before significant damage can take place.

Despite these automated functions, manual, human talent is still required to analyze the alerts and extrapolate meaning from the computer-generated data. Smaller businesses, which may not have the resources to maintain an in-house security analyst, may wish to consider the services of a managed security service provider.

How does EDR work?

The specific capabilities of EDR can vary significantly depending on the vendor and how the system has been implemented. At a high level, however, most EDR tools provide the same core functions:

• Endpoint data collection: Telemetry data (e.g. process activities, file changes, registry activity, network activity, etc.) is gathered from the endpoints in the environment, typically via a software agent deployed on each endpoint. This data is then sent to a centralized platform where it can be organized and analyzed. The centralized platform is usually cloud-based, although compliance requirements may necessitate the use of on-premises implementations in certain industries.
• Data analysis: Machine learning technology helps analyze and interpret the raw data gathered from the endpoints. Many EDR solutions are capable of using this data to “learn” what normal user behavior looks like, which can then be used to highlight endpoint irregularities. Security personnel can also utilize EDR tools to find the root cause of an incident by drilling down into the data to identify the ‘when,’ ‘where,’ ‘how’ and ‘who’ of a threat.
• MITRE ATT&CK: Many EDR tools use the MITRE ATT&CK framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations, to categorize potentially harmful events. This information provides security analysts with valuable insight into the how and why of real-world attacks, which can then be used to identify and bolster gaps in the organization’s security posture.
• Automatic response: Any events or activities that the EDR tool deems to be suspicious automatically generate an alert for security personnel to investigate. In addition to raising an alert, some EDR tools can take action directly based on the determined severity, using automated rule-based response capabilities to automatically remove or contain basic threats. While human intervention is often still required for resolving more sophisticated attacks, automatic responses are crucial for helping organizations minimize incident response times.
• Data retention: Security personnel can look back at historical data during incident response processes to determine how an attack occurred. The insights gained from EDR tools can be extremely valuable in helping an organization harden security against future attacks. Cloud-based EDR tools offer additional peace of mind: even in a worst-case scenario that involves the complete destruction of devices, administrators can still use the event history stored in the cloud to analyze the sequence of events leading right the way up until the final moment before the attacker was able to disable the security system. Cloud-based EDR data cannot be accessed by an attacker as it is secured with two-factor authentication, which requires input from a separate device.

Why is EDR important?

EDR has come to be seen as an integral part of an organization’s wider security posture as cyberthreats evolve and become increasingly sophisticated.

Prevention alone doesn’t guarantee protection. While perimeter-based defenses are effective at blocking the vast majority of cyberattacks, there’s always a chance – no matter how slim – that something slips through the gaps and compromises an endpoint. And the threats that do slip through are often the most destructive.

We’ve seen this time and time again in recent years, with well-resourced ransomware groups investing significant time and resources into human-operated attacks that are carefully designed to circumvent traditional cybersecurity solutions. After compromising an organization, ransomware operators may spend days or even weeks in the target network preparing the environment to maximize the impact of an attack. These targeted, carefully planned out attacks are often specifically designed to fly under the radar of security solutions and security teams if an organization does not have good visibility across its endpoints.

Organizations should operate on the belief that an attacker will, at some point, bypass their outer walls. When that day comes, EDR is crucial for seeing what happened, how it happened and, most importantly, how to fix it.

Emsisoft EDR tools

Emsisoft is currently developing a robust set of EDR tools to help users gain better visibility of their Emsisoft-protected devices. Emsisoft EDR features a number of protection layers that work together to identify suspicious behavior, automatically block attacks and provide security teams with detailed insight into potential threats.

Emsisoft EDR protection layers include:

• On-demand scanner.
• File Guard.
• Web Protection.
• Browser Security.
• Behavior Blocker.
• MITRE ATTs.
• Threat hunting, OSquery.

Best of all, Emsisoft EDR will be available for free to our business and enterprise customers, which will give smaller businesses and MSPs that serve smaller businesses access to the benefits of EDR without breaking the budget.

Emsisoft Business Security customers will receive a light version of Emsisoft EDR as a no-cost add-on to their regular subscriptions.

Emsisoft Enterprise Security customers will receive Emsisoft EDR with data retention as a no-cost add-on to their regular subscription.

Stay tuned over the coming weeks as we release more information about Emsisoft EDR.