Endpoint Protection

From Embedded Lab Vienna for IoT & Security
Revision as of 20:02, 21 December 2020 by MToth (talk | contribs)
Jump to navigation Jump to search

Summary

This article describes the importance of endpoint protection and the types of threats an endpoint can be a victim to. It also gives insights on data leakage and offers possible solutions for protecting an endpoint.

Data Leakage

Trusting third party companies (agents) with handling confidential data has several advantages: partner companies may gain access to customer data, that can be done by using the same service as the distributor (data owner). This way not only reading, but also updating and altering data in any way can be more efficient, but can also lead to worse data quality, due to perturbation. One of the main goals of the agents is to keep the data quality as high as possible while also preventing data leakage via endpoints. This means the protection of computer networks, that are remotely bridged to client devices, such as mobile phones, laptops or tablets. Many companies are trying to ensure endpoint security by using a single, multi-purpose software solution, that enables administrators to setup a centrally managed security system, but there are also several specialized products on the market. 53% of the companies, that took part in the 2018 Insider Threat report have been victims of insider attacks more than once a year, which highly emphasises the importance of the usage of proper cyber security systems.

Types of Threats

The CNNIC “Statistical Report on Internet Development in China” defined 20 types of internet usages, then classified internet users into 7 groups based on their habits, time and activities done while surfing on the web or using some applications connected to the internet. Some of these categories are Gamer, Network Businessman or Socializer. People in all of these groups may encounter various threats attempting to harm their systems or steal valuable information from them. Such threats can be fraud, attacks by virus, system overhead, false positive or prevalent malware.

Malware

Malware (malicious software) is by far the most dangerous type of threat and even though EPPs using the most updated signature databases used to detect such programs, they have widely spread across systems in the globe. The best way to eliminate malware in time is to use behavior-based detection, which is why EDR systems are most suited for this task.

Virus

A virus has the capability to spread from host to host and is designed to replicate itself. It is a type of malicious code or program written to alter the way a computer operates. A virus attaches itself to a legitimate program in order to execute its code and in the process, it has the potential to cause unexpected or damaging effects. This can be anything from harming the system software by corrupting data to fully destroying it.

False Positive

This happens, when an antivirus program or any other security system identifies a legitimate code as illegitimate by mistake.

Endpoint Security Software

Endpoint Protection Systems

Endpoint Protection Platform

One of the best solutions to achieve endpoint protection is to use an Endpoint Protection Platform (EPP), which consists of several tools, that can protect our systems from unwanted intrusion, such as firewalls, antivirus systems and data encryption.

Endpoint protection platforms are software using signatures to ensure negative endpoint protection. They also have access to an own database, which stores signatures of collected threats and use it to match them with other signatures, which helps them detecting possible threats. An EPP also uses different services to monitor processes running in networks for the sake of malfunction, virus detection. Even though most attacks can be stopped by monitoring and signature matching, some viruses are still able to get in the system and that’s where the so-called Host-based Intrusion Prevention System (HIPS) takes action. It does not only wipe out malicious activities, but is also capable of deep behavioral inspection. The annihilation of threats, that already got into the system needs to be done as fast as possible, since the virus can spread really fast and take over the whole system.

Endpoint Detection and Response

This is one of the newest cybersecurity technology, which combines endpoint management solutions and endpoint antivirus systems to wipe out malicious activities. EDR are complex systems also designed to monitor the state of multiple devices at the same time in bigger security infrastructures. Since this technology uses a moderner approach to endpoint detection, machine learning also plays a huge part in the functionality of EDR systems using calculations and well-tested algorithms to catch several kinds of suspicious activities from ruining the infrastructure without the need for manually created signatures. When relying on this method, attacks can be detected not by analyzing the file system, but by interpreting and monitoring the system, focusing on its malicious activities providing stable, real-time capture and alerting solutions. Some examples of EDR technology are FireEye Endpoint Security and Symantec Endpoint Protection.

References