What Is Endpoint Detection and Response (EDR)?

Threat detection is a foundational capability of an EDR solution. It is not a matter of if an advanced threat will strike, it is a matter of when. Upon entering your environment, you must be able to accurately detect the threat so you can contain, evaluate, and neutralize it. This is not an easy task when you're dealing with sophisticated malware that can be extremely stealthy and capable of morphing from a benign to a malicious state after crossing the point of entry.

With continuous file analysis, EDR will be able to flag offending files at the first sign of malicious behavior. If a file is initially deemed safe, but after a few weeks begins to exhibit ransomware activity, EDR will detect the file and start the process of evaluation and analysis, while alerting your organization to act.

In addition to continuous file analysis, it is important to note that EDR is only as good at detecting files as the threat intelligence that powers it. This intelligence leverages large-scale data, machine learning capabilities, and advanced file analysis to help detect threats. The more powerful your intelligence is, the more likely it is your EDR solution will identify the threat. Simply put, an EDR solution without threat intelligence would not provide adequate protection.

After detecting a malicious file, EDR must be able to contain the threat. Malicious files aim to infect as many processes, applications, and users as possible. Segmentation can be a great defense within your data center to avoid lateral movement of advanced threats. While segmentation is helpful, a robust EDR solution can help contain a malicious file before testing the edges of segmented areas of the network. Ransomware is a tremendous example of why you need to contain threats. Ransomware can be tricky to remove and once it has encrypted information, your EDR tool needs to be able to fully contain ransomware to mitigate the damages. As an additional control, EDR security provides the capability to isolate compromised endpoints, preventing further encryption over the network.

Once the malicious file has been detected and contained, EDR should investigate the incident. If the file snuck through the perimeter on the first try, there is a vulnerability. It's possible the threat intelligence team has never seen this kind of advanced threat before. Maybe a device or application is outdated and needs to be updated. Without proper investigative capabilities, your network will not gain insight into how a threat got through. As a result, your network is likely to experience these same threats and issues again. EDR security provides the type of per-incident review required to reveal these issues and prevent future exploitation via the same threat vector.

In the investigative process, sandboxing is another critical capability. Sandboxing can be used at the perimeter, to help grant or deny access, but it can also be used effectively after the point of entry. Sandboxing is when the file is isolated into a simulated environment and tested and monitored. EDR can provide sandboxing through integrated Cisco Secure Malware Analytics.

Within this simulated, isolated environment, EDR will try to determine the nature of the file without potentially risking the safety of the larger environment. In this process, EDR can understand the attributes and nature of this malicious file, then learn from it and adapt to better defend against future threats.

The most obvious component of an EDR needs to be its ability to eliminate the threat. Detecting, containing, and investigating a threat is a good start, but if you cannot eliminate it, then you just continue knowing your system is compromised. To properly eliminate threats, EDR needs exceptional visibility to answer such questions as:

• Where did the file originate?
• What different data and applications did this file interact with?
• Has the file replicated?

Visibility is crucial for elimination. Being able to see the entire timeline of a file is key. It is not as easy as simply removing the file you have observed. When you eliminate the file, you likely may need to automatically remediate multiple parts of the network. For this reason, an EDR solution should provide actionable data on the lifespan of the file. If an EDR tool has retrospective capabilities, this actionable data should be used to automatically remediate systems to their state prior to infection.

Lastly, it is very important to understand that the best EDR solution combines both EPP and EDR capabilities. A true next-generation endpoint security solution protects at the perimeter (EPP) and continuously monitors within the environment (EDR) to provide and manage security throughout the entire lifespan of files.