What is EDR (Endpoint Detection and Response)?

Ransomware, malware, phishing, and spear phishing—all clear and present dangers to your customers’ networks, businesses, and personally identifiable information (PII). And now, these attacks are preying on people’s fear, uncertainty, and doubt surrounding the rise of COVID-19.

How do you secure those networks in the face of an ever-changing environment? Perhaps your best defense is one you may not be overly familiar with: Endpoint Detection and Response (EDR). Anton Chauvin of Gartner originated the term, using it to describe “this family of new tools focused on visibility, and from prevention to detection for the endpoint.”

So, what is EDR? It’s a multifaceted solution that does everything modern managed antivirus (AV) can do, but takes things a step further—providing greater security and (most importantly) peace of mind. These include, but are not limited to:

• Monitoring
• Threat detection
• Whitelisting/blacklisting
• Threat response
• Integration with other cybersecurity solutions

Let’s take a closer look at this new weapon made for your cybersecurity arsenal.

EDR’s place in the cybersecurity universe

EDR centers on protecting endpoints. Given the number of threats that spawn daily, antivirus and other point solutions can make managing large numbers of endpoints difficult. When we talk about traditional managed antivirus (MAV), it's typically from a passive standpoint. MAV can only detect and quarantine known threats—those that have been previously identified. Therein lies the rub—MAV requires regular signature updates. This means there is often a gap in coverage between when a virus is discovered and when your customers become protected. Plus, threats that haven’t yet been discovered can operate in the wild before you can even get an update. It’s a reactive approach with proactive intent. 

In contrast, EDR is proactive. Comprised of monitoring software and endpoint agents, EDR solutions use integrated machine learning and advanced artificial intelligence (AI) to identify suspicious behaviors and address them regardless of whether or not there’s a signature. For example, if several files change at the same time, chances are it’s more likely a result of an endpoint assault rather than user error. 

The only constant is change

Think about it—the world is in a constant state of flux, and technology is no different. The cloud has changed everything, from the rise of ecommerce to enterprise-based solutions that billions of individuals rely on daily. But with progress comes inevitable roadblocks, and for the cloud, we must focus on intent—specifically those who look to profit from it in harmful ways. Data is arguably your customers’ greatest asset—so how do you help safeguard that asset?

AI to the rescue

For the moment, let’s focus on the positives that have come about with the rise of machine learning. If we look at the benefits of AI for EDR, the core benefit is advanced technology, which allows it to recognize and deal with advanced threats. This is where EDR excels—asking questions like:

• Has this endpoint performed this activity before?
• Does this file or behavior exhibit unusual patterns?
• Why are secured files being looked at or hit?

Advanced polymorphic viruses (those that can generate modified versions of themselves to counter detection) and zero-day threats (which target and exploit a previously unknown vulnerability) fall into the above line of questioning. EDR not only asks these questions, it also provides the answers we need to address the threats—with options to kill, quarantine, remediate, and rollback.

Ransomware realities