Thread by @password_ng

Endpoint Detection & Response (EDR): The New Way To Go

Antivirus was once the main way to protect endpoints (laptops, servers, workstations). They are designed to detect malicious programs, block them and offer an easy way of removing them.

But the threat landscape today have grown more advanced and malware are no longer the only threat vector the attackers can use. This drastically change the effectiveness of Antivirus to protect businesses and organizations data.

Today, fileless malware, zero day exploits and APT are leading in the attack campaign been launched at organization. These set of new threat don't use signatures which is the bases on which your Antivirus can work to protect you.

At this point the world need a solution that can protect them, and researchers started working out a new strategy to replace Antivirus, which gave birth to the Next Generation Antivirus (NGAV).

NGAV is the term coined to replace the new way Antivirus is working, handling detection by looking for a specific characteristics and don't account for human ingenuity or attacker behavior. How can we move beyond this point. Researchers keep on working.

Where we are today is the EDR, which combines elements of both endpoint antivirus and endpoint management solutions to detect, investigate, and mitigate any suspicious activities and issues on hosts and endpoints.

One of the beauty of the EDR is that they can be used as a complement to a larger security systems such as Security Information and Event Management (SIEM) , Vulnerability management and IR tools.

Essential elements of every EDR solution range from detection, effective cleanup and remediation, observing endpoint activity without interference, cross-correlation of data across the whole environment (using feeds and IOCs), to empowering IR and forensics investigation.

So most of what your Antivirus and NGAV will missed will be detected by the EDR platform.

There are many companies that offer EDR tools and we are going to list them out in this thread.

#1. @symantec Endpoint Protection
visit to read more on this vendor
symantec.com/products/endpo…

#2 @Webroot Endpoint Protection.

Visit to read more about this vendor
webroot.com/us/en/business…

#3 @Fortinet
visit to read more about this vendor

fortinet.com/products/endpo…

#4 @Sophos Intercept X: Next Gen Endpoint.

Visit to read more about this vendor

sophos.com/en-us/products…

#5 @CarbonBlack_Inc Response and Defense Product.

Visit to read more about this vendor

carbonblack.com

#6 @kaspersky Endpoint Security.

visit to read more about this vendor

kaspersky.co.za/small-to-mediu…

#7 @cybereason EDR.

Visit to read more about this vendor

cybereason.com

#8 @PaloAltoNtwksUK Networks Traps

Visit to read more about this vendor

paloaltonetworks.com/products/secur…

#9 @FireEye Endpoint Security

Visit to read more about this vendor.

fireeye.com/solutions/hx-e…

#10. @cylanceinc Endpoint Security
Visit to read more about vendor.

cylance.com/en-us/platform…

If you're reading this thread and you have work with product from any of these vendors, please leave comment to help guides those planning to invest in EDR.

Thank you.

@threadreaderapp unroll