Endpoint security in 2024 has advanced significantly from its “antivirus” days, when a tool had a signature of known malicious code and sounded the alarm upon detecting it.
Like stand-up comedians and retired athletes, today’s endpoint-security platforms are looking to do more acting.
Added endpoint security features like “detection and response” watch for suspicious behaviors (why is that Word doc running a script?) and initiate remediation (stop that script!).
As Chris Silva, VP and analyst at market intelligence firm Gartner, puts it: We’ve moved from passive tools to active passive tools.
“Tools that are going to look for behaviors and patterns, and as soon as something looks like it is moving in a direction that doesn’t make sense, some action can be taken,” Silva told IT Brew.
What’s EPP, doc? The National Institute of Technologies and Standards defines an “endpoint protection platform” (EPP) as “safeguards implemented through software to protect end-user machines such as workstations and laptops against attack.” NIST’s examples:
- Anti-malware: Software that scans for known signatures of malicious code.
- Personal firewalls: Tools restricting ports and services on a device.
- Host-based intrusion detection and prevention systems: An “application that monitors the characteristics of a single host,” detecting and stopping suspicious actions.
“What has changed has been the fact that we no longer see some of the biggest threats, things like ransomware, tying back to just a bad application,” Silva said. (IBM’s 2024 report, for example, found that stolen credentials led to 16% of its studied breaches.)
Read more here.—BH
|