Endpoint Security

Behavioural Anti-Malware

Anti-malware is software that is designed to detect and remove malware, such as viruses, worms, and Trojans, from a computer or network to protect against cyber threats. However, there are several key components to anti-malware which can differ. Traditional Anti-Malware relies on signatures and heuristics that are updated daily based on known malware variants. Modern anti-malware uses these along with behavioural techniques to spot malicious actions. It may also include other functions such as Exploit Prevention (IPS), device control and web control. Centrally managed AV is important to increase the mean-time-to-respond. We also recommend that business invest in EDR (below) capable solutions for any business environment.

EDR / XDR

Endpoint Detection and Response (EDR) is a next-level endpoint solution that continuously monitors end user devices to detect and respond to cyber threats. It provides visibility to uncover incidents that would otherwise remain invisible.

An effective EDR solution goes way beyond standard endpoint security and provides detection, investigation, threat hunting and response capabilities – all in real time.

Extended Detection and Response (XDR) builds on-top of this foundation by adding events and intelligence from additional data sources such as network, identity and cloud sensors and correlates the information alongside the endpoint events to show potential attack vectors and to stop the spread to additional systems. Most XDR solutions will track against the MITRE ATT&CK framework – allowing analysts to quickly focus response tactics to the relevant areas.

Device Control

Data is the most important organisational asset and, where possible organisations should invest in suitable Data Loss Prevention technologies. However, one of the simplest controls is that around peripheral devices and removable media such as CD/DVD USB Drives and Smartphones. These provide users an easy way to move data from one system to another, but in the process taking data out of the organisations control.

Endpoint Firewall

Windows, Mac and Linux all come with built in endpoint firewalls, but these can be cumbersome to manage. Using an endpoint solution with firewall controls can bring central management and can simplify policies. Firewall configuration is a key security hardening technique and is required by almost all security frameworks.

Full Disk Encryption

Deployment, management & key storage of native full disk encryption can be harder to manage directly within an operating system. Endpoint solutions are able to manage these native encryption tools, as well as reporting on compliance and hardware compatibility, from a single console. Some vendors also provide their own software or OPAL compatible hardware encryption management tools.

MDM and Mobile Threat Defence

As we consume more and more business data on mobile devices, we need to be able to maintain controls across these platforms. Whether they are corporate devices or Bring-Your-Own-Device (BYOD), MDM enables the management by applying policy installing business apps and allowing the remote locking or wiping of the device. Mobile threat defence looks at the risk level of a mobile device without the requirement for controls. They extend anti-malware, and network IPS as well as monitoring device security settings and updates.

Software & Configuration Management

Being able to remotely update systems, install and manage applications, and manage system configuration is a key requirement – especially with the growth of remote working. Depending on the requirement, we can provide specific solutions for managing these assets, or look at a Remote Monitoring and Management (RMM) solution – these provide the above controls as well as remote access for IT teams.