Endpoint detection and response (EDR) is much more than a next-generation endpoint capability, it is a driving force of evolutionary change within security operations centers (SOC) today. EDR provides visibility where most organizations are blind. In our network-centric world, EDR provides a fast path to endpoint context, enabling rapid identification of false positives or the origin of attacks.
To illustrate this point, I created a litmus test to review common limitations in security information and event management (SIEM) and threat monitoring today. Because most SIEM have insufficient endpoint data, threat analysts struggle to answer even the most fundamental questions, such as:
- Is the attack targeting a critical, sensitive, or regulated asset?
- Does the identified exploit target the right operating system or application?
Nor the more complex questions such as:
- What process executed a connection to the known malicious IP or URL?
- What occurred following the successful inbound attack?
Life without EDR
For organizations without EDR, researching and responding to threats is a maddening exercise. With limited access to endpoints or endpoint context, threat analysts -- particularly in large enterprise or managed security service provider (MSSP) -- have few choices other than to open a ticket and delegate the research to others with access to the targeted machine.
The stakeholder could be in another department or region. For MSSPs, this is the heartbeat of communication between the SOC and customers under attack. Tickets may be answered quickly but a large majority take days and weeks. Some aren’t answered at all. In fact, due to the substantial delays incurred, special tools have been created to address the hold up.
- One such tool is called alert suppression. Using alert suppression, mature SOCs can hide repetitive alerts waiting for information requested from stakeholders.
- Another technique is to auto notify and close tickets without response.
- Last but not least, it’s often easier to simply re-image the machine than to investigate root cause.
This is the average day to day of threat analysts in the SOC. It’s not sexy, nor is it cost effective. Repeated tens (if not hundreds) of times on a daily or weekly basis drives up organizational costs to an unsupportable level. When I hear people say: “I can’t afford to build or staff a SOC,” it’s not surprising given the status quo. Manual and human intensive tasks give security a bad name. This is life without EDR.
Life with EDR
The introduction of EDR is a major evolution in SOC effectiveness. Threat analysts no longer need to ask others to validate threats, the data is available to real-time query. With immediate access to the data, three incredible things happen:
- The SOC Analyst can research and respond to alerts in rapid succession, dramatically increasing their workload.
- Armed with endpoint context, Tier 1 threat analysts can perform more sophisticated analysis, encroaching on the role typically assigned to Tier 2.
- By eliminating the high volume of tickets requesting context, MSSP customers or stakeholders of large enterprise are relieved of the deluge of inquiries.
Inevitably, a breach will occur. When that does happen, utilizing a best-in-class EDR vendor that includes continuous and centralized recording takes the guesswork out of incident response. The attacker may have erased their tracks, but EDR recorded the attackers every move with an endpoint DVR, the cyber equivalent to a surveillance camera. With a complete historical recording of an attacker and their actions, incident responders don’t need to fly to the scene of the crime, scrape RAM, or image machines to look for clues. The full recorded history of the attack enables on the spot incident response.
EDR is much more than an endpoint security product; it’s causing an evolution in the people and process utilized within security operation centers globally. And for individual corporations or customers who rely on MSSPs to deliver skills and expertise, EDR is a fundamental technology that is not optional. It’s a foundational requirement of the next generation security operation center and primary reason we’ll collapse the average ~250 day gap between attack initiation and discovery.