Understanding endpoint detection and response

EDR meaning and definition

Endpoint detection and response (EDR) refers to a category of tools that continuously monitor threat-related information on computer workstations and other endpoints. The goal of EDR is to identify security breaches in real time and to develop a rapid response to potential threats. Endpoint detection and response – sometimes known as endpoint threat detection and response (ETDR) – describes the capabilities of a set of tools, the details of which can vary depending on implementation.

The term was first coined by Gartner in 2013 to highlight what was then considered a new category of cybersecurity software.

How does EDR work?

EDR focuses on endpoints, which can be any computer system in a network, such as end-user workstations or servers. EDR security solutions deliver real-time visibility and proactive detection and response. They achieve this through a variety of methods, including:

Collecting data from endpoints:

Data is generated at the endpoint level, including communications, process execution, and user logins. This data is anonymized.

Sending data to the EDR platform:

The anonymized data is then sent from all endpoints to a central location, which is usually a cloud-based EDR platform. It can also work on-location or as a hybrid cloud, depending on the needs of a particular organization.

Analyzing the data:

The solution uses machine learning to analyze data and perform behavioral analysis. Insights are used to establish a baseline of normal activity so that anomalies that represent suspicious activity can be identified. Some EDR solutions include threat intelligence to provide context using real-world examples of cyberattacks. The technology compares network and endpoint activity with these examples to detect attacks.

Flagging and responding to suspicious activity:

The solution flags suspicious activity and sends alerts to security teams and relevant stakeholders. It also initiates automated responses according to predetermined triggers. An example of this might include temporarily isolating an endpoint to prevent malware from spreading across the network. 

Retaining data for future use: 

EDR solutions preserve data to support future investigations and proactive threat hunting. Analysts and tools use this data to investigate existing prolonged attacks or previously undetected attacks.

The use of EDR is growing – driven partly by the rise in the number of endpoints attached to networks and partly by the increased sophistication of cyberattacks which often focus on endpoints as easier targets for infiltrating a network.

What to look for in an EDR solution

EDR capabilities vary from vendor to vendor, so before selecting an EDR solution for your organization, it’s important to investigate the capabilities of any proposed system and how well it can integrate with your existing overall security capabilities. The ideal EDR solution is one that provides the greatest level of protection while requiring the least amount of effort and investment — adding value to your security team without depleting resources. Here are key attributes to look out for:

Endpoint visibility:

Visibility across all your endpoints allows you to view potential threats in real time so you can stop them immediately.

Threat database:

Effective EDR requires significant data collected from endpoints and enriches it with context so that analysis can identify signs of attack.

Behavioral protection:

EDR involves behavioral approaches that look for indicators of attack (IOAs) and alerts relevant stakeholders to suspicious activities before a breach takes place.

Insight and intelligence:

EDR solutions that integrate threat intelligence can provide context, such as information about the suspected attacker or other details about the attack.

Rapid response:

EDR that facilitates a rapid response to incidents can prevent an attack before it becomes a breach, allowing your organization to continue to operate as normal.

Cloud-based solution:

A cloud-based endpoint detection and response solution ensures zero impact on endpoints while enabling search, analysis, and investigation capabilities to continue accurately and in real time.

The precise details and capabilities of an EDR system can vary depending on the implementation. An EDR implementation may involve:

• A specific purpose-built tool;
• A small component of a broader security monitoring tool; or
• A loose collection of tools used in combination with each other.

As attackers continuously evolve their methods, traditional protection systems may fall short. Cyber security experts consider EDR a form of advanced threat protection.

Why EDR is essential to businesses

Most organizations are exposed to a broad range of cyberattacks. These range from simple, opportunistic attacks, such as a threat actor sending an email attachment with known ransomware, to more advanced attacks where threat actors might take known exploits or attack methods and attempt to hide them using evasion techniques such as running malware in memory.

Because of this, endpoint security is an essential aspect of an organization’s cybersecurity strategy. While network-based defenses are effective at blocking a high proportion of cyberattacks, some will slip through and others – such as malware carried by removable media – can bypass these defenses entirely. An endpoint-based defense solution enables an organization to implement greater security and increases its chances of identifying and responding to these threats.

As organizations around the world increasingly move to remote working, the importance of robust endpoint protection has grown. Employees working from home may not be protected against cyber threats to the same degree as on-site workers and may be using personal devices without the latest updates and security patches. Employees who work remotely may be less vigilant about their cybersecurity than if they were in a traditional office setting.

As a result, organizations and their employees are exposed to additional cybersecurity risks. Strong endpoint security is essential since it protects the employee from threats and can prevent criminals from using a remote worker’s computer as a way to attack the organization’s network.

Remediation to address a breach can be difficult and expensive, and perhaps this is the single biggest reason why EDR is necessary. Without an EDR solution in place, organizations can spend weeks trying to decide what actions to take – and often their only solution is to reimage machines, which can be very disruptive, reducing productivity and incurring financial loss.

EDR versus antivirus

EDR is not antivirus software, although it may have antivirus capabilities or use data from an antivirus product. Antivirus software is responsible for guarding against known cyber threats whereas an EDR program identifies new exploits as they are running and can detect suspicious activity by an attacker during an active incident. That said, EDR software is part of the latest generation of cybersecurity products.

EDR best practice

There are various best practices to consider when implementing EDR in your organization:

Don’t overlook usersUsers represent one of the biggest risks to any system, since they can cause damage either through malicious intent or through human error. Educate your users about cyber threats and risky behaviors to increase their awareness of security and minimize liabilities caused by tactics like phishing or social engineering. Regular training or mock threat scenarios will increase user awareness of cybersecurity issues and speed up the response time when an incident does occur.

Some users might find workarounds if an EDR solution is intrusive to user experience. For example, this might include disabling defense functionality to improve their experience. However, if a solution is too flexible to user requests, attackers may find it easy to manipulate. It can help to be as transparent as possible to an end-user, ensuring they understand why these solutions are in place. Where user interactions are required, communications should be clear and direct. The system shouldn’t disclose unnecessary system information, such as personal data or IP architectures.

Integrate with other tools

EDR solutions are designed to protect endpoints but won’t provide complete security coverage for all the digital assets within your organization. EDR should operate as one aspect of your overall information security strategy, alongside other tools such as antivirus, patch management, firewalls, encryption, and DNS protection.

Use network segmentation

While some EDR solutions isolate endpoints when responding to threats, they do not replace network segmentation. For example:

• A segmented network lets you restrict endpoints to specific services and data repositories. This can significantly reduce the risk of data loss and the level of damage a successful attack might inflict.
• Ethernet Switch Paths (ESPs) can provide additional network protection. ESPs allow you to hide the structure of the network, ensuring attackers cannot easily move between segments of the network.

Take preventative measures

You should never rely solely on active responses to threats, but instead combine active response with preventative measures. Ensuring that systems remain up-to-date and patched, with comprehensive protocols and dependency lists, will reduce the number of threats you need to guard against.

Regularly audit your systems to check that tools and protocols are still appropriately configured and applied. Test systems and tool functionality by performing threat modelling and penetration testing on a continuous basis.

Ideally, your organization will have a comprehensive incident response plan that specifies who will respond and how they will respond in the event of an attack. Having a plan in place will help increase your incident response time and provide you with a structure for analyzing any data collected after the event.

Use available resources

If you are using third-party tools, make use of any educational resources provided by your EDR vendor. Many vendors offer training or webinars to keep clients up to date on the latest features and best practices. Some companies offer short courses on a variety of security topics for little or no cost.

You can find useful tools and resources on community-based resources and Information Sharing and Analysis Organizations (ISAOs). Well-known community organizations whose websites contain useful cybersecurity data and insights include the National Vulnerability Database (NVD) and the Open Web Application Security Project (OWASP).

EDR versus XDR

Traditional EDR tools focus only on endpoint data, providing visibility into suspected threats. As the challenges that security teams face – such as event overload, narrowly focused tools, a lack of integration, skills shortages, and too little time – continue to evolve, so too do EDR solutions.

XDR, or extended detection and response, is a more recent approach to endpoint threat detection and response. The “X” stands for “extended,” and represents any data source, such as network, cloud, third party, and endpoint data, recognizing the limitations of investigating threats in isolated silos. XDR systems use a combination of analytics, heuristics, and automation to generate insight from these sources, enhancing security compared to siloed security tools. The outcome is simplified investigations across security operations, reducing the time it takes to discover, investigate, and respond to threats.

Related products:

• Kaspersky Endpoint Detection and Response Expert
• Kaspersky Endpoint Detection and Response Optimum
• Kaspersky Endpoint Security for Business

Further reading:

• What is endpoint security?
• How the zero trust concept is shaping cybersecurity at scale
• What is data theft and how to prevent it
• How to protect privacy online as business and personal use converge