What Is Endpoint Security?
Protecting endpoints
Endpoint security solutions protect endpoints such as mobile devices, desktops, laptops, and even medical and IoT devices. Endpoints are a popular attack vector and the goal of an attacker is to not only compromise the endpoint but also to gain access to the network and the valuable assets within it.
Contact Cisco
-
-
Call Sales:
- 1-800-553-6387
- US/CAN | 5am-5pm PT
What is driving the need for enhanced endpoint protection?
Endpoint security is an integral component of the modern security stack. Digital transformation initiatives, the move to the cloud, and a rapidly expanding attack surface are all driving the need for a new class of endpoint security that is equipped to defend organizations against an increasingly diverse and sophisticated threat landscape.
What is endpoint security?
Endpoint security combines preventative endpoint protection with a new breed of continuous detection and response capabilities.
Endpoint protection systems are designed to quickly detect, analyze, block, and contain attacks in progress. To do this, they need to collaborate with other security technologies to give administrators visibility into advanced threats to speed detection and remediation response times.
How does an endpoint security solution work?
An endpoint security solution includes continuous monitoring, rapid time to detection, and architectural integrations. With threats continually increasing in sophistication and frequency, it is more important than ever to deploy an effective endpoint protection solution.
Endpoint security solutions take a cloud-based approach to instantly access the latest threat intelligence without requiring manual updates from security admins. This allows for faster and more automated responses. They continuously monitor all files and applications that enter your network and have the ability to scale and integrate into your existing environment.
Cloud-based solutions offer scalability and flexibility and are easy to install, integrate, and manage. There is also less overhead since there is no infrastructure to maintain.
Types of endpoint security
Attackers stay up to date on security trends to create stealthier attacks, rendering legacy antivirus tools obsolete. Endpoint security combines the preventive protection of an EPP solution as well as the detection and investigative features of an EDR.
Endpoint protection platform (EPP)
An EPP solution is a preventative tool that performs point-in-time protection by inspecting and scanning files once they enter a network. The most common endpoint protection is a traditional antivirus (AV) solution. An AV solution encompasses antimalware capabilities, which are mainly designed to protect against signature-based attacks. When a file enters your network, the AV solution will scan the file to see if the signature matches any malicious threats in a threat intelligence database.
Endpoint detection and remediation (EDR)
An EDR solution goes beyond simple point-in-time detection mechanisms. Instead, it continuously monitors all files and applications that enter a device. This means EDR solutions can provide more detailed visibility and analysis for threat investigation. EDR solutions can also detect threats beyond just signature-based attacks. Fileless malware, ransomware, polymorphic attacks, and more can be detected using EDR solutions.
Extended detection and response (XDR)
Where EDR improves on malware detection over antivirus capabilities, XDR extends the range of EDR to encompass more deployed security solutions. XDR has a broader capability than EDR. It uses the latest technologies to provide higher visibility and collects and correlates threat information while employing analytics and automation to help detect current and future cyberattacks.
Cisco Secure's Truman Coburn and Security Consulting Engineer Andy Hagar discuss the role the Cisco MDR platform and automation plays when investigating and mitigating threats.
