What is an Endpoint Protection Platform (EPP)

We have never lived in a more threatening time across the board. In the area of cybersecurity, there have never been more advanced attacks that are threatening your business. Additionally, your organization like many others is most likely using a hybrid approach that spans between on-premises and the cloud.

With businesses making use of the cloud technologies, and employees having the ability to access business environments using mobile devices and other device types, today’s network perimeter has shifted to the endpoint. An Endpoint Protection Platform (EPP) provides a holistic approach to cybersecurity that takes into consideration today’s shift to the cloud and end user device-centric productivity. What is an endpoint protection platform? How does it compare with traditional security solutions?

What is an Endpoint Protection Platform (EPP)?

With today’s environments being anything but traditional with a heavy mix of cloud services, solutions, and data storage, the cybersecurity solution that is used can be anything but traditional. Most traditional cybersecurity platforms, including legacy virus and malware platforms, are built for strictly on-premises environments and attacks based on malicious files.

We are all familiar with the legacy virus and malware scans based on a signature approach that looks for certain known variants of malware based on the signature of specific files much like a fingerprint. However, new malware and ransomware threats have evolved far beyond these traditional detection mechanisms.

Also, protecting endpoints based on their physical location on-premises is no longer effective since employees are using all types of devices, including mobile devices to access business environments both on-premises and in the cloud.

The new approach to protecting and securing business-critical systems is using an Endpoint Protection Platform (EPP). The word “platform” here helps us to understand that this is a holistic cybersecurity solution. An endpoint protection platform is a solution that combines several techniques and technologies to secure the new endpoint network perimeter. What are the components of an endpoint protection platform?

• Protection against sophisticated next-generation “fileless” attacks
• Use of artificial intelligence (AI) and machine learning (ML)
• Intelligent threat hunting
• Automated monitoring, remediation, and alerting
• Forensic tools to investigate incidents

The cloud has made powerful cybersecurity tools like endpoint protection platforms possible. Cloud solutions are the way of the future and allow a centralized approach and “connect from anywhere” architecture that allows endpoints to be managed from anywhere with effectiveness and accuracy.

This includes whether workers are working on-premises at your corporate location or working remotely at home or from another remote network. EPP provides a really great solution to remote work security landscapes and protecting business-critical data from compromise.

Most EPP solutions your organization will want to consider investing in will most certainly be housed in cloud environments to facilitate these and other great new features they bring to the table.

Protection Against Sophisticated Next-Generation “Fileless” Attacks

New and alarming attack techniques that are coming onto the scene are known to be highly effective. One of these new types of attacks is referred to as “fileless” ransomware. What is this? It refers to a new technique that attackers are using which is able to avoid detection by traditional malware scans and even application whitelisting.

A fileless ransomware attack never deploys malicious “files” on the end user client. Rather, malicious activity is carried out in memory only and uses legitimate applications such as PowerShell for encrypting end user systems. A typical workflow of fileless ransomware includes the following:

• Fileless attack lurks with a malicious email attachment or drive by download URL
• End user clicks on a malicious link in a SPAM email or opens a document
• A website downloads legitimate flash
• Flash launches PowerShell
• PowerShell code, only working in memory, downloads malware, contacts the C&C, encrypts files on the computer, deletes backups, etc

Traditional endpoint security techniques and solutions have a difficult time recognizing these types of fileless attacks. Today’s next-generation endpoint protection platforms are employing technologies that help to identify “behavior” base malicious activity instead of relying on file-based signatures and other tradition technologies.

What technologies included in today’s endpoint protection platforms make this possible?

Use of Artificial Intelligence (AI and Machine Learning (ML))

There is perhaps no greater advancement in the area of cybersecurity than the use of artificial intelligence (AI) and machine learning (ML). Both AI and ML provide the ability to allow cybersecurity solutions to “intelligently” identify and pinpoint malicious activities.

“Behavior” based malware hunting is the way of the future, especially with the new types of attacks that no longer use malicious file-based attacks that are dropped on the end user client and work only from memory. AI and ML are technologies that allow ingesting data on your endpoints to establish a baseline of normal behavior and activity.

Once the baseline is determined to know what normal behavior and application activity looks like on an end user client, then any anomalies to that behavior and activity can easy and quickly be spotted by the AI/ML solution. This is especially important with devices spread across various networks including home networks and connecting to cloud SaaS and other resources.

Think of an AI/ML solution as a 24×7×365 security analyst watching your environment performing tasks much more quickly and efficiently than a human being can do. Armed with AI/ML, an endpoint protection platform watches your environment across all devices and networks looking for suspicious behavior. Any anomalous behavior can quickly be pinpointed.

This also allows for very quick action to terminate malicious processes before any real damage is seen. An endpoint protection platform making use of “intelligent” software can quickly determine a process or behavior to be malicious and perform remediation steps, including terminating processes, sending alerts, and other actions.

This also leads us into the third component of a true endpoint protection platform — automated monitoring, remediation, and alerting.

Intelligent Threat Hunting

Threat hunting involves proactively searching for cyber threats that are lurking undetected in your network or cloud environments. Finding threats that may be silently hiding in your environment is an extremely valuable task that organizations today want to be doing to properly secure environments.

Additionally, if before switching to an EPP, organizations were using a traditional security solution, there can potentially be cybersecurity threats that have found their way into the environment. After migrating to a newer EPP, searching for and discovering any existing threats is extremely important.

However, threat hunting with an intelligent EPP solution helps to proactively find and remediate threats before they lead to major cybersecurity issues in your environment.

Automated Patch Management: Monitoring, Remediation, and Alerting

Automation is king in environments today. We have moved past the point of having humans perform all tasks in the environment. This is especially the case with cybersecurity. Today’s EPP solutions provide the ability for automated monitoring, remediation, and alerting which allows:

• Continuous observing of various behaviors across your endpoints
• Automatic actions to stop the spread of malicious files or behavior
• Simultaneous alerting of the threat, action taken, and further forensic data

These types of automated responses with the diverse endpoint environments that organizations are making use of are extremely powerful in fighting next-generation attacks that target your endpoints.

Benefits of an Endpoint Protection Platform (EPP)

As we have already considered looking at the capabilities of an EPP, there are many benefits that organizations reap as they adopt an EPP for securing the new network perimeter being the endpoints.

These include:

• Significant time savings and quick actioning of threats — When a cyberattack is underway, minutes, even seconds count before real damage takes place. Having an automated, AI/ML solution watching and immediately identifying and remediating threats helps organizations who already have a 24/7 SOC, but also those organizations that may not have a full-time security team. Either way, threats can be terminated quickly on endpoints that may become infected.
• Consolidated, centralized management — When to comes to cybersecurity, having all the needed information in front of you in a centralized UI for visibility, reporting, and alerting is extremely important. This allows for much more efficient and effective security operations.
• Ability to keep up with modern threats on the horizon — Keeping up with threats on the horizon for your endpoints is a difficult task with any tool. However, with a true endpoint protection platform guarding your endpoints using the latest technologies, it allows your organization to keep pace with new and emerging threats.

Wrapping Up

Using an endpoint protection platform (EPP) in your environment is necessary in securing very diverse and connected endpoints, including mobile devices, from new types of attacks. Being cloud-based, EPP solutions are able to provide many benefits over traditional security solutions that have been used for years.

Traditional security is no longer effective in securing endpoints connected across a wide range of networks. With cloud-based EPP, you have access to centralized management, monitoring, and alerting across all your endpoint devices. Additionally, today’s cloud-based EPP solutions employ the benefits of AI/ML intelligence that allows quickly finding malicious attacks, even subtle ones, based on behavior and activity analysis.

Security is extremely important. With the perimeter of your network now existing at the endpoint device, it is extremely important that you have both visibility and control over your endpoints no matter where they are located. By making use of an endpoint protection platform, your organization’s endpoints can be effectively secured against new and emerging threats.