Endpoint Protection
Also known as:
- Endpoint Protection Platforms (EPP)
- Endpoint Detection and Response (EDR)
What problem does it target?
Since almost the beginning of computing, there was a need to protect endpoints, initially fulfilled with Anti-Virus software. Endpoints and servers are still a prime target for exploitation and malware infection. Once infected, attackers move laterally, access credentials, or exfiltrate sensitive data - making endpoint security a top-priority issue in most organizations.
What does this solution do?
- Detects, responds to, and contains malware on endpoints
- Collects telemetry for response, forensics, and threat hunting
- Some vendors include triage and managed response services
- It can’t handle anything itself - still requires a mature monitoring and escalation process to be fully effective
Who is this for?
- One of the first controls every organization considers.
- Adopted very early - even in 10-50 employees organizations.
Who might not benefit from this?
- Very early-stage or very small organizations with a low risk profile
Pitfalls and remedies
| Pitfall | Remedy |
|---|---|
| Coverage issues – not all devices are protected | Compare inventories with device management solutions (MDM/SCCM). Insert EPP/EDR into the standard image used to deploy endpoints/servers. Leverage EPP/EDR vendor tools for automatic coverage validation or use CAASM/CCM solutions to ensure continuous coverage. |
| Unprotected servers - some organizations believe deploying EPP/EDR on servers is optional or can impact performance | EPP/EDR provide significant value when deployed on servers, and performance issues are not the norm, and can be resolved relatively quickly |
| Configuration – EPP/EDR policy is partially or incorrectly enforced | Periodically review EPP/EDR configuration manually, using vendor-provided tools/services, or external validation tools |
| Response – no manual or managed response process in place | Consider a reliable managed service such as CrowdStrike Falcon Complete. Maintain an internal escalation team for threat response. |
Sample products
- CrowdStrike Endpoint Security
- SentinelOne Singularity Endpoint
- Microsoft Defender for Endpoint (MDE)