What Is Endpoint Security? | CrowdStrike

Core functionality of an endpoint protection solution

Endpoint security tools that provide continuous breach prevention must integrate these fundamental elements:

1. Prevention: NGAV

Traditional antivirus solutions detect less than half of all attacks. They function by comparing malicious signatures, or bits of code, to a database that is updated by contributors whenever a new malware signature is identified. The problem is that malware that has not yet been identified — or unknown malware — is not in the database. There is a gap between the time a piece of malware is released into the world and the time it becomes identifiable by traditional antivirus solutions.

Next-generation antivirus (NGAV) closes this gap by using more advanced endpoint protection technologies, such as AI and machine learning, to identify new malware by examining more elements, such as file hashes, URLs, and IP addresses.

2. Detection: EDR

Prevention is not enough. No defenses are perfect, and some attacks will always make it through and successfully penetrate the network. Conventional security can’t see when this happens, leaving attackers free to dwell in the environment for days, weeks, or months. Businesses need to stop these “silent failures” by finding and removing attackers quickly.

To prevent silent failures, an EDR solution needs to provide continuous and comprehensive visibility into what is happening on endpoints in real time. Businesses should look for solutions that offer advanced threat detection and investigation and response capabilities, including incident data search and investigation, alert triage, suspicious activity validation, threat hunting, and malicious activity detection and containment.

3. Managed threat hunting

Not all attacks can be detected by automation alone. The expertise of security professionals is essential to detect today’s sophisticated attacks.

Managed threat hunting is conducted by elite teams that learn from incidents that have already occurred, aggregate crowdsourced data, and provide guidance on how best to respond when malicious activity is detected.

4. Threat intelligence integration

To stay ahead of attackers, businesses need to understand threats as they evolve. Sophisticated adversaries and advanced persistent threats (APTs) can move quickly and stealthily, and security teams need up-to-date and accurate intelligence to ensure defenses are automatically and precisely tuned.

A threat intelligence integration solution should incorporate automation to investigate all incidents and gain knowledge in minutes, not hours. It should generate custom indicators of compromise (IOCs) directly from the endpoints to enable a proactive defense against future attacks. There should also be a human element composed of expert security researchers, threat analysts, cultural experts, and linguists, who can make sense of emerging threats in a variety of contexts.

The importance of cloud-based architecture

Cloud-based architecture provides the following benefits when it comes to endpoint security: