The Truth and Myths behind EDR, the New Megatrend in Endpoint Security

Endpoint Detection and Response (EDR) is a security solution that provides continuous threat monitoring and responses to threats occurring at endpoints. In general, EDR should be able to perform four security functions: detect security incidents, investigate security incidents, contain incidents at the endpoint, and remediate endpoint to its pre-infected state.

Recently, security threats are becoming increasingly sophisticated using techniques such as bypassing detection. However, traditional security solutions have limitations in identifying potential threats to the organization infrastructure since they cannot gather behavioral information on logs for analysis.

On the other hand, EDR solutions are capable of addressing such threats by continuously collecting and analyzing behavioral information on endpoints including file creation and deletion, registry registration, process execution, and network connection. It enables clients to gain visibility on security threats. With an EDR solution, businesses can detect malware or malicious activities and respond immediately to threats through methods such as network blocking and process termination.

By providing visibility into various events and threats that occur at endpoints, EDR allows security administrators to quickly determine and respond to advanced threats.

To respond to advanced threats that are armed with sophisticated and complex technologies, an integrated security approach should be adopted, taking into consideration the infrastructure of the organization including endpoints and networks. Separate responses of security solutions alone cannot adequately respond to the latest security threats.

Security solutions such as anti-virus, media control, patch management, and personal information leakage prevention solutions apply different technologies and coverages depending on the function. However, EDR does not have the purpose of fulfilling a specific security function, but rather to support faster and more reliable decision-making abilities against threats by collecting information and responding to various events and security threats occurring at endpoints. Therefore, to actively and effectively respond to the latest security threats, it is necessary to establish a Cyber Kill Chain - a collection of processes that detect and react to an attack - through an organic integration of traditional security solutions and EDR solutions.

AhnLab has launched AhnLab EPP, the next-generation endpoint protection platform, for this purpose. AhnLab EPP responds more actively to the latest threats through integrated policy settings and integrated response features between its products. AhnLab plans to support the integrated operation of AhnLab EDR through AhnLab EPP in stages so that it can work with AhnLab Patch Management, AhnLab Privacy Management, and AhnLab ESA, which have been installed and operated by the existing endpoint management system, AhnLab EMS.

Endpoints are not the only entry point for threats; there are networks, emails, and more. There is therefore a need to introduce other types of security solutions that are optimized for each entry point. In this regard, AhnLab provides customers with AhnLab MDS, a network sandbox-based Advanced Persistent Threat (APT) protection solution. AhnLab MDS runs dynamic behavior analysis and dynamic content analysis based on virtual machines on the network to thoroughly analyze advanced attacks including unknown threats.

To be precise, an anti-virus solution (hereinafter AV) has an irreplaceable role to play, so it cannot be entirely replaced by EDR. AV is the most fundamental security solution for detecting, blocking, and isolating malware at endpoints. However, there is a limit to endpoint log collection, making it difficult to track the entry points of malware infection and to provide threat visibility and further responses. This is why EDR is necessary; it will compensate for the limitation and enable a stronger response.

This is attested to by some vendors who initially focused on providing EDR-specific features but later added prevention features to compete in the EPP market through partnerships or M&As with endpoint security companies. In addition to AV, solutions such as firewalls, IPS, and SIEM are still actively being implemented and operated because of their dedicated functions and purposes. EDR is implemented using a new methodological approach, making it a supplementary response to the latest diverse threats. 

As for AhnLab EDR, it classifies the risk into two groups: Malicious and Suspicious. It can respond to and take actions against detected threats by process termination, network blocking and artifact collection for agent systems, and file collection and search. Also, AhnLab EPP enables automatic response through integrated security policy settings for automatic notification and connected response with other products (e.g., patch, manual scanning, remediation), and more.

In a sense, EDR can be seen as a post-incident response from the viewpoint of responding to detected threat analysis. From another viewpoint, however, it can be seen that EDR provides a pre-incident response by preventing potential threats in the organization and minimizing the response time. Most of all, EDR can reduce the dwell time of threats through real-time detection, collection, and analysis of suspicious processes and files to effectively prevent potential damage.

When breaches occur, digital forensics collects not only the behavioral information collected by EDR for cause analysis, but also much more artifact information. In comparison, EDR collects all threat-related behavior information generated at endpoints, even before an incident occurs. Also, it notifies the administrators of any abnormal behavior suspected of being a security breach to ensure that countermeasures, such as network blocking and process termination, are taken in advance. If a security breach occurs, EDR analyzes the collected data to allow for prompt operation of the forensics process.

AhnLab EDR employs its unique behavioral engine to collect and analyze all behavioral information at endpoints to provide automatic responses to security threats. Security administrators can monitor and analyze endpoint behavior logs saved on the EDR server and link with AhnLab EPP to set various integrated response policies.

With AhnLab EDR, companies can take advantage of enhanced security visibility on entry points, such as PCs or other endpoints, through continuous monitoring and response. AhnLab EDR is distinct for its focus on customer feedback and its application of customer suggestions to provide exclusives features that provide: 1) comprehensive analysis of threat information through integrated operation of endpoint security solutions; and 2) management efficiency through single management console and single agent.

First, AhnLab EDR can easily work with other AhnLab endpoint security solutions, such as V3, AhnLab’s anti-virus solution. So if you are already using V3, you can respond to advanced threats through comprehensive analysis of information gathered from each solution, such as AhnLab Patch Management for OS and security patch management; AhnLab ESA for detecting and remediating vulnerable systems; and AhnLab Privacy management for data loss prevention.

Second, since AhnLab EDR utilizes V3 as an agent, no additional agent is needed, and it can run simply by applying for a license. Besides, with a single management console, this solution enables efficient and integrated management and response for endpoint security. This allows security administrators to reduce time spent on managing PC performance issues and new management points when introducing the solution.

Since AhnLab EDR is based on V3, customers who do not use V3 cannot use AhnLab EDR. The main reason AhnLab designed EDR to work with V3 is due to the nature of EDR solutions and the stability of endpoint system operation. EDR solutions require additional drives to collect and analyze behavior information at the endpoint system's operating system kernel level. However, having multiple kernel drives running together may affect the performance and reliability of the endpoint system.

V3 utilizes the MDP engine, AhnLab's behavior analysis engine, and with the help of V3, AhnLab EDR collects all behavior information on the actual operating system of the endpoint system. Therefore, it does not require the additional installation of kernel drives and also will not significantly affect system performance.

As many security vendors are releasing EDR products to meet rising demand, EDR is often misunderstood as the answer to a wide range of security problems. We must understand that EDR is indeed an advanced security solution, but is not a silver bullet. Rather, EDR is just one of many tools that help us address security threats. No solution can achieve the expected protection on its own without the integrated connection of people, processes, and services as a whole.