Endpoint is the starting point and core of security. Most companies use one or more security solutions to protect endpoint systems. However, this could lead to unexpected security holes. This is why AhnLab emphasizes integrated threat response centered around endpoint protection platform.
AhnLab recently released a new version of its EDR (Endpoint Detection and Response) solution along with three new endpoint security solutions, including AhnLab ESA, AhnLab Privacy Management, and V3 for VDI, to strengthen endpoint protection through AhnLab EPP. Following is AhnLab’s complete endpoint security strategy.
AhnLab EDR: Makes threat information easy to understand
The new version of AhnLab EDR intuitively provides more threat information. AhnLab EDR also provides a watch list for malicious-determined or malicious-like behaviors. Malicious-like behaviors refer to any behaviors suspected of ransomware and other behaviors, like changing the system settings, injecting code, or connecting to the suspicious network and the C&C servers. If the behavior in the watchlist is detected, it is categorized into factors, such as time, file, monitored behavior types, etc., as shown in [Figure 1], for easy identification.
[Figure 1] Setting for AhnLab EDR’s
monitoring threats
In addition, the new version has a completely renovated UI that allows security administrators to easily understand the detected threat details. Menus with additional information have been added to the process tree. When the security manager places the cursor on the content, detailed information appears in the pop-up window as shown in [Figure 2].
[Figure 2] AhnLab EDR’s correlation
diagram
Another new feature is the on-demand security check. Security administrators can now carry out on-demand security checks as needed, using the log processes classified as Unknown. The behavior information within the process can also be used as a basis for checking event diagrams. This is particularly useful when analyzing processes according to the administrator’s needs.
AhnLab ESA: Assess and reinforce endpoint security
AhnLab ESA (Endpoint Security Assessment) is a brand new solution that assesses and takes measures for vulnerable endpoint system, thereby contributes to enhancing endpoint security. It monitors the security status of the workplace PCs and automatically responds to strengthen the security level of each system. Based on AhnLab EPP, AhnLab ESA is integrated with V3, AhnLab Patch Management, and AhnLab Privacy Management to enable a more comprehensive and stronger response for vulnerable systems. Moreover, through the integration with AhnLab EDR, ESA can continuously and thoroughly monitor the endpoint and maintain threat visibility to quickly determine and respond to the ever-changing endpoint vulnerabilities.
[Figure 3] Concept of AhnLab ESA’s endpoint hardening
AhnLab ESA provides over 70 assessment items, and security administrators can customize the assessment items depending on their environment. For example, the password setting status on individual PCs and the CMOS password setting status can be monitored, and the security check feature can be used to fully manage the physical security checkpoints online. Most of all, ESA provides automated measures in the background and the one-click action on vulnerable items for efficiently managing security and dealing with the organization’s regulatory environment. Additionally, the console can customize the details sent to individual customers, such as notices or guides.
AhnLab Privacy Management: Stronger platform-based personal information protection
With regulations and penalties becoming severe in regards to personal information, companies often feel burdened when directly or indirectly using customer's personal information. Hence, AhnLab released AhnLab Privacy Management based on AhnLab EPP, to provide stronger personal information management and leak prevention by integrating multiple security solutions.
AhnLab Privacy Management provides optimized features for the management of critical information. It blocks any attempts to disclose files containing personal information from endpoints. Constantly monitoring the web browser, email, messenger, P2P, USB, external hard drives, applications, and devices, it forces applications with personal information to close.
The security manager can set the pattern rule for personal information and monitor those files real-time while also taking immediate action according to the policy, such as deleting the file, isolating the file, or blocking networks. Furthermore, it restricts the printing of files with personal information. When printing files with personal information, it can insert watermarks as per policy or apply a printing prevention policy to prevent any offline information leakages.
What stands out the most in AhnLab Privacy Management is the Manage Keyword feature that allows the management of document files. The manager can create a keyword pattern rule and apply the policy to monitor and track the staffs' document usage, possession, and more. This feature incorporated feedback from various users and provides confidentiality status check of documents, preventing important information leaks from companies.
V3 for VDI: Minimize security hole in changing environments
Recently, an increasing number of companies are turning to Virtual Desktop Infrastructure (VDI) for cost reduction and work efficacy. The problem is that this can cause security holes within endpoints. It is inadequate to run existing vaccines in a VDI environment. Anti-malware solutions installed on VDI systems use up system resources that the VDI should use, thus impacting performance. Also, there's a risk of an AV-Storm when updating the anti-malware engine. Most of all, it is not easy to unify and simultaneously manage numerous anti-malware products installed on the VDI.
To address this issue, AhnLab recently released a VDI-dedicated anti-malware solution, V3 for VDI. V3 for VDI has an exclusive built-in TS engine optimized for VDI environments that provides a strong defense against malware without impacting the VDI system performance. Both the agent type (V3 for VDI) and the non-agent type (V3 for VDI Agentless) support the VDI environment but only V3 for the VDI Agent supports integrated management though AhnLab EPP.
Optimum approach to enhance threat response in endpoints
The key of AhnLab EPP lies within the integration of multiple individual security solutions to enable efficient and seamless threat response.
The new AhnLab ESA and AhnLab Privacy Management integrated with the V3, EDR, and AhnLab Patch Management results in stronger security management and threat response. Depending on the client’s environment, the security manager can set the rules, such as ‘AND/OR’ condition, for individual security products to automate response for threat factors. In particular, the security manager can encourage staff members to proactively check the issue and take action. In other words, the user can automate endpoint hardening through AhnLab EPP and take authority of the security operation.
