Endpoint Protection - Revision history

NKirnbauer: fixed link

2024-08-28T15:08:51Z

fixed link

← Older revision		Revision as of 15:08, 28 August 2024
Line 271:		Line 271:
	* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-security.html		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-security.html
	* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-xdr.html		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-xdr.html
	* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-detection-and-response.~~html7~~		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-detection-and-response.html
	* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-encryption.html		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-encryption.html
	* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-protection-software.html		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-protection-software.html

CIfrim: /* References */

2024-03-04T11:21:31Z

References

← Older revision		Revision as of 11:21, 4 March 2024
Line 264:		Line 264:
	* https://ieeexplore.ieee.org/document/10314198		* https://ieeexplore.ieee.org/document/10314198
	* https://ieeexplore.ieee.org/document/646182		* https://ieeexplore.ieee.org/document/646182
			* https://ieeexplore.ieee.org/document/8082684
	* https://us.norton.com/internetsecurity-malware-what-is-a-computer-virus.html		* https://us.norton.com/internetsecurity-malware-what-is-a-computer-virus.html
	* https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-security/sescloud.html		* https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-security/sescloud.html

CIfrim: /* Services and Tools */

2024-03-04T11:21:16Z

Services and Tools

@@ Line 208: / Line 208: @@
 document readers, Java and more to block threats when triggered. ESET Endpoint
 Security can be deployed on-premises or hosted in the cloud.
 === Sandboxing ===

CIfrim at 22:42, 3 March 2024

2024-03-03T22:42:38Z

@@ Line 216: / Line 216: @@
 * A Sandbox can only handle and process files up to a certain size
 * The attackers' software can also act as a trojan horse, act innocent during the sandboxing process and then infect the system when triggered afterwards.
 == References ==
@@ Line 224: / Line 250: @@
 * https://ieeexplore.ieee.org/document/6703683
 * https://ieeexplore.ieee.org/document/6016683
 * https://us.norton.com/internetsecurity-malware-what-is-a-computer-virus.html
 * https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-security/sescloud.html
@@ Line 238: / Line 267: @@
 * https://www.fireeye.de/
 * https://securitycloud.symantec.com/cc/landing
 [[Category:Basic]]

CIfrim: /* Sandboxing */

2024-03-03T18:03:41Z

Sandboxing

← Older revision		Revision as of 18:03, 3 March 2024
Line 210:		Line 210:

	=== Sandboxing ===		=== Sandboxing ===
	Sandboxing is an approach Endpoint Protection Platforms use to prevent intrusions rather than detecting them. It is defined as a method of isolating untrusted data or software that is executed in the same address sapce as the trusted software. By executing suspicious software in an isolated envronemnt its behavior and output can be closely monitored and tested without having to worry that it will impact the entire system or network.		Sandboxing is an approach Endpoint Protection Platforms use to prevent intrusions rather than detecting them. It is defined as a method of isolating untrusted data or software that is executed in the same address sapce as the trusted software. By executing suspicious software in an isolated envronemnt its behavior and output can be closely monitored and tested without having to worry that it will impact the entire system or network. Unlike traditional antivirus software, sandboxing actively monitors the behavior of unknown threats, making it especially useful against new vulnerabilities. It works by studying suspicious files in a controlled setting to decide if they are harmless or harmful. While sandboxing improves security and teaches us about how malware acts, we need to know that it can't always find very smart threats. Sandboxing should be part of a larger defense system to make endpoints safer.

	==== Sandboxing Weaknesses ====		==== Sandboxing Weaknesses ====
	* Sandbox environments look slightly different to real environments and can therefore be detected by the malware		* Sandbox environments look slightly different to real environments and can therefore be detected by the malware
	* A Sandbox can only handle and process files up to a certain size		* A Sandbox can only handle and process files up to a certain size
	* The attackers' software can also act as a trojan horse, act innocent during the sandboxing process and then infect the system when triggered afterwards.		* The attackers' software can also act as a trojan horse, act innocent during the sandboxing process and then infect the system when triggered afterwards.

	== References ==		== References ==

FMuellner: Fundamental revision. Structure made clearer. Added new Endpoint Protection systems. Add new Endpoint Protection Tool (ESET). Outdated views fixed. Explanations extended. Links checked.

2023-01-02T13:28:42Z

Fundamental revision. Structure made clearer. Added new Endpoint Protection systems. Add new Endpoint Protection Tool (ESET). Outdated views fixed. Explanations extended. Links checked.

Show changes

FMuellner: /* References */

2023-01-02T12:57:51Z

References

← Older revision		Revision as of 12:57, 2 January 2023
Line 155:		Line 155:
	* https://docs.broadcom.com/doc/endpoint-security-en		* https://docs.broadcom.com/doc/endpoint-security-en
	* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-security.html		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-security.html
	* https://www.trellix.com/en-us/security-awareness.html
	* http://acta.uni-obuda.hu//Vokorokos_Balaz_Mados_57.pdf		* http://acta.uni-obuda.hu//Vokorokos_Balaz_Mados_57.pdf
	* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-xdr.html		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-xdr.html

FMuellner: /* References */

2023-01-02T12:56:52Z

References

← Older revision		Revision as of 12:56, 2 January 2023
Line 146:		Line 146:
	== References ==		== References ==

	* https://ieeexplore~~-1ieee-1org-1tn53mdf308d8~~.~~han~~.~~fhcampuswien.ac.at~~/~~stamp~~/~~stamp.jsp?tp=&arnumber=~~8945852		* https://ieeexplore.ieee.org/document/8945852
	* https://ieeexplore~~-1ieee-1org-1tn53md1x0013.han.fhcampuswien~~.ac.at/~~stamp~~/~~stamp.jsp?tp=&arnumber=~~1652120		* https://ieeexplore.ieee.org/document/1652120
	* https://ieeexplore~~-1ieee-1org-1tn53md1x0013.han~~.~~fhcampuswien~~.~~ac.at~~/~~stamp~~/~~stamp.jsp?tp=&arnumber=~~8939836		* https://ieeexplore.ieee.org/document/8939836
	* https://ieeexplore~~-1ieee-1org-1tn53mdf308d8.han.fhcampuswien~~.ac.at/~~stamp~~/~~stamp.jsp?tp=&arnumber=~~6703683		* https://ieeexplore.ieee.org/document/6703683
	* https://ieeexplore~~-1ieee-1org-1tn53mdf308de~~.~~han~~.~~fhcampuswien.ac.at~~/~~stamp~~/~~stamp.jsp?tp=&arnumber=~~6016683		* https://ieeexplore.ieee.org/document/6016683
	* https://us.norton.com/internetsecurity-malware-what-is-a-computer-virus.html		* https://us.norton.com/internetsecurity-malware-what-is-a-computer-virus.html
	* https://~~randed~~.com/~~false~~-~~positive~~-~~and~~-~~false~~-~~negative/?lang=en~~		* https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-security/sescloud.html
	* https://www.fireeye.com/content/dam/fireeye-~~www~~/~~products/pdfs/pf/ep/ds-~~endpoint-security.~~pdf~~
	* https://docs.broadcom.com/doc/endpoint-security-en		* https://docs.broadcom.com/doc/endpoint-security-en
	* S. ~~Chandel, S~~. ~~Yu, T. Yitian, Z. Zhili, and H. Yusheng, "Endpoint protection: Measuring the e�ectiveness of remediation technologies and methodologies for insider threat", in 2019 International Conference on Cyber~~-~~Enabled Distributed Computing and Knowledge Discovery (CyberC), 2019, pp. 81~~-89.		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-security.html
	* https://www.~~gartner~~.com/en/~~information~~-~~technology~~/~~glossary~~/~~endpointprotection~~-~~platform-epp~~		* https://www.trellix.com/en-us/security-awareness.html
	* https://~~home~~.~~sophos~~.com/en-us/security-~~news~~/~~2020~~/what-is-~~asignature~~.~~aspx~~		* http://acta.uni-obuda.hu//Vokorokos_Balaz_Mados_57.pdf
	* https://www.~~mcafee~~.com/~~enterprise/de~~-de/security-awareness/endpoint/what-~~isendpoint~~-detection-and-response.~~html~~		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-xdr.html
	* https://www.~~fireeye~~.com/~~products~~/~~endpointsecurity~~.html		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-detection-and-response.html7
	* L. ~~Vokorokos, A~~. ~~Baláz, and B. Mados, \Application~~ security ~~through sandbox virtualization," Acta Polytechnica Hungarica, vol~~. ~~12, no. 1, pp. 83-101, 2015~~		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-encryption.html
	* https://www.~~forcepoint~~.com/~~cyberedu~~/~~sandbox~~-~~security~~		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-endpoint-protection-software.html
	* https://www.~~gartner~~.com/~~doc~~/~~reprints?id=1~~-~~25BMPL2O&ct=210225&st=sb~~		* https://www.trellix.com/en-us/security-awareness/endpoint/what-is-advanced-endpoint-protection.html
			* https://www.deepinstinct.com/glossary/next-generation-endpoint-security-nges

	[[Category:Basic]]		[[Category:Basic]]

TKralik at 19:52, 21 December 2021

2021-12-21T19:52:50Z

← Older revision		Revision as of 19:52, 21 December 2021
Line 84:		Line 84:
	According to a 2019 study the average protection rate of an Endpoint Protection Platform is 99.3% with an average false positive rate of 17 in 3000, which equals to 0.0057%.		According to a 2019 study the average protection rate of an Endpoint Protection Platform is 99.3% with an average false positive rate of 17 in 3000, which equals to 0.0057%.

	## Advantages of Endpoint Protection Platforms		==== Advantages of Endpoint Protection Platforms ====
	* It provides a single, central endpoint security management solution		* It provides a single, central endpoint security management solution
	* It simplifies security management		* It simplifies security management
	* It protects and endpoint against most well-known threats		* It protects and endpoint against most well-known threats

	## Disadvantages of Endpoint Protection Platforms		==== Disadvantages of Endpoint Protection Platforms ====
	* It cannot deal with the complete network		* It cannot deal with the complete network
	* It reduces efficiency & productivity because it needs a lot of resources		* It reduces efficiency & productivity because it needs a lot of resources
Line 107:		Line 107:
	stable, real-time capture and alerting solutions.		stable, real-time capture and alerting solutions.

	## Advantages of EDR		==== Advantages of EDR ====
	* It provides greater visibility of the network and the state of each individual endpoint		* It provides greater visibility of the network and the state of each individual endpoint
	* It is able to scan entire networks		* It is able to scan entire networks
	* It can detect unusual activity and respoind by isolating a possibly compromised endpoint		* It can detect unusual activity and respoind by isolating a possibly compromised endpoint

	## Disadvantages of EDR		==== Disadvantages of EDR ====
	* It produces a high volume of false alarms		* It produces a high volume of false alarms
	* It creates mountains of backlogs and each alarm has to be assessed individually to identify the threat level		* It creates mountains of backlogs and each alarm has to be assessed individually to identify the threat level
Line 123:		Line 123:
	FireEye is a US cyber security company based in California, which offer solutions for cloud, network, email, or endpoint systems.		FireEye is a US cyber security company based in California, which offer solutions for cloud, network, email, or endpoint systems.
	Their Endpoint Protection Platform uses a signature-based engine and also has the capability to use EDR through a behavior-based analytics engine. It is able to find threats, for which signatures do not exist yet using MalwareGuard, which is based on machine learning algorithms, that help fulfilling this task. FireEye has various different features, that can be downloaded as modules on the FireEye Market. Some features include:		Their Endpoint Protection Platform uses a signature-based engine and also has the capability to use EDR through a behavior-based analytics engine. It is able to find threats, for which signatures do not exist yet using MalwareGuard, which is based on machine learning algorithms, that help fulfilling this task. FireEye has various different features, that can be downloaded as modules on the FireEye Market. Some features include:
	* Investigating known and unknown threats on tens of thousands		* Investigating known and unknown threats on tens of thousands of endpoints in minutes
	of endpoints in minutes
	* Identifying vectors an attack used to infiltrate an endpoint		* Identifying vectors an attack used to infiltrate an endpoint
	* Determining whether an attack occurred (and persists) on a specific endpoint		* Determining whether an attack occurred (and persists) on a specific endpoint and where it spread
	and where it spread
	* Establishing timeline and duration of endpoint compromises and follow the incident		* Establishing timeline and duration of endpoint compromises and follow the incident
	* Clearly identifying which endpoints and systems need containment to prevent		* Clearly identifying which endpoints and systems need containment to prevent
Line 137:		Line 135:

	Symantec Endpoint Security provides security at the endpoint for both traditional and mobile devices across the three attack phases—Pre-Attack, Attack, and Post Attack. Some of its features include Attack Surface Reduction, Attack and Breach Prevention, and Post Breach Response and Remediation. Attack Surface Reduction is based on advanced policy controls and technologies, that continuously scan for vulnerabilities and misconfigurations on the endpoint. Its Attack Prevention System uses Machine Learning and Artificial Intelligence on devices and in the cloud to detect schemes to identify evolving threats across device types. Breach prevention is used to detect suspicious activity as early as possible at the endpoint—before they have any opportunity to persist on the network.		Symantec Endpoint Security provides security at the endpoint for both traditional and mobile devices across the three attack phases—Pre-Attack, Attack, and Post Attack. Some of its features include Attack Surface Reduction, Attack and Breach Prevention, and Post Breach Response and Remediation. Attack Surface Reduction is based on advanced policy controls and technologies, that continuously scan for vulnerabilities and misconfigurations on the endpoint. Its Attack Prevention System uses Machine Learning and Artificial Intelligence on devices and in the cloud to detect schemes to identify evolving threats across device types. Breach prevention is used to detect suspicious activity as early as possible at the endpoint—before they have any opportunity to persist on the network.

			=== Sandboxing ===
			Sandboxing is an approach Endpoint Protection Platforms use to prevent intrusions rather than detecting them. It is defined as a method of isolating untrusted data or software that is executed in the same address sapce as the trusted software. By executing suspicious software in an isolated envronemnt its behavior and output can be closely monitored and tested without having to worry that it will impact the entire system or network.

			==== Sandboxing Weaknesses ====
			* Sandbox environments look slightly different to real environments and can therefore be detected by the malware
			* A Sandbox can only handle and process files up to a certain size
			* The attackers' software can also act as a trojan horse, act innocent during the sandboxing process and then infect the system when triggered afterwards.

	== References ==		== References ==
Line 149:		Line 155:
	* https://www.fireeye.com/content/dam/fireeye-www/products/pdfs/pf/ep/ds-endpoint-security.pdf		* https://www.fireeye.com/content/dam/fireeye-www/products/pdfs/pf/ep/ds-endpoint-security.pdf
	* https://docs.broadcom.com/doc/endpoint-security-en		* https://docs.broadcom.com/doc/endpoint-security-en
			* S. Chandel, S. Yu, T. Yitian, Z. Zhili, and H. Yusheng, "Endpoint protection: Measuring the e�ectiveness of remediation technologies and methodologies for insider threat", in 2019 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC), 2019, pp. 81-89.
			* https://www.gartner.com/en/information-technology/glossary/endpointprotection-platform-epp
			* https://home.sophos.com/en-us/security-news/2020/what-is-asignature.aspx
			* https://www.mcafee.com/enterprise/de-de/security-awareness/endpoint/what-isendpoint-detection-and-response.html
			* https://www.fireeye.com/products/endpointsecurity.html
			* L. Vokorokos, A. Baláz, and B. Mados, \Application security through sandbox virtualization," Acta Polytechnica Hungarica, vol. 12, no. 1, pp. 83-101, 2015
			* https://www.forcepoint.com/cyberedu/sandbox-security
			* https://www.gartner.com/doc/reprints?id=1-25BMPL2O&ct=210225&st=sb

	[[Category:Basic]]		[[Category:Basic]]

TKralik: /* Endpoint Protection Systems */

2021-12-21T19:37:20Z

Endpoint Protection Systems

← Older revision		Revision as of 19:37, 21 December 2021
Line 55:		Line 55:

	== Endpoint Protection Systems ==		== Endpoint Protection Systems ==

			Endpoint Protection Solutions are categorized into two main approaches:
			* Endpoint Protection Platforms (EPP)
			* Endpoint Detection and Response (EDR)

	=== Endpoint Protection Platform ===		=== Endpoint Protection Platform ===

	One of the best solutions to achieve endpoint protection is to use an Endpoint Protection Platform (EPP), which consists of several tools, that can protect our systems		One of the best solutions to achieve endpoint protection is to use an Endpoint Protection Platform (EPP), which consists of several tools, that can protect our systems
	from unwanted intrusion, such as firewalls, antivirus systems and data encryption.		from unwanted intrusion, such as firewalls, antivirus systems and data encryption. Such an Endpoint Protection Platform has several main characteristics:
			* It is deployed on endpoint devices
			* It focuses on preventing file-based attacks
			* It can detect malicious activity
			* It can provide investigation & Remediation capabilities

	Endpoint protection platforms are software using signatures to ensure negative endpoint protection. They also have access to an own database, which stores signatures		Endpoint protection platforms are software using signatures to ensure negative endpoint protection. They also have access to an own database, which stores signatures
	of collected threats and use it to match them with other signatures, which helps them		of collected threats and use it to match them with other signatures, which helps them
	detecting possible threats. An EPP also uses different services to monitor processes		detecting possible threats.
			A signature of a virus can be compared to a human fingerprint, is it a set of unique data or bits of code that makes it possible to identify it.
			An EPP also uses different services to monitor processes
	running in networks for the sake of malfunction, virus detection.		running in networks for the sake of malfunction, virus detection.
	Even though most attacks can be stopped by monitoring and signature matching, some		Even though most attacks can be stopped by monitoring and signature matching, some
Line 72:		Line 82:
	can spread really fast and take over the whole system.		can spread really fast and take over the whole system.

	[[File:~~Gartner~~.~~jpg\|thumb\|Companies providing endpoint protection systems ranked by Gartner\|400px~~]]		According to a 2019 study the average protection rate of an Endpoint Protection Platform is 99.3% with an average false positive rate of 17 in 3000, which equals to 0.0057%.

			## Advantages of Endpoint Protection Platforms
			* It provides a single, central endpoint security management solution
			* It simplifies security management
			* It protects and endpoint against most well-known threats

			## Disadvantages of Endpoint Protection Platforms
			* It cannot deal with the complete network
			* It reduces efficiency & productivity because it needs a lot of resources
			* It cannot protect against insider threats

			[[File:Gartner2021.png]]

	=== Endpoint Detection and Response ===		=== Endpoint Detection and Response ===
Line 84:		Line 106:
	interpreting and monitoring the system, focusing on its malicious activities providing		interpreting and monitoring the system, focusing on its malicious activities providing
	stable, real-time capture and alerting solutions.		stable, real-time capture and alerting solutions.

			## Advantages of EDR
			* It provides greater visibility of the network and the state of each individual endpoint
			* It is able to scan entire networks
			* It can detect unusual activity and respoind by isolating a possibly compromised endpoint

			## Disadvantages of EDR
			* It produces a high volume of false alarms
			* It creates mountains of backlogs and each alarm has to be assessed individually to identify the threat level
			* Log retention is a burden to the system and its operators so often logs get deleted before they are assessed

	Some examples of EDR technology are FireEye Endpoint Security and Symantec Endpoint Protection.		Some examples of EDR technology are FireEye Endpoint Security and Symantec Endpoint Protection.

	==== FireEye ====		==== FireEye ====

	FireEye uses a signature-based ~~endpoint protection platform (EPP)~~ engine and also has the capability to use EDR through a behavior-based analytics engine. It is able to find threats, for which signatures do not exist yet using MalwareGuard, which is based on machine learning algorithms, that help fulfilling this task. FireEye has various different features, that can be downloaded as modules on the FireEye Market. Some features include:		FireEye is a US cyber security company based in California, which offer solutions for cloud, network, email, or endpoint systems.
			Their Endpoint Protection Platform uses a signature-based engine and also has the capability to use EDR through a behavior-based analytics engine. It is able to find threats, for which signatures do not exist yet using MalwareGuard, which is based on machine learning algorithms, that help fulfilling this task. FireEye has various different features, that can be downloaded as modules on the FireEye Market. Some features include:
	* Investigating known and unknown threats on tens of thousands		* Investigating known and unknown threats on tens of thousands
	of endpoints in minutes		of endpoints in minutes
Line 97:		Line 131:
	* Clearly identifying which endpoints and systems need containment to prevent		* Clearly identifying which endpoints and systems need containment to prevent
	further compromise		further compromise

			It also comes with a malware guard, a machine learning engine to protect against more complex threats, as well as an exploit guard, a behavior analysis engine, which protects against software exploits.

	==== Symantec Endpoint Security ====		==== Symantec Endpoint Security ====