Magazine menu Close Magazine menu

Endpoint security

Latest stories

cross cloud world

With complex data storage now the norm, how can business stay secure?

  • min read
    • While firms in every line of business are planning increased cloud use, defending against the increased range of digital dangers needn't be time-consuming or expensive, even in a multicloud world. Almost nine in ten companies use multicloud – multiple cloud storage and processing providers – to power IT and store business-critical information. A whopping 80 percent use both public and private cloud. While these complex storage setups bring advantages, they make life harder for IT professionals. Recent Kaspersky research found IT complexity is becoming a top challenge for businesses, particularly securing these networked environments. How can leaders make sure it's all secure and manageable? Defending growing data worlds The number of employee and customer digital touchpoints that must be secured in the average enterprise is ballooning. Networks are getting more complex and the amount of data gathered skyrocketing. That data can be enormously valuable – if it doesn't get lost completely in the crowd of, well, more data. Meanwhile, high-severity cybersecurity incidents grew by half in just a year. Hackers keep finding new ways to breach defenses. "Cloud and online IT complexity expand each year as the magnitude of cyberthreats grow," Tim Rosato, head of trend forecasting firm Silver Lion Group, told me in a phone interview. "User accounts, information and logins are also traveling across more cloud networks, apps and virtual desktop environments." New solutions for multicloud enterprise This growing complexity has sent many companies the way of investing in automated endpoint detection and response (EDR) platforms. These proactively scan for and eliminate threats. They're also implementing more specialist security products for hybrid cloud with controls that let you centralize security. It's all about greater network visibility and faster threat response across online workloads, software development and third-party apps. "We live in a multicloud environment. Our research shows malicious actors can take advantage of any unprotected cloud, gaining unauthorized access to the whole infrastructure. New solutions can help protect assets and remediate different kinds of attacks", says Marc Rivero, senior security researcher at Kaspersky's Global Research and Analysis Team (GReAT.) New digital identity management tools also help identify and authenticate users as they travel across apps, networks and cloud providers. You'll also want to routinely scan code and applications, networked systems and connected devices for potential points of compromise, closing loopholes before they get used. Simple actions can also lower odds of compromise further, like adopting zero-trust security and multi-factor authentication. And you can't go past promoting security awareness regularly among staff, with training every three to six months. Back up data offline every 24 hours and test security teams' reaction times using exercises based on real-world cyber incidents. Data-mapping tools that track how information flows across your business, and which users have or control access to this data, can also strengthen your cloud defenses. They help you classify and cordon off data by sensitivity level, which may also be useful in regulatory compliance. Many clouds certainly don't make light work, but the growth of multicloud and hybrid cloud is here to stay. For enterprises, the challenge is making sure their security is up to scratch for this complex environment. The increasing adoption of solutions that use automation and AI, and those designed for convoluted cloud settings, show many are taking heed. But no matter how many clouds or endpoints, remember your people must be the heart of your cybersecurity strategy.

This balloon shows why businesses need better endpoint security

  • min read
    • It's not easy getting your head around endpoint protection for business. But with a toothpick and a balloon, Matt White, CEO of software-as-a-service platform XaaS Ltd, makes it simple. Every organization's 'attack surface' has expanded like a balloon thanks to increasing digitalization and smart devices in the workplace. But cybercriminals, like a toothpick trying to pop that balloon, now have more ways of getting in and reducing your network to shreds. The reality is even more extreme, White says, with thousands of cybercriminal toothpicks trying to pop your balloon at once. The toothpicks are also getting sharper, suggests Kaspersky Senior Security Researcher Noushin Shabab. "Cybercriminals are now using AI and machine learning to make their attacks more sophisticated." What are endpoints, and why better protect them? Today, businesses' attack surfaces are bigger than ever because there are more 'endpoints' – any device connected to the network, from mobile phones to webcams to fridges. White says that's "a total chaotic mess" from a security perspective. Endpoints are cybercriminals' favorite way to get into networks. Market data analysis firm IDC's 2019 study found 70 percent of breaches started at an endpoint. What's the best way to protect endpoints? Antivirus software used to do much of the heavy lifting in business security, but White says the new threat landscape demands more robust security. "Endpoint detection and response (EDR) is like antivirus on steroids. It doesn't just detect and identify. It isolates malicious code and repairs. Spending more on that kind of system is like an insurance policy – it may protect you from a lot more damage down the line." He compares endpoint detection and response with a COVID-19 vaccination. "You know you may still catch it, but you can make it far less serious by getting a vaccine upfront." Check what level of endpoint protection your business needs. White thinks the new cyber threat level demands a new way of working, too. "It's not just plugging in the latest shiny box that's going to secure a network. Everyone has to work together – all parts of a company, regulators, financial authorities – to create collaboration. It's a team game." And that might be a good thing for business overall, as well as for business security.
optimum EDR MDR

How to know what level of endpoint protection you need

  • min read
    • Endpoints – meaning, any end of a digital communications connection, like servers, laptops and mobile devices – are cybercriminals' favorite way to get inside your infrastructure. Market data analysis firm IDC's 2019 study found 70 percent of breaches started on an endpoint. There are a few types of threats: Traditional or commodity, evasive or complex, targeted and advanced persistent threats (APTs.) Classic Endpoint Protection Platforms (EPPs) do a great job at protecting against traditional threats like malware, but evasive and advanced threats are becoming more common as more cybercriminals get hold of advanced tools. Those digitizing their business also often want to add a few more security strings to their bow. And these days, cybercriminals aim advanced and complex threats at all kinds of businesses, not just household-name companies and nation states. That's why adding Endpoint Detection and Response (EDR) to your EPP is fast becoming the standard. And then, Managed Detection and Response (MDR) offers a way to achieve the same protection in a different way. We'll cover what these advanced options do, their benefits and which types of organizations need them. What is endpoint detection and response (EDR) and when do you need it? Once you've got an EPP you're happy with, think about whether you need EDR on top. EDR offers organizations of all sizes greater ability to protect themselves against complex and advanced threats. Although they're less common than traditional threats, they're costly and disruptive to business. EDR gives you better visibility of and instant response to complex threats. It continually monitors endpoints, aiming to identify, investigate and respond. Your EDR may include tools like advanced detection engines, real-time analytics and the ability to hunt, investigate and centrally respond to evasive threats across the protected infrastructure. There should be applied threat intelligence and visibility into endpoints. Level up your endpoint protection with detection and response gives a full list of what to expect. EDR gives you tools for visibility, investigation and response. Your team can see what's happening on all endpoints and understand the scale of the threat. Investigation capabilities let you understand the root cause of a threat. Threat-hunting tools let your cybersecurity experts actively seek out any threats hiding in your infrastructure. After detecting and analyzing the threat, a fast response matters. Each organization is different. While some might have extensive cybersecurity expertise, others need a simpler solution. If your business has in-house cybersecurity expertise, you may benefit from better threat discovery, threat hunting and centralized incident response, such as Kaspersky Endpoint Detection and Response Expert, also available as part of Kaspersky Anti-Targeted Attack Platform. Alternatively, Kaspersky Endpoint Detection and Response Optimum is a simpler solution for the smaller cybersecurity team on their way to building an incident response processes. When do you need managed detection and response (MDR?) EDR provides advanced defensive capabilities, but you need to have your own cybersecurity experts to use it. MDR, on the other hand, means external experts manage your defense. With MDR, skilled professionals give you continuous protection 24 hours a day, seven days a week. It's ideal for organizations that struggle to find expertise or with limited in-house resources. Many organizations that opt for MDR are small- to medium-sized. For large organizations, MDR means you can outsource detecting, validating and prioritizing incidents rather than having as many cybersecurity specialists in house. If you're not sure whether EDR or MDR is best for your business, this infographic lays out the benefits of each. Endpoints are often vulnerable because they're what we use to create, communicate and store information. Our people using them can be manipulated by social engineering or make the wrong decision during moments of inattention, so security awareness training will help strengthen your endpoints. Whether you want to strengthen your internal defenses or use expert guidance to combat the latest threats, Kaspersky can help. For effective threat detection and response and round-the-clock security monitoring without prohibitive costs or complexity, upgrade to our cloud-native Kaspersky Optimum Security.
endpoint detection response automation

Level up your endpoint protection with detection and response

  • min read
    • Effective – and cost-effective – cybersecurity is an art of balance. Complex cyberthreats are becoming more common, but every organization faces different risks. How likely are you to be attacked and by which threats? How should you use your time, money and resources to address these? How much expertise do you have, and how much could you expand it? Getting these answers right is where minimizing cybersecurity risk and improving efficiency begins. Recently, having more employees working from home has highlighted the importance of endpoint protection. The growing incidence of more disruptive advanced and complex threats adds further concern. Organizations of every size need safe and reliable ways to communicate and share information. But that's not all. Many businesses now find they're at greater risk now attacks are more complex and frequent so they're looking for a more advanced security tool: Endpoint Detection and Response (EDR.) All EDR products aim to better identify, investigate and respond to advanced and complex threats like ransomware and fileless threats. It's an extra layer on top of endpoint protection that's continuously looking for and responding to advanced threats. What does EDR do? EDR can have a range of capabilities, depending on the product and vendor. There may be a detection engine, for example, analyzing threats using machine learning and executing possible threats in a sandbox. It may include a real-time analytics engine, monitoring memory and searching for behavior patterns. The most important EDR feature may be visibility into your endpoints. With visibility, you can investigate past attacks or current threats on endpoints. You can involve cybersecurity experts in threat hunting using advanced tools. And once you've identified and analyzed threats, you can respond fast, preferably in an automated way, saving time and resources. EDR doesn't replace your Endpoint Protection Platform (EPP.) If you feel your EPP isn't up to the job, upgrade it before you add EDR into the mix. Multi-layered threat response saves time Cyberthreats are best addressed with multiple layers. As the threat enters the host, an endpoint protection engine uses approaches like structural machine-learning models and behavior analysis to identify and neutralize traditional threats. EDR comes into play after EPP has filtered out most malware through these automated processes. It lets you concentrate resources on the more dangerous complex and advanced threats. Using EDR's investigation, threat hunting and response capabilities, your cybersecurity team can efficiently address these more serious threats. For example, when a threat is detected, a cybersecurity officer can perform a root cause analysis to see if it's a complex threat and find out where it came from. If it is a complex threat, they can respond right away and set up a task to search for similar threats, automatically applying the same response. According to Kaspersky's IT Security risks survey, 28 percent of companies using EDR could detect cyberattacks immediately after or within a few hours of an incident. How EDR saves time and resources Automating and simplifying processes saves time and resources, and improves security. Even partial automation leads to faster responses, which could be crucial to mitigate a more serious impact for cases like ransomware. Together with a more simplified workflow, less will get missed because of 'alert fatigue' from dealing with many similar incidents. You can then give more attention to incidents that need human intervention, using EDR's enhanced visibility, investigation and response capabilities. You should see a happier IT team, freed from routine tasks and able to work better. They can deal with complex incidents quickly and efficiently, significantly improving your security and preventing business disruption. Choosing the right EDR for your business All EDR tools on the market are different. Some provide better threat hunting, while others focus on streamlining workflow and better integration. Here are some examples of Kaspersky products that could help. For better threat visibility, investigation and response capabilities when your IT department doesn't have access to highly skilled security officers, use Kaspersky Endpoint Detection and Response Optimum. For better threat discovery, threat hunting and centralized incident response when you have a specialized security team, try Kaspersky Endpoint Detection and Response, perhaps as part of Kaspersky Anti-Targeted Attack Platform. The broadening landscape of advanced and complex attacks has made many companies reexamine their endpoint protection. These businesses realize they need to do more to reduce the risk from cyberattacks. In a market where there's strong competition for cybersecurity skills, EDR capabilities help make the best use of your team's abilities. Investigation tools and visibility into all endpoints are intelligent additions to your endpoint security.
Cybersecurity for home working in a hurry

Boost cybersecurity for remote working teams with system hardening

  • min read
    • COVID-19 has forced people around the world to work from home. For IT managers, in all industries and sizes of organization, there's more security risks to deal with. Why? Outside of the workplace, with on-premises tech teams on-hand when things go wrong, there's a whole host of threats that extenuate for employees working from home. Remote working heightens cyber-risks With no boss or co-workers looming over colleagues, there's more temptation to do personal things on a work device. Like shopping, letting your kids use your corporate laptop for homework, or succumbing to clickbait from untrusted websites. Right now, we're seeing a rise in phishing attacks related to COVID-19, falsely promising 'urgent health advice.' Outside the office, there's a higher risk your employees may unwittingly unleash a cyberattack. It could happen by doing something as simple as updating a free application like a PDF reader; many free downloads are riddled with vulnerabilities – opportunities for hackers to force access to your machine. If corporate devices aren't patched properly, it increases the chances those hackers will cause havoc. But now the majority of endpoint devices are remote and not on high speed corporate networks, patching is increasingly difficult. As the COVID-19 lockdown continues, updates will fall behind the release of new versions, making devices more vulnerable so it crucial to use endpoint solution layers to your advantage. If you haven't already, invest in training your homeworking employees to become more aware of cyber-risks. Aside from education, system hardening can help you minimize remote working attacks. What is system hardening? Imagine this: Your employee has a child who's been given a USB stick from their school with homework. The school doesn't have the best cybersecurity, and there's malware on it. Once that's on your colleague's work device, it can be compromised. But by disabling particular devices from accessing your USB ports, you eliminate that risk. This is an example of system hardening by tightening up access to your devices. So what else can you do? Like this story, it's simple: start with the basics. Layers are critical to your cybersecurity defenses First and foremost, if you don't have endpoint security protection – security solutions, like anti-malware that helps protect computers from cyberattacks – get it on all devices across your IT network. Many businesses buy endpoint protection just for blocking malware, but there are other layers within the software to protect your devices. Use all the security features, or layers, to your advantage. Firstly, use features which lets you limit or block specific applications you don't trust. Next, add a web control layer that blocks particular websites or their categories, which could include social media (unless that's part of your job), ecommerce or adult websites. The anti-malware layer should be your last defense against cyberattacks: Build the layers from the bottom up so hackers have more hurdles to jump before they get here. Harden first, invest in new tech next I work with IT managers in enterprises. About three in four of the people I speak to aren't using the full features of their endpoint product. The issues they're concerned about, like ransomware attacks, could be prevented with system hardening, yet there's a huge push to move onto next-gen technologies which defend by predicting, detecting and actively respond to cyber-threats. While these solutions are critical for the future of cybersecurity, before investing in more advanced tech, get the basics right first. If you don't, when you launch new solutions, you'll spend most of your IT team's time fixing smaller issues, like cleaning up malware, that could've been sorted through system hardening. Need next-level protection? If you have skilled IT security experts in your team, or you're handing sensitive customer data, you'll need more than just endpoint security. Consider upgrading to solutions like Kaspersky's EDR which offers response and forensic capabilities in the event of a cyberattack. It's simple: with system hardening, you're making each device as resilient to a cyberattack as it can be. With multiple layers of security in place, your IT team will have more time to focus on critical issues and keep the systems running smooth.
choosing cybersecurity vendor

In a crowded field, take these three steps to choose the right endpoint protection vendor

  • min read
    • Stay focused. It's the perennial advice you'll hear as you strengthen and grow any small- to medium-sized business (SMB.) Avoid getting distracted. Keep things simple. Do less, but do it better. What does this age-old wisdom mean for cybersecurity? With cyberattacks becoming more common and more costly, you might think you must give cybersecurity more of your time and effort. The answer may be both yes, and no. Choosing the right endpoint protection supplier can make your business life easier now and in future, as cybercriminals gets more imaginative and your business develops and grows. By endpoints, we mean any end of a digital communications connection, like servers, laptops and mobile devices. Endpoints need protecting with antivirus, anti-malware and a range of other protective solutions, but it needn't be complex. Many endpoint products now let you control it all from one place. Bulletproof endpoint protection should save you time and money – not just in avoiding the cost of a breach, but in ease of updates and patching, reducing pressure on your IT security team. Getting endpoint security that keeps its promises Before things get easier, you're faced with the choice of dozens of vendors. Kaspersky's Endpoint security vendor evaluation guide helps you get the right endpoint protection platform (EPP) for your business. The guide recommends a three-step approach to make sure you get the best solution for the type of business you run and your growth phase. 1.  Research market opinions and independent test results Any vendor can claim their product does what you need and does it well, but you need to get evidence to back it up. Take a long, hard look at what independent experts and customers write about the vendor's product and solutions. Rather than focusing on what the product can do, focus on how well those capacities perform. If you're interested in a vendor that performs poorly in some assessments, there may be a good reason. Look for information about why they might seem to underperform, including by asking the vendor or tester directly if needed. Customer reviews The gold standard of customer review evaluation is Gartner's peer insights customers' choice for endpoint protection platforms. It compiles and analyses user reviews to reach a rating for each vendor. You should also check the vendor's help forums where users describe product problems. Look out for how quickly the vendor resolves the bugs users report. Independent testing and review The most accurate way to verify the vendor's capabilities against current cyber-threats is through independent tests and reviews by respected security industry experts. Look for evidence of solid performance across many tests. Laboratories that test technology against known, unknown and advanced threats include SE Labs, AV-Test's awards (especially AV-Test advanced endpoint protection test) and ICSA Labs. Analytical agency conclusions Leading analytical agencies also rate vendors and give reasons, compiled by experts who know the sector. Gartner magic quadrant for endpoint protection platforms, the Forrester Wave for endpoint security suites and Radicati market quadrant for endpoint security are all well respected. 2. Make a security criteria list Defining your business's essential security needs will give you a more critical lens to examine the tests and reviews. When choosing a vendor, the most important thing is to judge the quality and capacity of their endpoint protection correctly. Global market intelligence provider IDC says 70 percent of cybersecurity breaches start at endpoints. IDC also concluded it's something of a keystone in your cybersecurity arch: Related security products like threat intelligence and endpoint detection and response rely on effective endpoint protection. See the Endpoint security vendor evaluation guide for a full checklist of what to look for in a vendor. 3. Get to know the vendor's overall profile Cybersecurity now affects many parts of your business – arguably all parts. Choosing a security vendor that has a wider range of security solutions available may give you a better return on investment as your needs change. Research what's noteworthy about the vendor. What's their image and reputation? What do they specialize in? How transparent are they? How much of their work is investment in research and development? This three-step approach will help you evaluate your endpoint security options with clarity in a confusing market. You'll come to understand exactly what your organization needs, what the experts (and everyday users) say about the solutions and the potential of vendors to deliver overall value. Your choice is important. At this stage in your business growth, effective cybersecurity will make all the difference to your ability to protect your customers and outshine the competition. Good luck.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries