The 4 Commandments of Endpoint Detection and Response (EDR)

Now that you know how to plan for, select and deploy an endpoint detection and response (EDR) solution, there are just a few things you need to remember about EDR going forward. These are as follows:

1. Discovery and Inventory of Endpoints Are Key

To effectively secure your organization's endpoints, you need to understand the contextual details of your entire endpoint environment. That includes not only keeping an inventory of all existing endpoints' firmware, OS, and application versions, so that changes in violation of your organization's security policies can be addressed. It also involves continuously monitoring for new endpoints that might attempt to access the corporate network. All unapproved endpoint entries should be blocked, immediately and automatically.

2. Gaps Between Detection, Response and Prevention Need to Be Minimized

One of the most important challenges in EDR is the need to minimize the time that elapses between when an organization detects a threat and develops an appropriate response, as well as the time it takes for an organization to take that response and incorporate it into preventive security measures. Fortunately, organizations can do two things to minimize these gaps. First, they can baseline their endpoints' normal behavior. Doing so will provide them with a reference point for "safe" and "normal" behavior against which they can analyze configuration changes, or "drift." Second, they can make use of threat intelligence, business context, and security context in an effort to not only identify all threats but also prioritize and scope their severity. With that information, organizations can automatically create a patching schedule that quickly responds to a threat based upon its severity and priority without any human intervention whatsoever.

3. It's All About Security Maturity

EDR works best in a supportive corporate culture where security policies and training are formalized. As a result, organizations looking to get the most out of their EDR system should advance security maturity with the understanding that security functions as a process. That means companies should be continuously conducting security awareness training, formalizing security policies, and creating security processes. Organizations should also make sure the EDR solution is configured to share information with other elements of their security infrastructure. Taking that step will help their separate security systems to make correlations in an effort to identify threats.

4. The EDR Lifecycle Is Never Done

Hundreds of thousands if not millions of new digital threats manifest each and every day. With that in mind, organizations need to stay alert for signs of new threats, use responses to old threats to create prevention efforts, constantly monitor for new endpoints and configuration changes, and work to minimize the detection, response, and prevention gaps. For more information on how you can confront the endpoint security risks of tomorrow, download Tripwire's Endpoint Detection and Response for Dummies eBook here. _{Title image courtesy of ShutterStock}