Endpoint
devices
like
desktops,
laptops,
and
mobile
phones
enable
users
to
connect
to
enterprise
networks
and
use
their
resources
for
their
day-to-day
work.
However,
they
also
expand
the
attack
surface
and
make
the
organisation
vulnerable
to
malicious
cyberattacks
and
data
breaches.

Why
Modern
Organisations
Need
EDR

According
to
the
2020
global

risk
report
by
Ponemon
Institute,
smartphones,
laptops,
mobile
devices,
and
desktops
are
some
of
the
most
vulnerable
entry
points
that
allow
threat
actors
to
compromise
enterprise
networks.
Security
teams
must
assess
and
address
the
security
risks
created
by
these
devices
before
they
can
damage
the
organisation.
And
for
this,
they
require
Endpoint
Detection
&
Response
(EDR).

EDR
solutions
provide
real-time
visibility
into
endpoints
and
detect
threats
like
malware
and
ransomware.
By
continuously
monitoring
endpoints,
they
enable
security
teams
to
uncover
malicious
activities,
investigate
threats,
and
initiate
appropriate
responses
to
protect
the
organisation.

The
Limitations
of
EDR

Modern
enterprise
networks
are
complex
webs
of
users,
endpoints,
applications,
and
data
flows
distributed
across
on-premises
and
multi-cloud
environments.
As
EDR
solutions
only
provide
visibility
into
endpoints,
many
security
gaps
and
challenges
remain,
significantly
increasing
the
risk
of
cyberattacks
going
unnoticed.

• 
  Malware
  disabling/abusing
  EDR
  agents:
  The
  emergence
  of
  sophisticated
  hacker
  groups
  like
  
  Lapsus$
  is
  another
  risk
  that
  EDR
  tools
  can’t
  deal
  with.
  In
  late
  2021,
  Lapsus$
  hacked
  into
  several
  large
  companies
  by
  compromising
  remote
  endpoints
  and
  turning
  off
  their
  EDR
  tools.
  They
  were
  thus
  able
  to
  hide
  their
  malicious
  behaviour
  on
  the
  infected
  endpoints
  and
  achieve
  their
  goal
  of
  stealing
  sensitive
  company
  data.
  Another
  problem
  is
  that
  threat
  actors
  can
  abuse
  the “hooking”
  technique
  that
  EDRs
  use
  to
  monitor
  running
  processes.
  This
  technique
  enables
  EDR
  tools
  to
  monitor
  programs,
  detect
  suspicious
  activities,
  and
  gather
  data
  for
  behaviour-based
  analytics.
  However,
  this
  same
  process
  allows
  attackers
  to
  access
  a
  remote
  endpoint
  and
  import
  malware.
• 
  BYOD:
  In
  recent
  years,
  many
  organisations
  have
  shifted
  to
  remote
  work
  models
  that
  allow
  employees
  and
  third-party
  users
  to
  access
  enterprise
  resources
  via
  remote
  networks
  and
  unsecured
  mobile
  devices.
  These
  devices
  are
  outside
  the
  control
  of
  security
  teams
  and
  their
  EDR
  tools.
  Consequently,
  their
  security
  solutions
  cannot
  keep
  up
  with
  all
  these
  endpoints,
  much
  less
  protect
  them
  or
  the
  enterprise
  network
  from
  malicious
  attacks.
• 
  Unsupported
  devices:
  Also,
  not
  every
  connected
  endpoint
  can
  support
  EDR
  agents.
  This
  is
  true
  for
  legacy
  endpoints
  like
  routers
  and
  switches,
  as
  well
  as
  newer
  IoT
  devices.
  Further,
  with
  connected
  Supervisory
  Control
  and
  Data
  Acquisition
  (SCADA)
  and
  Industrial
  Control
  System
  (ICS)
  environments,
  some
  endpoints
  may
  be
  outside
  the
  organisation’s
  control
  and
  thus
  outside
  the
  EDR’s
  security
  perimeter.
  Consequently,
  these
  endpoints
  and
  systems
  remain
  vulnerable
  to
  threats
  like
  malware,
  DDoS
  attacks,
  and
  crypto
  mining.
• 
  Maintaining/deploying
  EDR:
  Finally,
  with
  agent
  based
  EDR
  products,
  it
  can
  be
  a
  huge
  burden
  for
  security
  teams
  to
  install
  and
  maintain
  agents
  on
  every
  endpoint
  across
  the
  enterprise
  network
  environment.

Closing
EDR’s
Security
Gaps
with
Network
Visibility
and
NDR

One
of
the
most
effective
ways
to
close
the
security
gaps
highlighted
above
is
by
adding
Network
Detection
and
Response
(NDR)
to
the
enterprise
cybersecurity
stack
for
the
following
reasons:

• 
  Cannot
  disable
  NDR:
  As
  a
  log
  data
  based
  NDR
  such
  as
  
  ExeonTrace
  collects
  data
  from
  multiple
  different
  data
  sources
  in
  the
  network
  (and
  does
  not
  rely
  on
  specific
  devices),
  the
  detection
  algorithms
  cannot
  be
  circumvented.
  Therefore,
  even
  if
  an
  EDR
  is
  disabled
  by
  malware,
  the
  NDR
  will
  detect
  it.
• 
  Identification
  of
  shadow
  IT:
  An
  NDR
  solution
  not
  only
  allows
  to
  monitor
  the
  network
  traffic
  between
  known
  network
  devices
  but
  also
  identifies
  and
  monitors
  yet
  unknown
  devices
  and
  networks.
  And
  of
  course,
  also
  endpoints
  without
  EDR
  agents
  are
  included
  in
  the
  network
  analytics
  (such
  as
  BYOD).
• 
  Misconfigured
  firewalls
  and
  gateways:
  Unproper
  configured
  firewalls
  and
  gateways
  can
  be
  entry
  doors
  for
  attackers
  –
  an
  NDR
  allows
  for
  detection
  before
  exploitation.
• 
  Tamper-proof
  data
  collection:
  Network-based
  data
  collection
  is
  more
  tamper-proof
  than
  agent-based
  data;
  ideal
  for
  digital
  forensics
  required
  by
  regulators.
• 
  Complete
  visibility
  of
  the
  whole
  network:
  As
  no
  agents
  are
  required,
  an
  NDR
  solution
  such
  as
  ExeonTrace
  allows
  for
  complete
  visibility
  of
  all
  network
  connections
  and
  data
  flows.
  It
  thus
  provides
  greater
  visibility
  across
  the
  entire
  enterprise
  network
  and
  any
  potential
  threats
  across
  it.

Conclusion

As
organisations
become
increasingly
complex
and
add
more
end-user
devices
to
their
networks,
they
require
a
reliable
monitoring
solution
to
protect
their
endpoints
from
potential
threats.
However,
Endpoint
Detection
and
Response
(EDR)
provides
such
endpoint
protection
only
to
a
certain
extent.
There
are
numerous
drawbacks
of
EDR
that
allow
sophisticated
cybercriminals
to
surpass
their
security
perimeter
and
exploit
network
vulnerabilities.

ExeonTrace Platform: Screenshot of Dashboard

To
fill
the
security
gaps
left
by
EDR
solutions,
organisations
must
reinforce
their
security
defences.
Network
Detection
and
Response
(NDR)
solutions
like
ExeonTrace
are
a
reliable
and
proven
way
to
monitor
network
traffic
and
thus
complete
enterprise
cybersecurity
stacks.
As
EDR
and
NDR
solutions
are
complementary,
their
combined
detection
capabilities
can
effectively
protect
organisations
from
sophisticated
cyberattacks.

Book
a
free
demo
to
discover
how
ExeonTrace
can
help
address
your
security
challenges
and
make
your
organisation
more
cyber
resilient.