Taking Your Endpoint Security to the Next Level

This chapter is about taking your endpoint security to the next level. We’ve covered the basics in Chapters 1–10. You know you need an antivirus and VPN. In this chapter, we’ll get into more advanced topics while demystifying EDR, MDR, and XDR. Next, we’ll cover zero trust and how it’s not all about buying a new product. Later in the chapter, we’ll talk about some more advanced cloud tools.

In this chapter, we’re going to cover the following main topics:

• Endpoint detection and response (EDR) – Focusing on the “R”
• Managed detection and response (MDR)
• Extended detection and response (XDR)
• Cloud security posture management (CSPM)/Cloud-native application protection program (CNAPP)
• Zero trust vs. software-defined perimeter
• DNS protection

Endpoint detection and response (EDR) – Focusing on the “R”

We already covered the latest advanced antivirus and anti-malware, which is called endpoint detection and response (EDR), in Chapter 5. It takes the traditional antivirus to the next level. Products such as CrowdStrike, SentinelOne, and MalwareBytes’ ThreatDown will sell the products based on multiple levels. Each level offers more protection, with the “R” actually providing your company with a 24/7 help desk for your employees’ endpoints. The help desk is there to provide you with help in the event of an endpoint-related incident and to get your endpoints back online. If an employee downloads malware or ransomware, then the help desk will help you recover the laptop and get back online. In some cases, the “R” acts as a remote Security Operation Center (SOC) for your company. Remember, when protecting your endpoints, this doesn’t just include your employee...

Managed detection and response (MDR)

MDR is essentially a virtual SOC. If your company doesn’t have a SOC, or even if it does, having an MDR solution is useful. Now, you have a remote SOC that is monitors threats across the globe, as well as the EDR clients on your network. When an alert is sent, the remote SOC analyst reviews the alert and determines whether it is a false positive. Once it is determined that the threat is not a false positive, then the team will reach out to your company and either guide your own IT security team in how to address the issue or remediate the issue.

MDRs offer several advantages:

• They provide 24/7 coverage, which can be complex and costly to implement in-house
• They possess expertise that may not be available internally
• They must handle the high turnover rates of their cybersecurity analysts
• They can distribute the costs of expensive security tools across all their clients
• They can oversee your log retention needs
...

Extended detection and response (XDR)

XDR is a product, typically a SaaS, that takes all of your vulnerability and threat data plus alerts and analyzes this with machine learning (ML) and artificial intelligence (AI). Most XDR services combine EDR as part of the service. Typically, the XDR will analyze the logs from EDR clients. The XDR will filter through the alerts, reducing false positives and allowing your SOC and security teams to focus on actual incidents. Typically, XDR is bundled as part of the response for the EDR.

SOAR

SOAR, which stands for security orchestration, automation, and response, is a cybersecurity solution that automates and streamlines security operations. It integrates various security tools and systems, typically the EDR/XDR, allowing for more efficient and effective incident response and threat management.

The core components of SOAR include orchestration, automation, and incident response. Orchestration connects different tools and systems to allow...

Cloud security posture management (CSPM)/Cloud-native application protection program (CNAPP)

CSPM and CNAPP tools are essentially the same. CSPM was the first name for these products, and then CNAPP became the way to describe the same tools. CSPM provides compliance with secure configurations such as the Center for Internet Security (CIS) or Security Technical Implementation Guide (STIGS). Some also provide compliance with regulatory frameworks and standards such as NIST, PCI, and ISO. Depending on the product, review the specific features it provides. Other features include exposure and vulnerability management. CNAPP takes all of the CSPM features and adds to them, such as infrastructure-as-code (IaC) scanning. Again, with all of the hype, I think CNAPP was a way to differentiate from all the other cloud security tools. You should do a product evaluation with at least three products, comparing the features and cost. I have included a product evaluation template at https://trustedciso...

Zero trust vs. software-defined perimeter

Zero trust is the latest and greatest security defense. You don’t have to purchase a new product to reap the benefits. Zero trust originated from highly classified networks in the Federal Government. Software-defined perimeter and zero trust are the same thing. In a software-defined perimeter, every asset sits behind a remote access gateway. To gain access to the asset, a user, service, or other device has to authenticate with their assigned X.509 certificate and is only granted with the specific authorization required (principle of least privilege). The Cloud Security Alliance has done an amazing job at demystifying zero trust, also known as SDP. Following their lead, I will explain what zero trust is and how to implement it in your company. You probably already have some zero trust features and functionalities implemented in your company and may not realize they are considered to be zero trust. In a nutshell, zero trust is mutual authentication...

Summary

In summary, taking your security program to the next level includes the visibility of your network and implementing advanced security measures such as zero trust. It boils down to using tools, such as CSPM/CNAPP, to continuously monitor your cloud and obtain alerts in the event of a misconfiguration or unintended exposure. Implementing zero trust is a journey that you may have already started. Remember, at the most basic level, it is about enforcing mutual authentication and assigning X.509 certificates to all devices, servers, and users. Every device, service, and user is considered untrusted until authenticated and authorized with fine-grained access controls.

In the next chapter, we will be covering creating a secure configuration baseline. We will discuss the importance of creating a secure configuration baseline and selecting a compliance framework to keep the attackers out.