Endpoint protection: Securing the pieces that make up the whole

The network perimeter has essentially vanished as federal agencies transition to cloud platforms and step up efforts to support a more mobile and distributed workforce. Cyber defenses must now start at the endpoint.

To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, President Joe Biden’s Executive Order on Cybersecurity mandates federal civilian executive branch agencies deploy endpoint detection and response (EDR) initiatives “to support proactive detection of cybersecurity incidents within federal government infrastructure, active cyber hunting, containment and remediation, and incident response.”

As background, EDR solutions provide continuous and comprehensive real-time visibility into what is happening on an organization’s endpoints -- including desktops, laptops, mobile phones, servers, tablets, and virtual environments -- or any remote device that is connected to and communicates with a network. By applying behavioral analysis and actionable intelligence to endpoint data, EDR solutions can stop an incident from turning into a breach.

That said, agencies must get the most out of their EDR investments and avoid becoming overwhelmed by high volumes of alerts. If configured and tuned properly, agencies can derive immense value from EDR. To do so, agencies should take these four steps:

1. Apply the widest range of coverage

The effectiveness of EDR technology depends on where it is deployed within an IT and network infrastructure. Agencies cannot deploy security to critical servers and leave employee workstations and laptops uncovered. As incident responders are quick to point out to victims, “No threat actor just lands on a domain controller or the file server where all the sensitive IP is stored.”

Attackers typically target an employee’s laptop or access a network through an unsecure remote desktop protocol (RDP) connection, using a set of user access credentials. They then move laterally through the environment and eventually land on critical infrastructure that they compromise. Ensuring that an agency’s EDR technology is configured for the widest possible coverage across endpoints is critical.

2. Properly configure and test preventions and security controls

Agency cyber defense teams must understand the configuration of their EDR platform. They must ensure they have the correct policies, preventions and controls configured and tested within their environments. Additionally, they must be certain their EDR platform is providing the best possible visibility and preventive controls based on the threats and sensitivity of the data in their environment.

3. Operationalize technology and a skilled workforce

Having EDR is necessary in today’s threat environment. However, if an agency has not operationalized it -- meaning, it has not provided the skilled personnel and processes to monitor and respond to alerts that come up in the user interface for that technology and do it faster than adversaries -- then the outcomes will not be aligned to the investments made. Consequently, it is essential to apply human-skilled resources to help monitor and respond quickly to alerts and the EDR’s visibility data, as well as the infrastructure impacted by threat activity, before adversaries can pivot deeper into the environment or carry out their objectives.

4. Deploy threat hunting for proactive security

The Cyber EO emphasizes the need for agencies to accelerate incident deterrence, prevention and response efforts and enable more effective defense of agencies’ systems and information. Threat hunting, an often misinterpreted and ineffectively deployed methodology, is a practice in which security teams proactively search for cyber threats lurking undetected in a network. Cyber threat hunting digs deep into an environment to find malicious actors that have slipped past initial endpoint security defenses (the needle in the stack of needles). 

Most organizations building a threat hunting capability might run a hunting exercise against their infrastructure once a month or a couple times a quarter. That is a good start. However, adversaries are not working Monday through Friday from 8 am to 4 pm. Their activities happen after hours or on weekends, such as the ransomware attack that targeted organizations using Kaseya VSA remote management software ahead of the July 4th holiday weekend.

Threat hunting must be consistent and performed at scale with skilled resources. It requires rich visibility and telemetry from the endpoints being protected 24/7, 365 days a year. To be effective, a robust threat hunting capability should have some level of automation and must provide cyber teams with rich analysis across a variety of telemetry culled from multiple data sources and a wide range of global users. Such a rich dataset enables an agency to see events quickly and at scale to determine if an incident is due to normal administration or user behavior versus an actual threat activity. Again, the threat hunting service should be equipped to find the needle in the haystack of needles.

Going forward: Visibility is key 

Visibility across an agency’s portfolio of assets is key to stopping breaches. If an agency does not know something bad is going to happen, the cyber team cannot stop it. If properly tuned and configured, EDR solutions that incorporate AI and machine learning capabilities, threat hunting at scale and vulnerability management for IT hygiene can help agencies stop known and unknown threats in real-time – a clear reason it is included in the Cyber EO.