Is Endpoint security dead? The future of corporate security

Introduction Computer Forensics Consult/Specialists is an Cyber security consultancy firm founded in 2004. Areas of focus include Digital Forensics Security Audits Compliance, Policy and Risk Advisory Cyber Intelligence, Defense and Offense Cyber Security R&D

Cyber Security vs Information Security Our approach to security is greatly influenced by how perceive use and engage with these two terms Information Security (INFOSEC):ISO/IEC 27000:2009 2.33 Information security - preservation of confidentiality, integrity and availability of information. Cyber security (CYBERSEC): ITU-T X.1205 Cybersecurity is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user’s assets.

What is Endpoint Security Endpoint security or Endpoint Protection is a technology that takes an extra step to protect computer networks that are remotely bridged to users' devices. The use of laptops, tablets, mobile devices and other wireless gadgets connected with corporate networks creates vulnerability paths for security threats. Endpoint security attempts to ensure that such devices follow a definite level of compliance and standards

Endpoint protection approach to Security Endpoint security systems operate on a client–server model with the security program controlled by a centrally managed host server pinned with a client program which is installed on all the network drives. There is the software-as-a-service (SaaS) model, the security programs and the host server are maintained remotely by the merchant. The contribution from both the delivery & model is that the server program verifies and authenticates the user login credentials and performs a device scan to check if it complies with a designated corporate security standards prior to permit network access.

Common Endpoint Security Techniques Organizations can leverage a number of techniques and technologies as part of their endpoint security, including: Personal firewalls Individual credential management Two-factor authentication Device and network-level anti-virus software. These can include the use of behavior-block and monitoring components that examine devices for actions typically carried out by rootkits to pinpoint an infection. However, the backbone of these processes is the central server that controls access to the network and the sensitive content present there.

People, Processes & Technology

People, Processes & Technology People. A strong people strategy is the heart of an effective change- management initiative. Start with setting a consistent vision for the security and operations teams. Process. Processes need to be reviewed in light of the shared goals and objectives. Technology. It’s vital that a technology be selected only after the people and process issues have been solved, and only after a comprehensive evaluation of the needs of all stakeholders.

Challenges facing an Endpoint Security approach False sense of security Believing that endpoint security products can keep endpoints secure with technology, and therefore skimping on actual security policies, procedures, and training. “No technology can deliver security if people undermine it” – Joseph Steinberg Complex endpoints Endpoint protection is becoming more complex in its application due to the broadening of many company BYOD policies and the increasing number of employees and authorized users being allowed to log in remotely to corporate networks Resources being accessed are also increasingly more complex. The driving force for this is to keep the worker/employee most productive thus availing any and all resources needed for them to succeed in that.

Challenges Connectivity Blind to fraud Blind to complex threats Endpoint security solutions demand continuous or frequent connectivity for update, upgrade and maintenance cycles. Thus makes lack of connectivity a risk which, depending on the market may be a big issue. Blind to fraud Because of the Technology centric approach of Endpoint Security, this makes the system blind to risks emanating from the other areas such as people and processes. Blind to complex threats More and more it is being found that antivirus products can take months before adding the algorithms to recognize the more complex threats, leaving endpoints unprotected. Technology centric as opposed to people &/or process centric Good security is a balance of People, processes and technology, focusing on one at the expense of the others is a mistake

So, is Endpoint Security dead? The ‘antivirus’ is a very basic defense with limited ability to handle sophisticated cyber-attacks and advanced persistent threats.  This also underscores why Endpoint Management has become a specialized discipline, and needs to be integral to a company’s overall security infrastructure. The ‘antivirus’ is particularly adept at handling known threats, but endpoint security is needed for post-incident detection and remediation with the understanding that problems, i.e. hackers, viruses, malware, etc., will eventually find their way into a network

Intelligence based security Incorporating Big Data into Cyber security Threat Intelligence not Information INFORMATION INTELLIGENCE Raw, unfiltered data Processed, sorted, and distilled information Unevaluated when delivered Evaluated and interpreted by trained expert analysts Aggregated from virtually every source Aggregated from reliable sources and cross correlated for accuracy May be true, false, misleading, incomplete, relevant, or irrelevant Accurate, timely, complete (as possible), assessed for relevancy

Endpoint Security evolution Defense in depth - The principle of defense-in-depth is that layered security mechanisms increase security of the system as a whole. If an attack causes one security mechanism to fail, other mechanisms may still provide the necessary security to protect the system. Endpoint Security still has its place however because if its risk to give a false sense of security make it a less than ideal solution to take up ALONE in cyberspace today. Endpoint security in itself is in a transition incorporating the other dimensions like processes and people making newer solutions that take an approach from these angles more viable