Management, compliance & auditing

Comparing endpoint security: EPP vs. EDR vs. XDR

What are EDR, EPP and XDR?

What is EDR?

Endpoint detection and response is a type of security solution that provides real-time visibility into endpoint activities by monitoring and recording endpoint data, detecting suspicious behavior and responding to threats. EDR solutions store, enrich and consolidate endpoint data to prime it for manual analysis by security teams and proactive threat remediation. 

Threats such as fileless attacks and advanced persistent threats threaten to wreak havoc on company and organization networks, and an EPP solution alone cannot deal with these skilled attacks. 

There are both open source and commercial options available for EDR solutions. Commercial vendors like Symantec and Cynet are best suited to EDR security and protection for the enterprise; however, open-source is a more cost-effective choice for non-profit organizations and government bodies. 

What is EPP?

An endpoint protection platform (EPP) is a solution deployed on endpoint devices to prevent file-based malware attacks, detect malicious activity and provide the investigation and remediation capabilities needed to respond to dynamic security incidents and alerts.

Detection capabilities will vary, but advanced solutions will use multiple detection techniques, ranging from static IOCs to behavioral analysis. Desirable EPP solutions are primarily cloud-managed, allowing the continuous monitoring and collection of activity data, along with the ability to take remote remediation actions, whether the endpoint is on the corporate network or outside of the office. In addition, these solutions are cloud data-assisted, meaning the endpoint agent does not have to maintain a local database of all known IOCs but can check a cloud resource to find the latest verdicts on objects that it is unable to classify.

What is XDR?

XDR is a method of gathering and automatically correlating information across several security layers to enable rapid threat detection. It monitors threats across different sources or locations within an organization.

Attacks can tuck in between security silos created as a result of disconnected solution alerts and gaps during security triaging and attack investigations. These successfully remain hidden because of the disconnected and limited attack viewpoints of most security analysts.

XDR eliminates security silos through a comprehensive and holistic detection and response strategy. It collects information and matches the relationships of deep activity data across many security layers including those configured for endpoints, servers, emails, cloud and workloads. Automated analysis of various data is undertaken to detect threats faster and for security analysts to have enough time to conduct thorough investigations.

EPP vs. EDR solutions

EPP solutions detect signatures and other attributes that indicate an intrusion of known threats. EDR solutions add an extra layer of defense by using threat-hunting tools for behavior-based endpoint threat detection. 

EDR does not make EPP a redundant security tool, even though EDR might sound like a more powerful solution. Organizations that need robust endpoint security measures should take the holistic approach that covers traditional and advanced security threats. 

Both EPP and EDR require aspects of each other’s functionality to be considered a holistic endpoint security solution. As a result, the endpoint protection market has become somewhat vague. This has led to EPP vendors adding EDR capabilities to their product and vice versa. 

EDR requires active investigation and analysis by security experts to properly respond to threats. In contrast, EPP software runs with minimal supervision needed after its initial installation and configuration.

These two types of endpoint protection systems complement and not replace each other. Modern organizations and enterprises should combine both in their cybersecurity strategy. 

XDR vs. EDR

XDR provides the evolution of detection and response beyond the current point-solution, single-vector approach.

Clearly, endpoint detection and response (EDR) has been enormously valuable. However, despite the depth of its capability, EDR is ultimately restricted because it can only look at managed endpoints. This limits the scope of threats that can be detected as well as the view of who and what is affected and thus, how best to respond.

Likewise, Network Traffic Analysis (NTA) tools’ purview is limited to the network and monitored network segments. NTA solutions tend to drive a massive amount of logs, so the correlation between network alerts and other activity data is critical in order to make sense and drive value from network alerts.

The industry has made great strides in detection and response, but to date, capabilities have been delivered via an individual solution and security layer; thus, data collection and analysis benefits have remained siloed. XDR evolves detection and response into a consolidated, centralized activity that delivers results that are greater than the sum of the parts.

XDR: The future of EDR

When it was published in 2011, Lockheed Martin paper introduced information security professionals to the concept of the intrusion kill chain. The concept was simple — and brilliant. Instead of randomly placing security controls at various points on a network and hoping adversaries would trip over them like landmines and barbed wire on a battlefield, enterprises could put prevention controls at every place in the attack chain that they knew the adversaries had to travel to succeed in their mission.

Endpoints were one of many links in the attack chain. A few years ago, EDR — endpoint detection and response — emerged as another network defender tool in the attack chain. Think of EDR like an old-style VCR; a way to record what happened to the endpoint in case a hacker compromised it in the same way you would record old movies for later review. Network defenders could use EDR in their incident response procedures to determine what the hacker did to take control.

XDR expanded the EDR idea. If you can record what happened on the endpoint, why couldn’t you record everything on the intrusion kill chain for later review? If you did it correctly, XDR would give you complete visibility at every phase of the intrusion kill chain to include the end point. It is EDR ++.

When a security platform integrates XDR, it gives enterprises the ability to monitor and account for every change in the intrusion kill chain, no matter where it originates. And this is happening not a moment too soon, as traditional network perimeters have splintered into multiple data islands: employee computing devices like smartphones, tablets and laptops, data centers run by the company, a raft of SaaS services like Salesforce and Gmail, a hybrid collection of IaaS services from the likes of Amazon, Microsoft and Google, and yes, we still have a perimeter or traditional office space.

If you’re a business executive or a board member without a graduate degree in cybersecurity, you may be wondering why XDR might impact business operations. Let’s break it down:

• XDR reduces the probability of a material impact on an organization due to cyberthreats.
• It does so by taking the intrusion kill chain to its logical extension by including all data sources in the cybersecurity ecosystem, not just traditional endpoints.
• It is implemented as a platform, rather than as an individual product you buy from a vendor and install on your network, making it easier to deploy, upgrade, extend and manage.
• It reduces the need for widespread training and additional certifications for your already-overworked infosec team and SOC analysts.
• By creating a wider lens with real-time views of adversaries’ movements, it dramatically improves cybersecurity agility in a time when cyberthieves are getting smarter and more collaborative.