Cyber-attacks, far from abating, have become more complex and sophisticated over the years. The traditional method of protecting the network perimeter is futile in today’s remote working and BYOD work environment. Enterprising attackers exploit out-of-date software on employee phones to compromise the network. Likewise, signature-based antivirus is passé owing to the sheer number and types of unknown attacks. Cyber attackers create nearly one million threats daily. These attacks assume many forms, from malware to social engineering, from ransomware to Intellectual Property pilferage, and much more.

Countering such enhanced threat levels requires a fresh approach to security.

Next-Generation endpoint security solutions focus on monitoring of attacker tactics, techniques, and procedures (TTP) and deliver real-time response capabilities. These tools use data science, predictive analytics, and threat intelligence to prevent many attacks. These methods are a big improvement over the conventional signature-based approach and focus on the network perimeter. This tech blog explains the key features of these next-generation endpoint security solutions.

The Three Pillars of “Next Generation” Endpoint Security

The next-generation endpoint security solutions protect endpoints connected to the network and not just the devices within the enterprise firewall. It offers a three-layer defence, comprising advanced behavioural analysis, cloud intelligence, and digital forensics.

Behavioural analysis:

Traditional tools focus on protecting the perimeter or defending against attacks. The next-generation endpoint security tools focus on analyzing the running processes in each network endpoint. It makes a deep inspection of each file to identify suspicious behaviour.

The suite applies deep learning technology to analyse event streams and identify malicious intent. It seeks out indicators of attack.

Smart endpoint security suite:

• Detects changes in files, processes, registries, and network connections, to flag anomalies. 
• Monitors and analyses how applications and processes interact with each other, to learn how one action relates to another, and identify suspicious relationships. For instance, it sees if an application tries to open or read an “inappropriate” file or send information to unverified websites. 
• Detects programs infiltrating the registry, changing names, or opening unauthorized connections outside the firewall, to unearth threats.
• Takes cognizance of the individual stages of sophisticated, multi-layered attacks, for proactive countermeasures.

On detecting anomalies, the suite triggers an alert and applies the set remedial action. 

The exploit mitigation technology recognizes the script technologies of the attacker and blocks it. For instance, a malicious Microsoft Excel document trying to modify registry keys on a Windows computer triggers an alert and an automatic block on the activity.

Legacy signature-based antivirus suites could not process ambiguities. Several legitimate programs look suspicious at first glance, and several viruses seem legit initially. The latest security suites use the sandbox to overcome such deceptions. The security suite replicates the software in a “sandbox” or a secure, isolated digital environment to observe the programs’ behaviour, before allowing it to run in the normal environment.  Sandboxing repels zero-day attacks and advanced persistent threats.

Remediation works in many ways. Bufferzone creates a virtual container around any applications deemed insecure. It segregates the network into trusted and untrusted domains and creates a virtual sandbox around the untrusted files, registries and network access. Other vendors, such as Barkly and SentinelOne install agents or sensors at the endpoint and filter traffic through proprietary behavioural analytics.

Cloud Intelligence:

The cloud makes resource-intensive streaming analytics seamless.

Artificial Intelligence (AI) powered analytics gathers information from millions of malware samples, to spot cyber-attack patterns even as it develops.

Cloud-based next-generation endpoint security suites, with bi-directional communication to endpoints, deploy advanced techniques such as deep convolutional neural networks to enhance malware detection models. The analytics compare normal and abnormal endpoint activity to unfiltered historical endpoint data

Several security vendors, such as Cisco and Palo Alto Networks offer unified security intelligence feeds collected from their firewalls across their worldwide customer base. Such cloud-based global threat monitoring systems analyse event streams and compare them to normal endpoint traffic.

The contextual analysis offers some spin-off benefits, such as insights on network performance, to improve network administration.

Digital Forensics:

The period after an attack is critical to understand the breach. The digital forensics capabilities capture the detailed attack path for follow-up action. It seeks the indicators of compromise (IOCs), present after the attack.

Intuitive suites present the display data in a simple, graphical format, comprehensible even to non-professionals. Replaying attacks help investigators understand the nature of the breach, to make structural changes, or go after the perpetrators.

State-of-the-art endpoint detection capabilities contain identified threats and block emerging attacks, including zero-day attacks that slip through most antivirus suites. The real-time response and remediation foil the best-laid plans of attackers.

A Ponemon study estimates that it takes 170 days to detect an advanced attack, 39 days to contain it and 43 days to remediate it. In contrast, Avast’s new machine learning pipeline trains and deploys malware-detection models within 12 hours.

Other Capabilities

Most next-generation endpoint security suites come with several other features and capabilities, to deliver comprehensive security solutions. These suites:

• Offer effective patch management solutions to keep software up to date. In most cases, exploits take place through known, but unpatched vulnerabilities.
• Cache copies of files before execution, to protect against ransomware and other malicious payloads.
• Continue to use signature and hash matching to detect malicious files. Only that it goes beyond such basic capabilities.

As cyber-attacks continue to evolve, so does endpoint security. Traditional antivirus suites were reactive. The next-gen endpoint security leverage cutting-edge technologies such as artificial intelligence, deep learning, and behavioural analysis to stay one step ahead of cybercriminals. It keeps pace with the lightning speed in which cyber-attacks strike, and remediates attacks rather than just stopping it.