With enough motivation, time and resources, adversaries eventually devise a way to get through an organization’s defenses. Unfortunately, when that occurs, most security products “fail silently,” unable to detect, let alone alert you on the intrusion. This can allow an attacker to freely roam around your environment for weeks and even months. This situation may be aggravated by a lack of visibility, security resources and expertise. Endpoint detection and response (EDR) is the most promising solution for addressing this challenge. At a primary level, EDR products record the activities and events taking place on endpoints, providing security teams with the visibility they need to uncover incidents that would otherwise remain invisible. Even though the basic concept may sound simple, EDR comes in a wide variety of implementations that can vary greatly in scope and efficacy. This is captured in what CrowdStrike ® calls the EDR Maturity Model, a model that encompasses both the evolution and capabilities of EDR solutions. The model, which is outlined in this white paper, can be used as a guide to furthering your understanding of EDR, where it fits in a robust security strategy and ultimately, what is involved in maturing EDR capabilities so that your organization can derive the greatest benefit. Toward that end, it is crucial to find an EDR solution that provides the highest level of protection while requiring the least amount of effort and investment, adding value for the security team without adding additional burden.
Endpoint Detection and Response: Automatic Protection Against Advanced Threats
