Due to advancements in technology, using more than one device from many different places is more of a reality than it ever was before. However, this also means that there are more strategies that can be used to steal or change invaluable information than ever before. Nearly anything connected to a network has the potential to be a gateway for an attacker. Maintaining security at a company level can be challenging, but micromanaging everything a user can accomplish on their personal devices that they may also use for work is near impossible.
Luckily, the solution isn’t removing or banning tablets, laptops, phones, or other devices. One option that various organizations have used are Managed Service Providers (MSPs). These are third-party companies that remotely manage a customer’s information technology (IT) infrastructure and end-user systems. Regarding MSPs, you’ll hear two solutions discussed frequently as solutions to protect the end user: Anti-Virus (AV) and Endpoint Detection and Response (EDR). Both offer benefits to clients but as the lines between the two blur, it can be difficult to know the difference between the two.
Either – Not Both
While there is debate on whether separate EDR and AV should be used simultaneously, it is often noted that running both may not be practical since they’ll each use up resources. When deciding between the two, it’s important to consider several factors; This can include the type of business in need of protection, who the end users are, the short-term/long term pricing, among others.
Malware
Malware (short for “malicious software”) is an inclusive term for files or codes that infect, explore, steal, or otherwise conduct virtually any behavior an attacker wants on a device. Due to the wide number of variants, there are numerous methods for various devices.
Despite how varied Malware can be, they usually follow some common goals:
- Allow an attacker access to an infected machine.
- Send unwanted messages from infected devices.
- Stalk and manipulate a user’s local network.
- Steal sensitive data.
AV Solution
AVs are generally a single program which serve basic purposes like scanning, detecting, and removing malware. They accomplish this by comparing files against a known database of “bad” files. When a file is discovered in the database, it is usually moved to a safe location until a user decides to fully remove it or restore it if it was a mistake.
EDR Solution
AVs are generally a single program which serve basic purposes like scanning, detecting, and removing malware. They accomplish this by comparing files against a known database of “bad” files. When a file is discovered in the database, it is usually moved to a safe location until a user decides to fully remove it or restore it if it was a mistake.
Comparison
It should be noted that several EDR vendors incorporate AV detection methods with EDR. Other EDR solutions from other vendors may specifically only function as threat hunting or digital forensic tools. Thus, they have complete behavior monitoring of the systems but no AV detection methods. Despite their limitations when deployed alone, AVs can be useful compliments to EDR solutions. Below are some key differences between the two:
Antivirus uses database signatures which contain malware information such as hashes of the file, name, certain code signatures in the virus functionality, etc. This makes them more simplistic and limited in scope compared to modern EDR systems. EDR scans the processes and methods a file is interacting with the OS. By doing this, it sets a baseline to see if a behavior is malicious or not. EDR may also contain many security tools like firewall, whitelisting tools, monitoring tools, and other tools to provide comprehensive protection against digital threats.
AVs usually just detect and delete malware if it is found in its signature database. EDR can accomplish much more. It can remediate the actions of the virus/malware because it monitors the endpoint processes and behaviors. Certain techniques can even be reversed. However, to take advantage of EDR’s benefits, you usually have to adjust security policies to be really strict. Compared to database signatures, EDR needs more effort to optimally perform. However, AVs are more of a decentralized security system which can become difficult to scale. EDR provides centralized security which can make it easier to manage more users.
Conclusion
As technology continues to improve, so do the determination and techniques of cybercriminals. Unless one wants to be their next victim, we need to stay a few steps ahead of them. AVs are a cheap and fairly simple starting point, but EDR security systems are much better equipped at handling evolving cyber threats.
