01/12/2021 - Laserfiche WebLink

Home Browse Search

r aJ r� -i FI INDIAN RIVER COUNTY, FLORIDA MEMORANDUM TO: Jason E. Brown, County Administrator L DEPARTMENTAL FROM: Dan Russell, Information Technology Director SUBJECT: End Point Protection (EPP) / End Point Detection & Response (EDR) and Managed Detection & Response Procurement Recommendation DATE: January 12, 2021 BACKGROUND: On October 22, 2020, the Indian River County (IRC) Board of County Commissioners (BoCC) network was the target of a cyber -attack. Fortunately, the IRC Information Technology (IT) Department staff discovered the attack in progress and were able to successfully mitigate the attack with no loss of data. The IRC BoCC staff did experience a limited, self-imposed, loss of certain technology services while a forensic investigation was conducted to ensure that any unauthorized access to the network was eradicated. Subsequent to completing the forensics investigation, the IRC IT staff examined the attack vectors that were deemed contributory to the attack and determined that the current end point protection (EPP) & anti-virus (AV) software should be upgraded to assist with detection and response to future cyber -attacks. ANALYSIS The EEP & AV software currently in use is signature based. This type of anti-virus software relies upon pre -distributed malware signatures to detect anomalous computing or network behavior. Signatures are updated on a recurring basis; however, the detection capabilities of this type of legacy software are limited to known malware attacks and do not provided protection against new or previously unknown malware attacks. Cyber criminals are constantly innovating the techniques used to conduct their attacks. Legacy AV software is inherently disadvantaged when it comes to detecting attacks for which signatures have yet to be developed. Next generation (Nextgen) EEP & AV software solves this dilemma via the additional of Extended Detection & Response (EDR) functionality. EDR is an integrated end point security solution that combines real-time continuous monitoring and collection of endpoint data with rules -based automated response and analysis capabilities to enable cyber security teams to quickly identify and respond to threats. The primary functions of an EDR security system are to: 1. Monitor and collect activity data from end points that could indicate a threat. 2. Analyze that data to identify threat patterns. 3. Automatically respond to identified threats to remove or contain them, and to notify cybersecurity personnel. 4. Provide forensics and analysis tools to search for/research suspicious activities. EDR tools work by monitoring endpoint and network events and recording the information in a central database where further analysis, detection, investigation, reporting, and alerting take place. A software agent installed on the host system provides the foundation for event monitoring and reporting. Most EDR tools address the "response" portion through sophisticated analytics that identify patterns and detect anomalies, such as rare processes, strange or unrecognized connections, or other risky activities flagged based on baseline comparisons. This process can be End Point Protection (EPP) / End Point Detection & Response (EDR) and Managed Detection & Response Procuremept4 Recommendation b