01/12/2021 - Laserfiche WebLink

Home Browse Search

automated so that anomalies trigger alerts for immediate action or further investigation. Many endpoint detection and response tools also allow for manual or user -led analysis of data as well. New features and services are expanding EDR solutions' ability to detect and investigate threats. For example, third -party threat intelligence services increase the effectiveness of endpoint security solutions. Threat intelligence services provide an organization with a global pool of information on current threats and their characteristics. That collective intelligence helps increase an EDR's ability to identify exploits, especially multi -layered and zero -day attacks. Many EDR security vendors offer threat intelligence subscriptions as part of their endpoint security solution. Additionally, new investigative capabilities in some EDR solutions can leverage Al and machine learning to automate the steps in an investigative process. These new capabilities can learn an organization's baseline behaviors and use this information, along with a variety of other threat intelligence sources, to interpret findings. Another type of threat intelligence is the Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) project underway at MITRE, a nonprofit research group that works with the U.S. government. ATT&CK is a knowledgebase and framework built on the study of millions of real-world cyberattacks. ATT&CK categorizes cyberthreats by various factors, such as the tactics used to infiltrate an IT system, the type of system vulnerabilities exploited, the malware tools used; and the criminal groups associated with the attack. The focus of the work is on identifying patterns and characteristics that remain unchanged regardless of minor changes to an exploit. Details such as IP addresses, registry keys, and domain numbers can change frequently. But an attacker's methods— or "modus operandi" -usually remain the same. An EDR can use these common behaviors to identify threats that may have been altered in other ways. In preparation for making this recommendation, the IRC IT staff reviewed a number of EPP and EDR tools from various suppliers. The list software products considered for recommendation was reduced to the list below because these particular products each met all of the criteria of an EDR solution, as described above. 1. Sentinel One; 2. Carbon Black; 3. Crowdstrike; 4. GreyMatter; 5. Rapid7; 6. Secureworks Of the products reviewed the Sentinel One EPP & EDR product was deemed to best meet the County's requirements based on a combination of functionality and price. As previously noted, it is possible to automate the EDR system response to many, but not all, of the alerts generated by end points. The EDR system must be actively monitored to ensure that all alerts are responded to appropriately. The IRC IT staff considered three options for monitoring the EDR system. 1. Monitor the EDR system with IRC IT Staff 2. Managed Detection and Response (MDR) through a professional services supplier 3. MDR & prepaid.cyber Incident Response (IR) through a professional services supplier The options above are presented in order of risk reduction with option #1 carrying the most risk and option #3 the least. They are ordered in a good, better, best format. Option #1 - using the IRC IT staff to monitor the EDR system is the option that carries the most residual risk as the IRC IT staff is not staffed to provide 24 x 7 monitoring support and does not specialize in cyber incident detection and response. Option #2 - using an MDR service through a supplier reduces this risk by providing 24 x 7 monitoring and response provided by cyber security professionals that perform this function daily and as such are intimately familiar with current and evolving cyber -attack techniques. Option #3 - using an MDR supplier to perform monitoring & detection and prepaying for cyber incident response (IR) support has the added benefit of having a cyber incident response team available to support immediately upon detection of a cyber breach End Point Protection (EPP) / End Point Detection & Response (EDR) and Managed Detection & Response ProcuremeA� Recommendation U