01/12/2021 - Laserfiche WebLink

Home Browse Search

01/12/2021 12.E.1. Terminology • AV = Anti -Virus • Signature based malware detection software • EPP = End Point Protection • General term used to describe software products that are used to protect workstations and servers against cyber threats (e.g. anti-virus, host based firewall solutions, etc.) • EDR = Extended Detection &'Response • Software tools primarily focused on detecting and investigating suspicious activities (and traces of such) on hosts/endpoints • IR =Incident Response • A structured process used by organizations to detect and respond to cybersecurity incidents • MDR = Managed Detection & Response • An outsourced service that provides organizations with threat hunting services and responds to threats once they are discovered 1/12/2021 12.E.1. Current EPP & AV Solution 0 • The EEP & AV software currently in use is signature based • This type of anti-virus software relies upon pre -distributed malware signatures to detect anomalous computing or network behavior • Signatures are updated on a recurring basis; however, the detection capabilities of this type of legacy software are limited to known malware attacks and do not provided protection against new or previously unknown malware attacks • Cyber criminals are constantly innovating the techniques used to conduct their attacks • Legacy AV software is inherently disadvantaged when it comes to detecting attacks for which signatures have yet to be developed • Next generation (Nextgen) EEP & AV software solve this dilemma via the addition of Extended Detection & Response (EDR) functionality. 1/12/2021 12.E.1.