3 ms·
> How else to protect a complex IT environment with thousands of assets in form of servers and workstations, without some kind of endpoint protection? There is
by imiric 2y ago
> How else to protect a complex IT environment with thousands of assets in form of servers and workstations, without some kind of endpoint protection?
There is no straightforward answer to this question. Assuming that your infrastructure is "secure" because you deployed an EDR solution is wrong. It only gives you a false sense of security.
The reality is that security takes a lot of effort from everyone involved, and it starts by educating people. There is no quick bandaid solution to these problems, and, as with anything in IT, any approach has tradeoffs. In this case, and particularly after the recent events, it's evident that an EDR system is as much of a liability as it is an asset—perhaps even more so. You give away control of your systems to a 3rd party, and expect them to work flawlessly 100% of the time. The alarming thing is how much this particular vendor was trusted with critical parts of our civil infrastructure. It not only exposes us to operational failures due to negligence, but to attacks from actors who will seek to exploit that 3rd party.
- matwood 2y ago> starts by educating people Any security certification has a section on regularly educating employees on the topic. To your point, I agree that companies are attempting to bypass the hard work by deploying a tool and thinking they are done.
- kchr 2y agoAbsolutely, training is key. Alas, managers don't seem to want their employees spending time on anything other than delivering profit and so the training courses are zipped through just to mark them as completed. Personally, I don't know how to solve that problem.
- kchr 2y agoI totally agree. In my current work environment, we do deploy EDR but it is primarily for assets critical for delivering our main service to customers. Ironically, this incident caused them all to be unavailable and there is for sure a lesson to be learned here! It is not considered a silver bullet by the security team, rather a last-resort detection mechanism for suspicious behavior (for example if the network segmentation or access control fails, or someone managed to get foothold by other means). It also helps them identify which employees need more training as they keep downloading random executables from the web.