4 ms·

> Why can't I just use Windows Defender and a network scanner for detection, and netboot the endpoints to make bootkits useless? Defender for Endpoint runs in

by 0xBDB 2y ago

> Why can't I just use Windows Defender and a network scanner for detection, and netboot the endpoints to make bootkits useless? Defender for Endpoint runs in kernel mode. If you just mean plain jane Defender, well, there's a reason Microsoft sells Defender for Endpoint. I'm not sure what a network scanner is intended to do here but if you mean a network intrusion detection system, those still exist but the market has kind of been strangled by EDR because you get higher fidelity detections and need one fewer skillset. > It works just fine and has for a long time. Sort of. There are a lot of controls (MDM and sandboxing and such) that go into that. I'd guess most orgs would just slap EDR on the phones if they could. Again, same result with fewer skillsets and products if so. You need a pretty severe risk to outweigh that and I'm not sure a one-time incident and the slight risk of an actual hostile compromise of an EDR vendor get there. Maybe if there are more like this.

sudosysgen 2y ago
Plain Jane Defender also has a kernel component. The point is to not have to trust any additional vendor. You can't avoid trusting your OS vendor with writing and updating kernel code but you can avoid trusting CrowdStrike. > Sort of. There are a lot of controls (MDM and sandboxing and such) that go into that. I'd guess most orgs would just slap EDR on the phones if they could. Again, same result with fewer skillsets and products if so. You need a pretty severe risk to outweigh that and I'm not sure a one-time incident and the slight risk of an actual hostile compromise of an EDR vendor get there. Maybe if there are more like this. There's nothing wrong with MDM and group policy in and of itself. If orgs could slap EDRs into their mobile devices, the mobile devices would have to become less secure to begin with. The EDR seems to be a marginal risk, but the problem is in the architecture change that's needed to accomodate such an invasive product as an EDR that is a huge risk.

by 0xBDB 2y ago

sudosysgen 2y ago

Plain Jane Defender also has a kernel component. The point is to not have to trust any additional vendor. You can't avoid trusting your OS vendor with writing and updating kernel code but you can avoid trusting CrowdStrike. > Sort of. There are a lot of controls (MDM and sandboxing and such) that go into that. I'd guess most orgs would just slap EDR on the phones if they could. Again, same result with fewer skillsets and products if so. You need a pretty severe risk to outweigh that and I'm not sure a one-time incident and the slight risk of an actual hostile compromise of an EDR vendor get there. Maybe if there are more like this. There's nothing wrong with MDM and group policy in and of itself. If orgs could slap EDRs into their mobile devices, the mobile devices would have to become less secure to begin with. The EDR seems to be a marginal risk, but the problem is in the architecture change that's needed to accomodate such an invasive product as an EDR that is a huge risk.