What is EDR?
What Is Endpoint Detection And Response (EDR)?
The term Endpoint Detection and Response (EDR) was suggested by Anton Chuvakin, a former researcher at Gartner. EDR is a tool that helps to detect and rectify suspicious activities throughout all the endpoints in a digital environment.
That oddly sounds like an anti-virus software. So how is EDR different from traditional anti-virus software?
Legacy Anti-Virus
Legacy anti-virus software is a signature-based solution, relying on known static signatures and cloud lookups for prevention and detection. This can leave your network vulnerable to unknown threats.
They provide aid in the removal of basic virus forms like worms, trojans, malware, adware, and spyware. However, as threats are evolving, legacy anti-virus cannot keep up and are becoming less effective at detection and combating of threats.
EDR security not only contains the antivirus features but also includes firewalls, whitelisting tools, monitoring tools, and many more. EDR can be used to:
- Identify and block malicious executables
- Control where, how, and who can execute scripts
- Manage the usage of USB devices, prohibiting unauthorised devices
- Eliminate the ability for attackers to user fileless malware attack techniques on the protected endpoint
- Prevent malicious email attachments from detonating their payloads
- Predict and prevent successful zero-day attacks
SentinelOne
SentinelOne is an Endpoint Detection and Response agent, the next generation of security, replacing legacy anti-virus software. What makes EDR and SentinelOne superior?
Since legacy anti-virus depends on definitions of known viruses, it can only detect what has been found previously and needs to constantly update the definitions. This results in unknown viruses getting through security. They would learn the threats only hours later and start to detect them, but by this time, it can be too late.
On the other hand, SentinelOne has outstanding detection. It does not rely on definitions but rather uses behaviours. Has this endpoint performed this activity before? Does this file or behaviour exhibit unusual patterns? Why are secured files looked at or hit?
SentinelOne also has other features such as:
- Network isolation: SentinelOne will isolate a device under attack from the network if it cannot stop the source. This protects from further attacks or the device compromising others on the networks, while still allowing access to manage and investigate the issue
- Rollback: in the case of a threat not stopped, SentinelOne allows users to undo what the virus has done to a system. Click here to watch a quick two minutes video on how it works. *Only works on Windows
- Storyline: SentinelOne provides insight via ‘visual storyline’. You can see what caused the initial attack and how it replicated and spread
- Lightweight: you may be worried that such a powerful programme would slow your device down but speaking from experience, we found no notable impact
Comparing SentinelOne vs. Legacy Anti-virus
Why SentinelOne?
You may be asking, why do I need Endpoint Detection and Response? And why do I need SentinelOne specifically?
Well, the reality is that in cyber security, we are no longer working off an ‘if’ but rather a ‘when’. Europe, East Asia, and Latin America saw over 100% rise in the volume of cyberattacks according to Gartner. The impact of a successful attack can range from the loss of productivity of one user for several hours, to the more severe entire organisation for days or weeks with the risk of losing data.
No security measure is perfect but effective controls help to manage and minimise the risk. SentinelOne is as good as it gets but don’t just take it from us. Thousands worldwide use SentinelOne, including three of the Fortune 10 and larges companies like Samsung, Aston Martin, Estée Lauder, TGI Fridays, and many more. SentinelOne is a 2021 Gartner Magic Quadrant for Endpoint Protection Platforms Leader. The Gartner Magic Quadrant is an industry-standard report for technology evaluation.
