EDR vs CLASSIC ANTIVIRUS
The new technology for defending against modern cyber threats is called EDR (Endpoint Detection and Response).
What are the characteristics of an EDR
Different vendors provide very heterogeneous solutions, and each EDR has its own peculiarities, but a few characteristics define them:
- It catalogues endpoints (PCs, servers, mobile devices, etc.) and keeps a history of them over time.
- It collects a large amount of data, threat patterns and alerts so that in-depth analysis can be carried out.
- Forensic analysis capability, based on the large volume of data collected.
- It quickly applies remedies to prevent threats.
The difference between an EDR and an antivirus
An EDR has many distinguishing characteristics, but the fundamental one is the ability to carry out forensic analysis and recognise how the malware reached its target.
What are the benefits of an EDR?
Thanks to specific additional modules, an EDR almost always also has the ability to actively stop threats.
The main advantage lies in the ability to recognise a threat without using signatures. While an ordinary antivirus needs to update its signatures constantly to recognise a virus, an EDR recognises the virus from its behaviour.
In other words, to put it paradoxically, an EDR from two years ago can stop a virus created today, about which it knows nothing and for which it has no signature.
Besides this very important plus, there are many others, among which it is worth highlighting the great ability to correlate critical events and provide important forensic analysis tools.
Last but not least, an EDR’s natural ability to coexist with other security tools, such as traditional legacy antivirus, without creating conflicts or malfunctions should also be considered.
Is it effective against ransomware?
The answer is obviously YES. Typically, modern ransomware no longer follows “dragnet” attacks, that is, widespread ones, but some of them are targeted attacks, built for a specific scenario or customer.
As a result, it is hard to imagine that an antivirus knows about, and has the signatures to block, a number approaching 350,000 new malware samples created every day!
An EDR recognises the threat from its behaviour, so the reaction time is zero: it does not need anyone to create a patch and a signature to block the attack.
Why is an EDR perfect for the ICS world?
From the point of view of an automation designer or technician, one of the greatest fears is installing an antivirus on a SCADA server. The reason is simple: it could recognise a normal process or query as a virus (false positive). This makes it always very difficult to persuade the people involved to use antivirus systems and keep clients and servers up to date.
An EDR, by contrast, does not have this kind of problem. Since it does not need signature updates, it does not run the risk of recognising a process or a query as a threat because of the latest update. At the same time, it is able to block threats built ad hoc for the ICS/OT world.
It follows that an EDR is perfect for ICS environments. The EDR can initially be configured in a learning mode, in which it works out which processes are normal and common. Afterwards, you can switch to the active protection phase. All this thanks to heavy use of artificial intelligence (AI).