« Back to Glossary Index
What is Endpoint Security? Explained
Endpoint security is the practice of securing endpoints — including desktops, laptops, servers, and mobile devices — from cybersecurity threats.
Endpoint security software is undergoing a massive shift, progressing from antivirus software to endpoint detection and response (EDR). Now, extended detection and response (XDR) is replacing many EDR implementations in an effort to simplify and consolidate cybersecurity toolsets.
What Is An Endpoint?
An endpoint is any device that can connect to and communicate with a network. In a two-way phone call, for example, the connection extends from one person to the other, making the phones “endpoints” in the scenario.
Endpoints can include laptops, virtual machines, workstations, servers, and mobile devices. Since IoT devices can connect to a network, they are also considered endpoints, which means that any ‘smart’ device — thermostats, speakers, refrigerators, cameras and more — can be an endpoint, too.
Why Is Endpoint Security Important?
Endpoint security is often referred to as the frontline of cybersecurity, as endpoints are commonly an entry point for threat actors to launch attacks. In the past decade, the number of endpoints with access to sensitive data has increased significantly, creating an even higher demand for endpoint security solutions.
Additionally, a few trends have contributed to greater need for endpoint security:
- Accelerated adoption of the Internet of Things (IoT). The IoT era created an explosion of internet-connected devices; in 2022, the number of IoT connections increased by 18% with over 14.4 billion active endpoints globally, according to IoT Analytics’ State of IoT Report. IoT devices are extremely varied, ranging from smart thermostats to refrigerators, creating further complexity.
- Popularity of remote work. The Covid-19 pandemic completely shifted the modern workplace and forced organizations to quickly shift to a remote environment, often without considering the security ramifications. In 2022, an estimated 4.7 million people work remotely at least half the time in the United States. Endpoint security is a common concern as remote workers increasingly use unmanaged, personal laptops, phones, tablets, etc. to connect to networks as they work from home. The lack of visibility and control over the security posture of those devices can introduce risk to corporate networks in the form of malware, unpatched software, rooted devices and more.
- Increased smartphone usage. In the past decade or so, mobile device usage has skyrocketed, creating more endpoints. The number of smartphone users is expected to increase to 7516 million by 2026, according to Ericsson. Smartphones are accompanied by another set of specific risks; for example, zero-click malware enables threat actors to place spyware on a device without the user taking any action.
- An evolving threat landscape. The emergence of new devices and applications opens up the opportunity for new attack vectors and vulnerabilities. For example, 44% of cybersecurity professionals report an increase in exploits targeting their virtual private networks (VPNs), according to the 2022 VPN Risk Report by Cybersecurity Insiders and Zscaler.
How Does Endpoint Security Work?
EDR, XDR, SOAR, antivirus, and others are all considered endpoint security tools or endpoint protection platforms. They work by
What is EDR?
Endpoint detection and response (EDR), or endpoint threat detection and response, software collects security-related information from endpoints, with the goal of detecting security incidents in real time. The term was coined by Gartner analyst Anton Chuvakin in 2013.
EDR can either refer to a suite of tools or a single platform.
EDR is often referred to as a natural evolution of antivirus software because both tools perform similar functions. Traditional antivirus, however, typically relies on signature-based detection to spot known threats. EDR combines continuous monitoring with automated response and analysis capabilities, using behavior-based detection to detect emerging attacks such as advanced persistent threats (APTs) and fileless malware, whereas traditional antivirus typically does not. EDR software, however, can be a component of next-generation antivirus products.
How Does EDR Work?
First, an agent is deployed on the host system to handle monitoring and reporting. EDR software continuously monitors and ingests data and activity taking place on endpoints and workloads, such as communications, user logins, and event logs.
Then, the software records that information — which should include real-time data — in a centralized database for analysis, detection, investigating, and alerting.
The solution’s detection engine will be able to learn and eventually recognize unknown or suspicious activity at the endpoint level. Using predefined rules, EDR software can automatically respond to and remediate indicators of compromise, while alerting IT and security teams.
« Back to Glossary Index