Smartinvestment
into EDR-classprotection
and why yourbusiness needs it

A buyer’s
guide tooptimumlevel ofsecurity

Executive summary
For years, SMBs and mid-size enterprises have been able to rely on theirendpoint protection platform (EPP) to defend their businesses against an
extensive range of commodity threats. But with cybercriminals increasingly
turning to new, unknown and evasive threats that can bypass the EPP,
it’s time to upgrade these defenses with endpoint detection and response(EDR) and/or managed detection and response (MDR) solutions capable ofprotecting against such threats.
This buyer’s guide explains how to identify the optimum EDR-class security
for your business in eight easy steps. You’ll want to start by reviewing yourexisting endpoint protection to identify any critical gaps in your endpoint
defenses. You’ll also need to be clear about what you want to achieve, andidentify the protection that best fits your needs by thinking about your use
cases. And you should take a serious look at both EDR and MDR, consider
these solutions within your broader security landscape, and draw up list of
key capabilities required from potential vendors.
By reading this guide, you’ll have a clear understanding of why and how to
upgrade your defenses, the benefits of the available solutions, and how tocreate an optimum security solution that not only matches the needs ofyour business, but also the specialist security skills of your IT team.

Why upgrade yourdefenses – and why now?

Advanced cybersecurity solutions like endpoint detection and response(EDR) are one of the hottest topics in the market – and with good reason.
Especially if yours is a small to medium-sized business (SMB) or mid-size
enterprise.
Why these segments in particular? Changes in the cybersecurity landscapemean today’s attackers are focusing on organizations of all sizes, spheres ofactivity and levels of preparedness. More specifically, high-end SMBs andmid-size enterprises are under fire from the more advanced evasive threats
previously only directed at much larger organizations.

1

In response, IT security teams have been supplementing their existing
endpoint protection platforms (EPP) with EDR and/or managed detection
and response (MDR) solutions enabling them to detect and investigate
security incidents, contain the threat at the endpoint, and receive an
automated response and/or guidance for remediation.
Unfortunately, adopting these solutions can sometimes cause as many
issues as it solves – by alerting security teams to enormous volumes of
threats which, although suspicious and requiring investigation, ultimately
turn out to be harmless. This can be a particular problem for IT teams withlimited in-house security expertise or time with which to deal with thesealerts.

Optimize key
resoursces and focus
on the businessof cybersecurity,
rather than chasing
false positives andoverwhelming columesof alerts

The ideal solution is therefore one that supplements endpoint protection
with EDR-class security that significantly lightens the EDR workload – as themore threats that are prevented, the less noise is created for security teams
to investigate. This in turn means that IT security teams can optimize key
resources and focus on the business of cybersecurity, rather than chasing
false positives and overwhelming volumes of alerts.
So what changes to the threat landscape are driving the need for moreadvanced protection? How do these vary for different types of businesses?
And (perhaps most crucially of all, given the global shortage of skilledcybersecurity talent) how can you effectively address these threats witha solution that best fits your organization, the size and security skills of yourIT team, and the types of cyberattack to which you’re potentially exposed?

This buyer’s guide will help you,by outlining:  hy existing endpoint security won’t ensure protection against theW
new threat landscape.
How to assess your evolving security requirements.
 ow to identify the protection that best fits your needs – both inHterms of the threats to which you’re increasingly exposed, and the
security skills of your IT team.
 hat to do if you have only limited time, headcount and/or in-houseW
security expertise.
How the latest solutions fit within the broader security landscape.

2Why existing endpoint security
won’t ensure protection against
the new threat landscape
When it comes to enhancing your endpoint security, it’s easy to think that
this is simply a matter of identifying and implementing an EDR solution that
seems a good fit for your business. But in the same way that it would be
inadvisable to add an extra floor to a building without first checking thefoundations, your first step should be to review your existing EPP.
IDC1, for example, has suggested:

Do not accept substandard
or weak EPP as it corrupts
the results of the complete
endpoint solution1.
A company should not makeup for weak EPP with EDR(and a lot of security analysttime).

 efore discussing considerations for EDR, IDC would first recommend
Bthat you look at your existing EPP solution. The expectation for EPP
should be that it protects endpoints as an independent solution.
 o not accept substandard or weak EPP as it corrupts the results ofD
the complete endpoint solution. A company should not make up for
weak EPP with EDR (and a lot of security analyst time).
EPP plays a vital role in enabling any business to protect itself against an
extensive range of commodity threats, and minimize IT security workloads.
But when it comes to evasive threats you need to go further.
To reduce the risks presented by the new threat landscape, you therefore
need to start by assessing the effectiveness of your existing endpoint
protection and identifying any potential gaps in your defenses.

Why you may not be as well protected as
you think 
While you might think your business is well protected, it’s estimated that in
the first half of 2019 alone there were nearly 4,000 data breaches2, putting
more than four billion users’ data at risk.
This alarming figure is quoted in the introduction to IT security economics
in 2019, the Kaspersky report summarizing the results of our annual Global
Corporate IT Security Risks Survey. The survey involved interviews withalmost 5,000 SMBs and enterprises in 23 countries, and revealed someconcerning statistics of its own. For example:

1
2

55%

12%

51%

66%

of organizations are‘completely confident’ that
their network hasn’t been
hacked, despite 38% feelingthey lack sufficient insighton the threats facing theirbusiness.

of enterprises areconcerned about malware
infection, despite it being
the costliest security
incident for them.

of enterprises and 47% of
SMBs agreed it’s becoming
more difficult to tell thedifference between
a generic or a targeted
security attack.

of both enterprises and
SMBs were looking toincrease their investmentin specialist IT staff in
2020, despite critical global
shortages – especially incybersecurity.

IDC Doc # US45794219 - Endpoint Security
2020 The Resurgence of EPP and the Manifest
Destiny of EDR - Jan 2020
https://pages.riskbasedsecurity.com/2019midyear-data-breach-quickview-report3What these figures suggest is a dangerous disconnect between
organizations’ perceptions of the cyberthreat landscape, which types
of attack pose the greatest potential risks (including financial), and their
preparedness and ability to defend themselves.

For enterprises, malware infection oncompany-owned devices is actually
the form of data breach with thebiggest financial impact, costing
US$2.73 million in 2019 – despite
only 12% of enterprises feeling ‘very
concerned’ about malware infection
as a threat.

SMBs too are ignoring their mostexpensive forms of attack. The
costliest type of data breach forsmaller businesses were incidents
affecting IT infrastructure hosted bya third party, adding up to US$162,000.
However, SMBs only ranked this thefifth most important measure, andinstead were most concerned aboutdata protection issues, such as theloss of a physical device, or data loss
through a targeted attack.

The fact that enterprises and SMBs
are finding it more difficult to tellthe difference between generic andtargeted security attacks is making it
harder for them to detect or evaluate
the potential harm of the incidents
they’re experiencing – a possible
reason why they’re becoming
susceptible to growing levels of bothmoderate and advanced malware
threats.

The report concluded by saying ‘It’s vital that businesses keep investing andrethinking their IT security processes in order to stay one step ahead of thegrowing rates of cyberattacks, and to limit any financial losses incurred’. But
they can only achieve that by effectively addressing the actual threats towhich they’re increasingly being exposed – i.e. by investing in the EDR-classsecurity needed to protect against evasive threats.

Step 1: Review your existing
endpoint protection
With so many advanced cybersecurity solutions available on the market,
it’s easy to forget the vital role played by your endpoint protection. Why are
endpoints so important? Not only are they the most common entry points
into a business’s infrastructure – and cybercriminals’ primary target – they’realso key sources of the data needed for effective investigation of complex
incidents.
As a result, every organization should choose an EPP delivering automatedprotection against the large numbers of possible incidents caused bycommodity threats – including fileless threats and ransomware.
Because this type of setup requires relatively limited specialist security
knowledge or personnel, it meets the endpoint security needs of SMBs or
small enterprises without a dedicated security team, or organizations withvery low levels of cybersecurity expertise.
It’s also a crucial foundation stage for midsize and larger enterprises where,by dealing automatically with large numbers of minor threats, the solution
can clear the way for security teams to focus on more advanced defense
where needed.
When reviewing your EPP to assess if it’s delivering the capabilities you
should expect, you need to consider:4How effective is it?
How many false positives are you receiving?
Does it offer effective attack surface reduction
capabilities like web, application and device controls?
Does it help to automate routine tasks?
Is it easy to operate, and helping to minimize costs
and overheads on your IT team?
Does it help with critical tasks such as vulnerability
assessment and patch management?

Step 2: Identify any criticalgaps in your endpoint defenses
While your EPP will protect against an extensive range of commodity
threats, you also need to consider your defense against new, unknown andevasive threats that are bypassing your EPP.
Preparing an attack is becoming cheaper for cybercriminals, putting moreorganizations at risk. And as well as occurring more frequently, these kinds
of attacks have become much more effective due to criminals combining,
testing and using varied techniques in order to effectively bypass endpoint
security.
The urgent need to deal with these threats has also become increasingly
critical due to changes such as the dissolving of corporate perimeters
resulting from the surge in remote working.
Telltale signs that it’s time to expand your defenses beyond traditional EPP
therefore include: our EPP is failing to stop an increasing number of new, unknown andYevasive threats.

The best use of all
the functions you
actually need, rather
than paying for large
numbers of functions
you don’t really want ou have limited visibility into what’s happening on your endpoints.
Y
This includes being unable to undertake root cause analysis,
investigation and real-time threat response – or having to do thismanually, with standard operating system (OS) tools on a case-by-casebasis, which is slow, complex and error-prone.
 ou don’t have the specialist IT security skills or capacity needed toYdeal with increasingly sophisticated threats.
 ou’re concerned about potential fines, or the threat to yourYbusiness’s reputation resulting from a major security incident.

5

To implement an effective solution to defend against these threats, you’ll
need to consider aspects of your organization including its size, corporate
profile, security preparedness, existing resources and expertise – and inparticular the security skill level (or ‘maturity’) of your IT or IT security team.
You’ll also want a solution that makes the best use of all the functions
you actually need, rather than paying for large numbers of functions you
don’t really want, and then having to try to recruit IT security experts withthe skills needed to work with these.

Step 3: Be clear about what
you want to achieve
According to Gartner3, EDR tools provide a method for security and risk
management technical professionals to answer two key questions about the
security of their environment:
What happened here?
What is happening right now?
Many organizations have limited expertise (or a small IT security department
and no plans to expand it), but need to understand what’s happening to theirinfrastructure and be able to respond to evasive threats before damage canoccur.
Adding appropriate EDR capabilities to EPP can provide highly effective
defense against more advanced and evasive threats. This should give IT
security specialists the information and insights needed for effective
investigation, and the tools required for root cause analysis, creating custom
Indicators of Compromise (IoCs), importing IoCs, and scanning for themacross all endpoints. And it should enable automated and/or fast, accurate‘single-click’ responses like quarantining files, host isolation, stopping
a process, deleting an object etc.

Step 4. Identify the protectionthat best fits your needs
Many organizations may not employ anyone dedicated specifically to IT
security. Some may just be beginning to build their IT security department.
And others may already have fully formed and skilled-up IT security teams.
The quality of these organizations’ available expertise in relation to threat
defenses will therefore vary widely – as can the amount of time they can
dedicate to this task.
To deal with these differing circumstances, organizations without dedicatedIT security personnel, or those whose IT security staff are overloaded withroutine tasks, will need to make strategic use of automation to counter thelatest evasive threats.
This means supplementing their EPP with additional EDR tools which, while
protecting against these threats, also incorporate appropriate levels of
automation (full or partial).
3

Gartner – Solution Comparison for Endpoint
Detection and Response Technologies andSolutions – Jan 20206

Tools that are
as straightforward andsimple as possible –saving time andreducing
frustration

Alternatively, rather than investing in an overly complex EDR solution forwhich they may not have the necessary time or skills, managed detection
and response (MDR) lets them access capabilities such as 24/7 security
monitoring by industry experts, automated and managed threat hunting,and guided and remote response scenarios – either from a vendor, managed
service provider (MSP) or managed security service provider (MSSP).
A third option is to combine EDR and MDR. Many organizations do nothave the expertise required for threat hunting, so outsourcing this while
implementing detection and response capabilities in-house is often an ideal
solution. And this can be particularly beneficial for businesses that want todevelop their own cybersecurity team, but lack the resources, personpower
and/or skills to support specialist detection and response.
Whichever best fits your particular situation, you’ll want tools that are
as straightforward and simple as possible – saving time and reducing
frustration. To minimize alert fatigue, you’ll also want a solution that deals
with large numbers of potential threats automatically.

Step 5: Think about
your use cases
To identify the protection that best fits your needs, you need to set
clear requirements for it. This means considering critical aspects of thesolution’s performance and regular use, such as the use cases you need it tofulfil and the results you expect it to deliver.

For example, when youFor
receivea whensecurityalert, aEDR
and/orexample,you receive
securityalert, MDR
EDR and/or MDR should
should enable you to answer
keytoquestions
such as:such as:
enable you
answer key questions
What’s the context of the alert?

Are other hosts under attack?

What actions have been
performed on the alert already?

What path did the attack take?

Is the detected threat still active?

What’s the root cause of the threat?

It should also help you understand the full scope of the threat. For example:

If you’re at risk of a global threat,
your management team will likely
want to be reassured you’re notcurrently under attack, for which
you’ll need the ability to find an IoC
online, run a scan and answer theirconcerns correctly.

If a regulatory authority asks you
to run a scan for a specific IoC, you
should be able to import IoCs fromtrusted sources and run periodic
scans for signs of an attack.

If you’ve thoroughly investigated analert, and generated an IoC basedon the discovered threat, rather
than running scans throughout
the entire network to find ifother hosts have been affected,
this should be done for you
automatically.

7

Similarly, you should be able to quickly respond to prolific,
fast-moving threats by: ontaining the threat by isolating the host, quarantining the file orC
preventing files being executed during the investigation.
 utomated cross-endpoint response based on IoC scans – enablingA
you to respond to evasive threats as soon as they’re discovered.
 nd, importantly, guided and remote response scenarios if you’reAusing MDR.
Among the key results you should therefore expect from yoursolution include:Protecting against more frequent and more disruptive evasive threats.
Saving time and resources with a simple, automated tool.
Seeing the full scope of evasive threats over the whole of your network.
 nderstanding the root cause of each threat and how it actuallyUoccurred.
Avoiding further damage with rapid automated response.

What if you have only limited in-housesecurity expertise? Let’s assume you have limited internal IT security expertise, or a small teamof one or two security specialists. Let’s also assume you’re trying to decide
whether to supplement your EPP with EDR and/or MDR. What kinds ofbenefits can you expect and what would be right for you?

Step 6: Take a serious lookat both EDR and MDR
If you prefer a more hands-on approach (and your IT team has sufficiently
mature IT security skills), EDR can help prevent business disruption anddamage by eliminating the risks posed by new, unknown and evasive
threats, and giving your security personnel the visibility needed for threat
investigation, root cause analysis and response.
This can drive cost efficiencies by enabling your security team to work
more effectively without having to juggle multiple tools and consoles, andmaximize capacity by automating an extensive array of processes. It also
gives you peace of mind by making it easy to monitor and detect threats,
and respond to and prevent attacks.
If you’re looking to expand your internal IT security capacity by offloading
key detection and response tasks, MDR can offer advanced, round-theclock protection from threats that can otherwise bypass automatedsecurity barriers. This can help to empower your business by solving
the cybersecurity talent crisis, and supplying all the major benefits of
a 24/7 Security Operations Center (SOC) without the prohibitive costs.
8

MDR can also drive cost efficiencies by focusing in-house resources on
those critical tasks that really demand your IT security team’s involvement,
and maximize capacity by leveraging advanced machine learning models
to significantly increase analyst throughput and minimize mean-time-torespond. And it can deliver continuous security monitoring by industry
experts, along with automated and managed threat hunting. This includes
analysis of complex non-malware threats, and dangerous, hard to detectthreats using legitimate OS tools in attacks.
Combining EDR and MDR, meanwhile, lets you tailor their respective EDRclass capabilities to your particular needs, for example by outsourcing
threat hunting (for which you may not have the required expertise) while
implementing endpoint detection and response capabilities in-house.

What about the bigger picture? Having established your preferences for EDR and/or MDR, you’ll also want toassess how the various available solutions are viewed by the market. When
you’re looking for a product as vital as cybersecurity, the opinions of
independent experts and existing users should far outweigh any potential
vendor’s marketing claims. So, for example:

What’s your personal experience with other products from the same vendor?
What are peers and colleagues within your industry saying?
What do the vendor’s customers think?
What do independent tests and reviews have to say?
What are analysts saying about the vendor and their products?

Step 7: Consider yourbroader security landscape
In many organizations, EPP, EDR and/or MDR solutions will need to integratewith and operate as part of a much broader security framework.
Alongside these solutions, you could, for example, benefit from:Security awareness training
for your employees, which helps address
gaps in cybersecurity awareness andtransform employee behaviors – especiallywith the vast majority of cyber incidents
being caused by human error.

Threat intelligence – enabling you to better
deal with issues such as cyberthreats in suspicious files, URLs, IPs and domains, and investigate threats more quickly and thoroughly.

9You’ll also want to consider how your solution will be managed – for example
by giving you a unified, single pane of glass cloud-enabled console for all
the various components, and including web, on-premises and air-gappedmanagement options.

Step 8: Ask your vendor
if they offer all this:Different vendors offer EDR and MDR solutions with (sometimes widely)differing capabilities. As a simple rule of thumb, a comprehensive solution
should ideally incorporate the following.
 uick and hassle-freeQdeployment
 asy and intuitive tools that doE
not require lengthy
familiarization or retraining
 unified management consoleA
to configure yourcybersecurity tools and react
to incidents from one place

Guided response scenarios
 utomated threat hunting,A
supported by vendor/MS(S)P specialists
 ightly integrated endpoint
Tprotection and endpoint
detection and response
functionalityСapacity

 bility to meet your specificAneeds and requirements withevery possible deployment
option: cloud, on-premises,hybrid, air-gappedIntegrated fileless protection
Anti-exploit technology
Ransomware protection

Threat visibility
 oot cause analysis includingRvisualization and drill-down
capabilities for quicker andmore convenient analysis
IoC import, generation andscanning
 ast and preferably automatedF
response capabilities

 ulnerability and patch
Vmanagement functionality
 pplication, web and deviceA
control, and other systemhardening methods igh performance to prevent
Huser and network slowdowns
 ffective technical support inE
your local language

10How Kaspersky Optimum
Security can help
In independent tests,
Kaspersky consistently
demonstrates a higher
quality of protection
compared to any othervendor.

Kaspersky Optimum Security protects your business against new, unknown
and evasive threats in a resource-conscious way. With it, you can quickly
and easily adopt an effective threat prevention, detection and response
solution, backed by support from Kaspersky experts for 24/7 security
monitoring, automated threat hunting, and guided and remote response
scenarios.

In 2019, we were Gartner
Peer Insights Customers’
Choice for Endpoint
Protection Platforms4 forthe third year running, andthe most tested, mostawarded security vendor forthe seventh year in a row.

And, if you’re looking for EPP, EDR and MDR, managed from a cloud console,a threat intelligence portal and security awareness training, Kaspersky
Optimum Security enables complete protection for all your endpoints ina unified solution delivering automatic prevention, detection and response,managed protection and cyber-safety training.

In 2020 we were also one of
only six vendors worldwide
to receive Gartner Peer
Insights Customers’ Choicerecognition for Endpoint
Detection and Response
solutions5, with the highest
rating of any vendor forservice and support.

 dvanced prevention and detection mechanisms (machine learning,Abehavior analysis, automated threat hunting with Indicators of Attack(IoA)) maximize protection against dangerous evasive threats – building
on strong EPP protection against commodity threats with Kaspersky
Endpoint Security for Business

Other recent awards
include:• AA product rating in the2020 NSS Labs Advanced
Endpoint Protection (AEP)
group test
• The highest possible score
for protection against
advanced cyberthreatsin AV-Comparatives
Enhanced Real-World Test
• 2020 SE Labs BestEnterprise Endpoint
annual award

Advanced threat protection  nhanced threat visibility provides context and details on detectedE
threats, while simple root cause analysis and visualization tools allow
you to quickly and efficiently investigate and understand the threat
and how it has developed.
 utomated threat hunting helps establish and improve early, effectiveA
threat detection and response, through 24/7 continuous monitoring byindustry-leading experts.
 uick ‘single-click’ and cross-endpoint automated response options
Q
and IoC scans across the whole infrastructure help you quickly respondto fast-moving threats.
 uided and remote response scenarios provide your security teamsGwith expert analysis and responses to new, unknown and evasive
threats.
 aising employee awareness of cyberthreats, the methods used byRcybercriminals, and how employees can help prevent attacks from ever
happening, reduces risks of human error and social engineering.

Fast, scalable turnkey protection  orks across workstations, laptops and servers, physical and virtualWmachines, public clouds and containers.
 onsolidated, multi-layered endpoint security prioritizes incidents andC
expedites threat discovery and investigation with threat intelligence via
a convenient web portal.

4
5

Gartner Peer Insights ‘Voice of the
Customer’: Endpoint Protection Platforms,
10 December 2019
Gartner Peer Insights ‘Voice of the Customer’:Endpoint Detection and Response Solutions,
1 May 2020

 tops known and emerging threats using industry-leading technologies
S
that are proven to prevent ransomware, exploits, fileless and othermalware attacks.

Gartner Peer Insights Customers’ Choice constitute the subjective opinions of individual end-user reviews, ratings, and data applied against a documented
methodology; they neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates.

11

Minimizes needs for additional staff orexpertise  traightforward analysis and response processes within a single
S
cloud-enabled console help security personnel optimize time andeffort spent on investigation and remediation.
 nified console enables single pane of glass management for major
U
Kaspersky security applications. Cybersecurity tools can be configured
and react to incidents from one place, and meet specific needs withevery possible deployment option including cloud, on-premises, hybrid
and air-gapped.
2 4/7 security monitoring provides round-the-clock protection, even fororganizations with a lack of IT security staff.
Why invest in Kaspersky Optimum Security

Through Kaspersky Optimum Security we can take you from a situation where you’re
under significant risk of an evasive attack, to one where you have renewed confidence in yourendpoint security. Rather than being unsure about what’s happening in your environment,
you’ll have visibility and control over all of your endpoints, wherever they are. And, rather
than being reluctant to upgrade security because of the complexity involved, you’ll havea simplified and consolidated solution that helps optimize your resources.
You can learn more about how to get the advanced protection your business needs – while
minimizing needs for additional resources – by visiting go.kaspersky.com/optimum.

12

Cyber Threats News: www.securelist.com
IT Security News: www.kaspersky.com/blog
Threat Intelligence Portal: opentip.kaspersky.com
Technologies at glance: www.kaspersky.com/TechnoWiki
Awards and recognitions: media.kaspersky.com/en/awards
Interactive Portfolio Tool: kaspersky.com/int_portfolio

www.kaspersky.com