5 CRITICAL STEPSTO COMPLETE
ENDPOINT
SECURITY
Karl Lankford
RVP, Solutions Engineering
EMEIA©BeyondTrust 2021 | 0What is Endpoint Security?
TRADITIONAL
ENDPOINT SECURITY
The process of securing
mobile devices, laptops,desktops, servers, IoT,and POS and ensuringthat they comply withcertain criteria before
being granted access tonetwork resources• The goal of endpoint security is to limit the attack
surface by blocking unauthorized entry andsafeguarding the network from malicious threats• A compromised endpoint can give attackers afoothold within an environment, enabling them tolaunch further attacks on systems to access data andcompromise more endpoints via lateral movement• The traditional model has multiple challenges
associated with achieving complete endpoint security©BeyondTrust 2021 | 1

70%of Successful Breaches
Started at the Endpoint in 2019

IDC, "Do You Think Your Endpoint Security Strategy Is Up to Scratch?", October 2019

©BeyondTrust 2021 | 2

Challenges with Traditional Endpoint Security
These factors leave organizations at risk of being ‘left behind’ when itcomes to endpoint security:• Continually evolving and more advanced cyber threats• Increasingly complex and diverse endpoint environments• Corporate misalignment of security technologies to threats• Resource challenged IT and InfoSec teams that continue to be
stretched thin

Consider This…
The year 2020 has been an unprecedented time, with the pandemic and ”new normal” for remoteworkers, creating a perfect storm for privilege abuse and changing the cybersecurity landscapeforever
av-test.org©BeyondTrust 2021 | 3

How can organizations shift to amore

preventativeapproach to endpoint security?

©BeyondTrust 2021 | 4©BeyondTrust 2021 | 5

ANTIVIRUS
Detect Known Malware©BeyondTrust 2021 | 6

1. Antivirus: Detect Known Malware• Many companies still use antivirus alone to secure
their endpoints, but only catch 40% of known attacks• For the threats that do bypass AV, some companies
will utilize Endpoint Detection and Response(EDR) solutions to detect and then react to threats• However, starting with combination of Least Privilege
and Application Control, most malware andransomware attacks will be blocked©BeyondTrust 2021 | 7

ENDPOINTPRIVILEGEMANAGEMENT
Remove Excessive End User
Privileges & Stop Zero Day Attacks©BeyondTrust 2021 | 82. Remove Admin Rights& Stop Zero Day Attacks
REDUCE THE NOISE EDR AND SHRINK THE ATTACK SURFACE• With 40% of known threats covered by AV, it’s time
remove admin rights from end users and give them
just enough privileges to do their jobs
• Perimeter security is stronger than ever, making end
user devices heavily targeted by threat actors• Modern EDR will be optimized and noise reduced
when layered on a solid foundation of zero-adminrightshttps://www.zscaler.com/blogs/research/30000-percent-increase-covid-19-themed-attacks©BeyondTrust 2021 | 9

ENDPOINTPRIVILEGE
MANAGEMENT
Use Pragmatic Application Control &Block Malicious Code©BeyondTrust 2021 | 10

3. Use Pragmatic Application
Control & Block Malicious Code• Not all malware needs admin rights• Control what applications a user can run regardless of privileges bydefining good and bad applications• App Control improves security, compliance, and licensing management• With admin rights removed, you can now trust critical operating system
functionality making it easier to implement modern Application Control
By layering Modern Application Control on top of Privilege Management,
critical functionality in the operating system can now be trusted making
Application Control easier and greatly reducing the attack surface©BeyondTrust 2021 | 11

ENDPOINT
DETECTION &RESPONSE
Continuously Monitor for
Harmful Activity©BeyondTrust 2021 | 12

4. Endpoint Detection & Response
You have now successfully removed excessive adminrights and implemented and application control.

Now it’s time to consider… EDR• Designed to help organizations identify and react tothreats that have bypassed their other defenses.
• Runs locally on user workstations or servers to monitor
processes, applications, logged in users and determines if
malicious activity is present on the system.
• Using EDR with EPM as the foundation prevents theexecution of applications that need elevated privileges,
allowing EDR tools to focus on a smaller amount of endpointdata

EDR alone
does notgive yourorganization
completemonitoring
capabilities.

©BeyondTrust 2021 | 13

OTHER ENDPOINT
SECURITY TOOLS
Apply End User Lockdown Based on End
User Cases©BeyondTrust 2021 | 14

5. Other Endpoint
Security Tools• Endpoint security solutions are not onesize-fits-all• Depending on your industry, compliancemandates, and systems – there are dozens
of other endpoint security tools that should
be considered• It’s imperative that organizations review
specific use cases based on specific needs

Endpoint Privilege
Management
makes all otherEndpoint Security
tools more
effective byreducing the noiseand minimizing
the attack surface©BeyondTrust 2021 | 15

KEY TAKEAWAY
Removing privileges and implementing application control withEndpoint Privilege Management makes all other Endpoint Security tools

more effectiveby reducing the noise and minimizing the attack surface©BeyondTrust 2021 | 16