Endpoints are a primary target in common and advanced cyberattacks

Security and risk management leaders should use this guide to evaluate the quality of their current endpoint protection and identify next steps to improve their resilience.

Key Challenges

• There are no clear guides that outline the steps to take to improve the security posture of endpoints in a rapidly changing attack landscape.
• Attacker tradecraft is in a constant cycle from targeted nation-state tools to mass-propagated automated attack kits. Advanced attacks are moving to fileless attack methods.
• The endpoint protection market is rapidly changing from protection-only to protection and detection and response, but has still failed to address the configuration and vulnerability assessments necessary to harden endpoints from future attacks.
• Good operations best practices such as configuration vulnerability and patch management are the hallmarks of a sophisticated endpoint protection program; however, less mature organizations don’t have the resources to improve their processes and need to find ways to compensate now.
• Staffing levels are often an impediment to improving endpoint security.

Recommendations

Security and risk management leaders responsible for endpoint security:

• Analyze the current level of endpoint protection and the potential steps needed to improve.
• Consult with business leaders to identify the biggest potential risks to their goals and negotiate an achievable level of endpoint protection to strive for, given resources located.
• Strive to implement endpoint maintenance process, and select solutions that offer cloud delivery and managed services, if your organization is less mature.
• Invest in improving endpoint security configuration standards and endpoint maintenance processes, and shift from protection-only to a detection and response mindset, if your organization has reasonably mature endpoint protection.
• Focus on detection and response across the stack, from firmware to authentication, if your organization has highly mature endpoint protection.