A holistic approach to security: threat prevention and remediation

For those that don’t recall, there was a famous advertisement that ran across television stations throughout the U.S. from the 1960s and well into the late 1980s, intended to provoke thought amongst parents by asking them “It’s 10 pm, do you know where your children are?”

The ad’s aim was to bring general awareness to keeping a watchful eye over loved ones. A modern take with a focus on IT and Security teams sees a modified version of this message, and begs the question:

It’s 10 pm, do you know where your endpoints are?

And diving deeper, the question is posited to ascertain if you know the status of the security of your Apple endpoints. More importantly, can you verify that your endpoints are indeed protected against the variety of threats targeting the Apple ecosystem within today’s modern threat landscape?

If you answered “Yes”, that’s good! But are you certain? And by certain, we mean do you have access to the necessary insight and rich telemetry data that gives organizations the evidence they require to be confident that their endpoints are protected and demonstrate compliance with any laws or regulations that govern your industry and/or region?

That’s a lot trickier to answer, but with the right security tooling – such as the endpoint security solutions developed by Jamf – implementing the various protective layers in a comprehensive defense-in-depth strategy makes minimizing risk a breeze.

Additionally, by centralizing visibility across your entire fleet of macOS and iOS/iPadOS endpoints (including support for Android and Windows devices), organizations not only have ready access to the verifiable data they need to prove their endpoints are secure but provide them access to advanced workflows to enforce compliance while gaining the ability to automate remediation tasks if malicious threats are detected.

Three security elements – one trusted platform

Industry-leading endpoint security and management developed by Jamf, purpose-built and Apple-first. Blending behavioral analytics to monitor for and detect malicious threats to stop zero-day phishing threats, and known malware (and their variants) alongside reducing the risk from unknown threats. Not to forget powerful threat remediation that leverages advanced machine learning without compromising security, privacy or performance.

Elegant solutions that utilize minimal resources while providing maximum protection and mobile threat defense across your entire Apple fleet without needless complexity.

Detection

The modern threat landscape means users are productive across various device types – regardless of physical location or ownership level – working with organizational resources on any modern device, from anywhere and at any time. All while encountering multiple threats daily.

Hence why it’s important for endpoint security products to stay out of the user’s way, yet be powerful enough to stand up to the rigors of security threats. All the while, balancing performance by minimally impacting resources, like battery life while holistically securing endpoints across multiple platforms – regardless of the hardware or software being used.

And of course, providing IT and Security admins centralized visibility into all the layers of defense across their fleet, giving them the rich telemetry data necessary to identify known and novel threats, as well as their severity to assess further the level of risk posed and finally, inform their decision making on how to best mitigate the threat.

Jamf’s desktop endpoint security and mobile threat defense tooling achieves exactly this through:

• Constant monitoring and device health status checks with up-to-date insight into endpoint health
• Advanced machine learning (ML) and threat intelligence engine technology – named MI:RIAM – aiding teams in threat hunting of unknown threats stealthily compromising devices
• Real-time notifications inform IT and Security teams of the latest detections data, alerting them to endpoints that may need triaging or remediation
• Granular reporting that provides detailed logging data related to threats, risky apps and suspicious behaviors and the system processes affected

Prevention

Also known as “stop the bad things from happening.” To us, prevention wears many hats. Sure, blocking malware is a large part of a bad actor’s attack chain – easily among the largest threats affecting users today – but strong, comprehensive endpoint security means more than just installing an antivirus solution.

A lot more.

Take for example the list below of capabilities Jamf bakes into their endpoint security and mobile threat defense solutions to keep your fleet safe from an assortment of threats, such as:

• Behavioral analytics mapped to the MITRE ATT&CK framework to protect against known malware, and their variants and reduce the risk of unknown threats
• Stop modern malware threats and attacks, just to name a few:
  • Ransomware
  • Trojans
  • Spyware
  • Potentially unwanted programs (PuP)
  • Cryptojacking
  • Command & Control (C2) server traffic
  • Malicious data exfiltration
  • Living-off-the-Land (LotL) attacks
  • Zero-day phishing attacks
  • Man-in-the-Middle (MitM) attacks
• Keep endpoints safe from zero-day phishing attacks by blocking malicious domains and secure against apps used in targeting users, such as:
  • SMS (text messaging)
  • Social media
  • Email clients
  • Messaging clients
• Customizable access controls for applications that limit access to sensitive data and enable restrictions in the execution of malicious apps

Have you ever realized that nearly each software update released today for any OS includes patches that address security vulnerabilities? Despite Apple’s history of developing some of the most secure operating systems, the myriad threats found within the modern threat landscape make it difficult to account for every possible vulnerability as they range in severity, exploit method and how it operates once endpoints are compromised.

This variation is affected by several factors, such as the apps and services in use on the affected device, the types of security protections actively being used and the level of risk – both from third parties and user-initiated. Though signature-based activities can denote malicious activity, it may be difficult to know exactly what circumstance led to the endpoint becoming compromised or how severe the impact is. This is where robust telemetry data enables threat hunting to fill in the gaps and effectively makes investigations possible and productive. Lastly, the rich visibility gained into devices, behaviors and protection against known and unknown threats provides organizations with the evidence required to confidently know their fleet is compliant, with their endpoints secure, data safe and user privacy upheld.

Remediation

Last but certainly not least in this trifecta of security elements, is arguably the most critical: remediation. After all, it serves the role of eliminating the threat from your endpoints – without which – devices would remain affected and therefore endpoints, users and data effectively compromised.

Some examples of how Jamf endpoint security and mobile threat defense solutions bring powerful remediation capabilities to your organizational fleet are:

• Creating security policies aligned to organizational policies, ensuring endpoints are and remain compliant with regulatory requirements, industry best practices and regional laws
• Develop automated incident response workflows to mitigate threats quickly and efficiently to maintain device security
• Establish baselines that ensure compliance by aligning with CIS Benchmarks to both audit and fortify endpoint security
• Extends detection, prevention and remediation capabilities through integration with first- and third-party solutions via Jamf’s Risk API

As many IT and Security admins would agree, it is a best practice to automate remediation workflows so that they jump into action the second anomalies are detected. Not every scenario will benefit from this solution though. Since not every security threat is the same, remediation workflows benefit from being robust yet flexible. This means that, depending on the situation, an advanced, automated workflow could mitigate risk before it has the chance to grow into something more, like if a user downloads a suspicious application. The workflow can automatically delete the download before the malicious code has a chance to execute.

Conversely, allowing for user-initiated remediation options empowers users to take an active role in the management of their devices by granting them the agency to resolve minor issues when alerted on their devices. This is especially useful in remote/hybrid environments when IT or Security teams may not be available to help. For example, thanks to its tight integration with Apple, when a critical update or new version of macOS/iOS/iPadOS is released, Jamf’s same-day support means that users can update their devices on their timetable – not ours. This lightens the burden on administrators by permitting users to keep their devices up to date while being able to benefit from any new features and workflows that help keep them more productive.

Jamf designed, Apple first…

But not Apple only.

Jamf prides itself on being able to provide solutions that help organizations succeed with Apple and has been doing so for decades. That said, the modern threat landscape combined with the evolution of the work environment, has fueled the adoption of Apple in the enterprise, increased reliance on mobile devices by organizations and the growing need to keep sensitive data secured while being able to access and work with it from both company owned and BYO devices – in service to keeping users productive from anywhere, at any time and from any modern device.

These needs have driven support for macOS, iOS and iPadOS first as Jamf has always done. But it has also driven support for mobile devices, such as Android and Windows, in concert to extend, standardize and maintain endpoint security across your entire mobile fleet.

The unified endpoint security strategy is echoed in Jamf’s belief – one that it shares with Apple – that the user experience is tantamount to success. By developing solutions that empower, device, user and data security are maintained and operate out of the way in the background, ensuring the user experience is upheld and never an afterthought.

Key takeaways:

• Align with Apple security and privacy frameworks to provide comprehensive, same-day support for all Apple-centric hardware, software, operating systems and features.
• Centralized visibility into all layers of defense is critical for organizations required to demonstrate endpoint compliance in protecting against security.
• Automatic remediation workflows, like quarantining malware before it’s able to run and providing alerts about malicious activity in real time.
• Block zero-day phishing attacks in real-time, regardless of which app or browser was used to access the content.
• Work across all the platforms your users rely upon for work, including Mac, iOS, iPadOS, Android and Windows.
• Stop known malware and detect new variants of malware that haven’t been seen before.
• Leverage Jamf Risk API to securely integrate with first- and third-party solutions to expand capabilities.
• Identify exploits based on the behavioral characteristics of those attacks to learn how they happened, for example, risky behavior or suspicious apps.
• Robust telemetry data makes threat hunting and investigating incidents possible, productive and comprehensive.
• Rich visibility into protections against known and novel attacks provides organizations with the evidence they require to audit endpoints and strengthen security.

***

This post is one of a series on a holistic approach to security. See a roundup of all of the posts, or read one below:

• How Trusted Access can protect your organization's data
• Mobile Device Management (MDM): a basic building block for tighter security
• Zero-touch deployment can keep your devices safe
• Zero-Trust Network Access (ZTNA) addresses modern data security needs
• Automated application management keeps everyone more secure
• Modern endpoint protection can mitigate new security challenges
• How inventory management affects security
• How Self Service can mitigate risk from third-party apps
• How identity and access management can protect your users and your sensitive data
• How content filtering and safe internet can keep users —and your data— safer
• The importance of visibility in compliance and security