What is endpoint security?

No matter the size or complexity of your business, you handle confidential data regularly. This could be customer information, payment data, employees’ personal information, proprietary knowledge and so on.

And if you handle this data you have the responsibility — legally and for your reputation — to keep this data secure. This is no small feat, and in this blog post we won’t go in depth about how to defend your data. But we will talk about one aspect: endpoint security, also called endpoint protection.

What is endpoint security?

Your endpoints are devices that connect to your company network. This could be computers, mobile devices or servers, as some examples. As employees become more mobile, they access confidential information from outside your company’s guarded network perimeter. They might connect their work laptops to public Wi-Fi networks or work from their personal phones. This requires more advanced endpoint security strategies than historically required.

Securing these endpoints means:

• Keeping them free from malware and other threats
• Enforcing security policies, like a complex password
• Knowing the device’s security status
• Regularly updating the operating system (OS) and software

Endpoint protection is critical for defending your data, since these endpoints are what expose your data to the outside world. This exposure is necessary for employees to do their job, but it also creates risk.

Common threats

So what are we protecting endpoints from, exactly? Let’s go through a few common threats.

Phishing

Phishing, and other social engineering attacks, are the most common way attackers find their way in your data. Phishing tries to trick the user into giving the attacker something they want. Some examples are:

• An email from it-department@yourcompany.net says that everyone needs to change their password because of a new company policy. Not looking carefully, you don’t notice that it isn’t your IT department’s real email address. You follow the link and attempt to change your password, not knowing you’ve given attackers your information.
• You receive an email that looks like it’s from your bank. It says you need to change your password immediately, or risk losing access to your account. It has a link that takes you to a page that resembles your bank’s login page, and it has a place for you to enter your information.
• You are in charge of financials for your company. You receive an email from what appears to be a vendor. It contains an attachment titled “invoice.” They ask you to approve the invoice, but when you try to open the attachment, it installs malware on your device.

These threaten your endpoint security in a few ways. If a user gives their login information to an attacker, that attacker now has a way to enter your system. They may be able to move to other more sensitive sections of your network, including databases with personal information.

Phishing attacks sometimes attempt to download malware on your system. This can cause a number of other problems too, which we’ll dive into next.

Malware

Malware, or malicious software, comes in many forms. Whatever the form, the intention is generally to harvest sensitive data, cause disruption or make money by some other means. Some examples of malware are:

• Ransomware is malware that encrypts and locks all of your data. Attackers will demand a ransom payment for you to get access to your data back. They may even demand more money to delete their data from their system (but there’s no way to verify they did).
• Trojans masquerade as real software. For example, you might think you’re downloading innocent photo-editing software from a third-party website, but in reality it also carries malware. These can also create “backdoors” that allow attackers to enter and exit your system as they please.
• Viruses and worms are malware types that spread to other systems. Viruses spread through some form of “contact,” like an email or even by being on the same network. Worms are able to spread without this contact by other means.
• Spyware does what it sounds like — it spies on you. It might record what you type, click or search in order to collect your information.

Spotting malware can be difficult. Security software can identify it by recognizing certain files or observing suspicious behavior on the device.

Network threats

Public Wi-Fi is convenient, but you can never guarantee that it is safe. Attackers use this convenience to their advantage for man-in-the-middle and other similar attacks. They are able to intercept a user’s connection and see what they are doing. This can leave any information they view or share vulnerable.

Insider threats

Insider threats come from within your organization. It could be a user accidentally clicking on a phishing link, or an unhappy employee using their inside knowledge to help attackers. Insider threats can be hard to spot because legitimate users are often accessing resources they’re allowed to use. Detecting this requires an understanding of what typical behavior looks like for these users and monitoring for strange behavior.

Endpoint security tools

Now that we know some of the threats we need to defend against, what endpoint security tools can we use to accomplish this?

Mobile device management

Mobile device management (MDM) software is the foundation for understanding your devices. By enrolling devices into your MDM you can:

• Keep an inventory of devices accessing your company data and resources
• Remotely configure devices
• Deploy software and keep it up to date
• Keep the operating system (OS) on the latest version
• Enforce password policies, including multifactor authentication

All of this is important to security.

Endpoint protection platform

An endpoint protection platform (EPP) is an important addition to your security stack. An EPP works by:

• Preventing malware from entering and/or executing on your device
• Automatically remediating potential issues
• Detecting suspicious activity and spotting indicators of compromise

EPPs are useful for collecting behavioral analytics that admins can use to spot patterns of suspicious activity.

User education

Attackers use social engineering attacks like phishing very frequently. Warning users about what these attacks look like can go a long way in thwarting these attempts. Users should also know how to report a potential phishing attack to IT. Some topics to teach users include:

• The signs of a phishing attack
• What to do if they accidentally clicked on a phishing link and/or gave attackers information
• What risky behavior looks like, like downloading software from a third-party website
• Signs of malware on their device and what to do

Intrusion prevention system

Sometimes the best offense is a good defense. An intrusion prevention system (IPS) can block access to malicious sites, so even if users do click on a phishing link, they can’t access the content. An IPS can determine whether a site is dangerous by:

• Manual lists created by IT and/or Security teams
• Referencing a list of known malicious sites
• Using artificial intelligence and machine learning to intelligently determine if a site is suspicious