Have We Forgotten the Endpoint Client? IT Security Blog

About the job

Why is the endpoint often given little attention in IT security? Is the endpoint no longer the last line of defence or the first early warning system? Perhaps it is because the BYOD mentality exists in minds but has not yet gained the upper hand. How many "BYO" devices are in use in your company compared to corporate clients can be an interesting indicator of how advanced this mentality is in your organisation. Are sensitive data and especially files entrusted to these foreign devices? Or are the truly sensitive files and accesses still performed from company-owned devices? Digital workflows are not yet so mature that no files need to be written or exchanged. Especially in the core areas of companies, automated data processing stalls and Excel, Word, drawings, and developments are exchanged and edited. In these core areas, company PCs and laptops are still very common, and it may take one or two more IT generations before this situation changes drastically. The time to neglect security on the endpoint therefore seems a few decades too early to me. If you cannot fight on all fronts simultaneously, you should at least focus on those that make you particularly vulnerable. Many things change, some remain good. The multi-layer protection approach remains a central part of IT security, even in times of borderless networks and zero trust computing. It is also (or especially?) negligent today to let client security play on Court Number 2 (in Wimbledon, this would aptly be "The Graveyard"), while other security aspects constantly play on the Centre Court. The endpoint security landscape has seen many new players in recent years, challenging the established professionals who have adapted to the new style of play. Today, IT security often revolves around hot topics like cloud and containers, serverless, or secure application design. Security teams in modern companies are thematically very close to network teams, sometimes overlapping or even merging again. Security architects, acting as referees on the field, deal with network segments and zones, possibly with in-house applications and third-party obligations regarding data processing of their solutions. Rarely do they delve into client-specific requirements in detail. Client teams operate with little contact with security teams, already fighting a match against application incompatibilities, Windows updates and patches, and the peculiarities of too new or outdated hardware. For security, it is enough if log data is sent to a huge data sink and a Gartner Top 5 antivirus is installed. Rarely do client and security teams play doubles together; usually, they feel like they are on different halves of the court. This style of play must be broken to ensure an adequate level of protection across the entire IT environment. The best team wins. EDR solutions that correlate data with network threat detection, machine learning technologies for file access, behaviour detection during file execution, application control and privilege management, or isolation of potentially dangerous content from the client computer are technologies that can be used today. Through closer collaboration of client and security teams, networking of individual components, and new possibilities of endpoint security products, preventive measures (prevention) become more effective and visibility (detection) increases. I still need to zone and segment my networks. I still need to secure my applications and cloud access. But I must not neglect the client segment and allow malware an easy game on clients. And now? It is not just about a single pane of glass where I must use all components from the same manufacturer. It is also not about feeding huge amounts of data into a SIEM. That may be the solution for some companies but not necessarily the right solution for mine. Also, a SOC or managed SOC will not be the solution for all companies. By cleverly choosing my security products and working hand in hand between client, network, and security teams, much can already be achieved. In IT, some things take longer than we hope, and until we can do without working with files and data-processing client computers are no longer attack targets, we will still need to invest in protecting client computers. Links www.avantec.ch/themen/endpoint-security/ The article Have We Forgotten the Endpoint Client? first appeared on Tec-Bite.