Endpoint protection is a pretty big deal
when it comes to securing your network,
but endpoint protection solutions
come in a bunch of different shapes and sizes.
So before we jump into what Cisco brings to the table,
we need to talk about the different kinds
of endpoint protections that are available to us.
Let's jump on a whiteboard and talk about the differences
in different kinds of endpoint protection.
The threat landscape itself, the attacks that
are being carried out against us are constantly changing,
and guess what?
The solutions for protecting ourselves against those attacks WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The solutions for protecting ourselves against those attacks
are also constantly changing, and we're now
in an era, where we have to differentiate
between the different kinds of endpoint protection solutions
that we have.
So what we're talking about now is endpoint protection
platforms and endpoint detection and response platforms.
Those are two different solutions
that both work together to accomplish the same thing,
and that's protecting our endpoints.
So let's talk about the difference between EPPs, EDRs, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's talk about the difference between EPPs, EDRs,
and then a little extra thing called XDRs here
in this Nugget.
When we're talking about endpoint protection platforms,
what you're really saying here is
this is our traditional antivirus
or anti-malware solution.
This is going to be installed on all of our endpoints
like desktops and servers, as long as it doesn't impact
your server's performance.
The idea is we have a user like Bob here.
Bob is sitting on their computer, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Bob is sitting on their computer,
and we'll install an antivirus solution on this computer.
That way as files enter the computer,
the antivirus solution will scan the file
and determine if it matches some sort of signature
or hash that it knows is bad.
If the antivirus determines that it's bad,
it can do things like quarantine the file, fix the file,
or correct it by removing the malicious code, or just
plain old delete the file.
The idea is that it stops it at the point in time WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The idea is that it stops it at the point in time
that the file enters our network.
This is kind of like a firewall, except for it's not a firewall.
It's not working the network itself,
it's working with the individual files as they're entering.
The kicker to that is the malware is constantly evolving
and all it really has to do to get into the network
is just beat this solution at the point in time.
That's a really important word to understand
or here is point in time.
I guess that's more than one word. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I guess that's more than one word.
It's really important to understand
that the file is trying to beat the endpoint protection
platform at the point in time that it's being scanned.
Once it beats it, it's in.
It has full access to servers, the network, and all
of the other things that we have going on in our environment,
and that's where the EDRs come into play.
The EDRs go beyond this, whereas the endpoint protection
platform is, in fact, monitoring files at this point in time
that they enter the network and it's
trying to stop malicious files from entering the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
trying to stop malicious files from entering the network.
The endpoint detection and response solution
constantly monitors all files within the environment.
It looks for anomalous behavior.
How do I spell anomalous?
Hang on, I've got to pause this.
Here we go.
A-N-O-M-A-L-O-U-S. There we go.
Anomalous behaviors.
It's looking for anything that just seems out of the norm.
It learns what is normal for our computer or our entire network.
So once a file makes its way onto an endpoint, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So once a file makes its way onto an endpoint,
the EDR will actually continue to monitor and analyze a file,
because some malicious files make their way in and then wait
to perform the attack once they verify
that they're past the EPP.
So the EDR will continue to monitor what's
going on our particular device and then
use analytics, machine learning, and AI to constantly report
back to a centralized solution, where
we can monitor threats that are ongoing
in our entire environment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in our entire environment.
That way we can determine what threat has occurred,
how it entered the environment, what it's doing,
what is it trying to do to the environment, what trajectory
is it on, and what are our steps to remediate it.
The endpoint detection response is really taking it up a notch,
but you can see how these are two separate solutions.
One is trying to stop files from entering into the environment,
the other one is maintaining the security of our environment
in an ongoing monitoring way. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in an ongoing monitoring way.
And one of the cool things that Cisco did
is they noticed these were two different solutions,
and they thought, you know what?
We could probably make it one solution,
and that's called Cisco AMP for Endpoints.
In the next Nugget, we're going to talk
a lot more about what Cisco AMP for Endpoints does for us
and how it uses the best of both worlds
when it comes to EPPs and EDRs.
But that sets up what EPPs and EDRs are.
I did say I was going to mention one more thing,
and that's now called the XDR. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that's now called the XDR.
This is a EDR on steroids, where it's
going to be using advanced analytics reporting machine
learning techniques to monitor the entire network
in a centralized fashion.
This is a new and upcoming solution
that you should just be aware exists out there in the wild,
even though it may not be on an exam environment.
So that sets up the difference between endpoint protection
platforms and endpoint detection and response platforms.
I hope this has been informative for you,
and I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'd like to thank you for viewing.