The best way to understand endpoint security is to understand its evolution.
In the past, antivirus--also known as endpoint protection platforms (EPP)--was used as the primary defense vehicle to protect endpoints. However, they relied primarily on signatures, or digital footprints that attackers could easily bypass. As far back as December 2012, the New York Times reported that antivirus missed the vast majority of malware. In 2013, FireEye reported that 80 percent of malware was used just once.
To contend with the growing rates of infection and attack enabled by poor EPP defenses, endpoint detection and response (EDR) tools were developed to help identify persistent forms of attack. Security professional needed EDR to answer key questions including:
- How did the attack happen?
- How big was the attack?
- What was the root cause?
In the beginning, EDR didn’t provide an ability to block attacks, it was mostly a forensics tool. However, in time many EDR tools added blocking. Today, EDR is morphing into MDR--managed detection and response. MDR is simply EDR only it is delivered as a service to free the customer from tactical management.