Would someone explain what endpoint security is, exactly? What do companies like McAfee and Symantec sell with their endpoint security suites?
I also would like to learn if endpoint security involves a hardware appliance which handles typical endpoint security. If both of these companies do sell a hardware appliance which runs AV and firewall applications, then does it use a MCU or SoC or is it just a single CPU processor core?
Endpoint security refers to the security controls of laptops or desktops to apply below controls:
Detect malicious activity
Application controls: example; Block malicious applications from running user from running
Privilege management: Remove local admin rights from users, Elevate privilege on-demand for authorized applications
Credentials theft protection: example Contain attacker to the endpoint limit lateral movement
Anti virus: run periodic scans on machines
Apply the latest Patches to OS and applications
Some endpoint detection tools provide centralized management tool which allows the admin to monitor and manage all the users in one place.
A few examples on Endpoint security tool provider are: Forcepoint, Cyberark, Kaspersky
Endpoint security is something of an industry effort to group several security controls (anti-malware, firewall, intrusion preventions, and a few types of host security) into a single product. Although this could be standalone software for a single computer it is usually sold by companies as software to apply to all of an organizations computers where it can be centrally monitored and controlled from a single console or web page.
Note that this is something of a vague vendor term that although it has industry recognition it's not clearly defined and will probably continue to evolve over the next few years.
I got this in flat 30 secs over web. It "includes behavioral anti-malware, smart scanning, and dynamic whitelisting, in addition to essential antivirus, antispam, web security, firewall, and intrusion prevention." End point refers to the last node /entry point in network and can be PC, Laptop, Server, etc. Most of the End-point solutions are software to be installed on systems and are centrally managed. I am not aware of any hardware end point solution. See typical requirement for the software here.
P.S.: Please do a bit of research and avoid having lots of assumption.
The best way to understand endpoint security is to understand its evolution.
In the past, antivirus--also known as endpoint protection platforms (EPP)--was used as the primary defense vehicle to protect endpoints. However, they relied primarily on signatures, or digital footprints that attackers could easily bypass. As far back as December 2012, the New York Times reported that antivirus missed the vast majority of malware. In 2013, FireEye reported that 80 percent of malware was used just once.
To contend with the growing rates of infection and attack enabled by poor EPP defenses, endpoint detection and response (EDR) tools were developed to help identify persistent forms of attack. Security professional needed EDR to answer key questions including:
In the beginning, EDR didn’t provide an ability to block attacks, it was mostly a forensics tool. However, in time many EDR tools added blocking. Today, EDR is morphing into MDR--managed detection and response. MDR is simply EDR only it is delivered as a service to free the customer from tactical management.
