{"id":40101,"date":"2021-06-21T08:48:04","date_gmt":"2021-06-21T07:48:04","guid":{"rendered":"https:\/\/www.intelligentcio.com\/africa\/?p=40101"},"modified":"2021-06-21T08:49:45","modified_gmt":"2021-06-21T07:49:45","slug":"securing-the-endpoint","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/africa\/2021\/06\/21\/securing-the-endpoint\/","title":{"rendered":"Securing the endpoint"},"content":{"rendered":"\n

Endpoint security management is a policy-based approach to network security that requires endpoint devices to comply with specific criteria before they are granted access to network resources. Endpoints can include PCs, laptops, smart phones, tablets and specialised equipment such as bar code readers or point of sale (PoS) terminals. Industry experts share insights on how CIOs can improve their endpoint security posture.<\/em><\/strong><\/p>\n\n\n\n

Endpoint security management systems, which can be purchased as software or as a dedicated appliance, discover, manage and control computing devices that request access to the corporate network. Industry experts share insights how CIOs can improve their endpoint security posture by developing comprehensive endpoint security management policies.<\/p>\n\n\n\n

Pundits warn that in today\u2019s world, without the use of proper tools such as endpoint protection on host computers and proper data security practices, users with careless attitude towards using unencrypted portable devices such as laptops, tablets and USB storage leave themselves and others exposed to possible data breaches that could be costly to the end user and can even compromise an entire organisation or government.<\/p>\n\n\n\n

According to Mordor Intelligence, the cybersecurity market in the Middle East and Africa (MEA) was valued at US$1,903.59 million in 2020 and it is expected to reach US$2,893.40 million by 2026, registering a compound annual growth rate (CAGR) of 7.92% during the forecast period of 2021 to 2026.<\/p>\n\n\n\n

Edison Mazibuko, Technical Director, DRS \u2013 a Cyber 1 company, said endpoint solutions had to evolve to cater for the distributed workforce whilst ensuring the same standard of security is provided inside corporate networks. Mazibuko said organisations need to consider breaking security silos by consolidating solutions and getting more from their endpoint security. \u201cHow these endpoints are managed is vital as we are seeing more organisations moving to the SaaS model, therefore, reducing complex infrastructure,\u201d he said. \u201cHaving an endpoint solution with automated workflow capability will be the difference between keeping up with threats or playing catchup. The ability to integrate endpoint security with third-party integrations, such as threat intelligence feeds, will give any enterprise the edge against adversaries.\u201d<\/p>\n\n\n\n

Nicolai Solling, Chief Technology Officer, Help AG, said when choosing solutions for endpoint security management, CIOs must ensure that any potential solution is evaluated in terms of how well it can generate accurate telemetry and data in order to make the correct security decision and in terms of how good the solution is at detecting and stopping malicious activity on the endpoint.<\/p>\n\n\n\n

Solling said it is also crucial to understand how an endpoint security solution would be integrated with existing solutions. \u201cEstablishing visibility on the endpoint is also key, as the endpoint is the foothold that cyber attackers use to reach their end target \u2013 corporate data,\u201d he said. \u201cFinally, before creating a plan for endpoint security management, CIOs should be clear on whether they can utilise cloud for storing data and managing their agents, because if not, the range of endpoint security solutions they can choose from is narrowed down significantly.\u201d<\/p>\n\n\n\n

Solling said it can be difficult to select an endpoint solution, as all endpoint security solutions fundamentally try to achieve the same thing \u2013 protecting the endpoint. \u201cThe threats they protect against are also similar, meaning that the value propositions and capabilities of different solutions are often alike. Evaluating the efficiency of a solution is also a relatively complex task, during which several factors need to be taken into consideration,\u201d he advised. \u201cAdditionally, the discussion around choosing a solution often focuses on issues of economics, rather than understanding what the solution delivers.\u201d<\/p>\n\n\n\n

Shane Grennan, Channel Director Middle East, Fortinet, said to effectively address today\u2019s advanced threats, organisations require visibility and control across their entire distributed networks.<\/p>\n\n\n\n

Grennan said and while many security solutions are limited in terms of their capabilities, extended detection and response can help fill the gap. \u201cOrganisations must bring together all their security tools in a single location for enhanced visibility. For example, they can consolidate network security, endpoint security, email security and cloud security monitoring in a single platform to ensure the whole is greater than the sum of its parts,\u201d he said. \u201cThis enables solution providers to deliver a differentiated customer offering that improves security posture while reducing security operations overhead.\u201d<\/p>\n\n\n\n

Even before the implementation, when evaluating an endpoint solution, resellers should consider different key factors in choosing the right vendor.<\/p>\n\n\n\n

Attack surface<\/strong><\/p>\n\n\n\n

According to Grennan, man vendors\u2019 solutions do not cover the entire attack surface, instead, they focus on securing one or a few different attack vectors individually, such as cloud, email or endpoints and call it XDR or extended detection and response. \u201cWhen this is the case, XDR cannot demonstrate its true value, which lies in its ability to combine components across multiple attack vectors,\u201d he said. \u201cSecondly, even though they may offer a full range of security products and solutions, vendors that have acquired these components (especially ones with large install bases) individually over time may lack the resources and commitment for tight integration needed for higher-value analytics and automation. Third, most all vendors seem to focus on extended detection and extended response, skipping over the middle stage of investigation and validation. As a result, human security professionals still have significant effort ahead of them, especially as threat and alert volumes continue to grow.\u201d<\/p>\n\n\n\n

Samer El Kodsi, Channel Sales Director, Emerging Markets, EMEA, Palo Alto Networks, said with the massive technological innovation over the years, the cybersecurity sector has had to adapt and create new solutions for better safety of people and organisations. \u201cAbout 20 years ago, an organisation\u2019s data was behind corporate headquarters but now people have immediate access to data from the cloud through laptops, tablets and other devices,\u201d he said. \u201cBecause we now have data everywhere \u2013 it is important to shift from the \u2018layered defence model\u2019 to the \u2018zero trust model\u2019, which is the ability to microsegment parts of your data or network environment and apply visibility and control. With the zero trust model, you can microsegment all your critical assets including machine, server or endpoint from the rest of the network with full visibility and available controls.\u201d<\/p>\n\n\n\n

Pitfalls to avoid<\/strong><\/p>\n\n\n\n

With endpoint protection management the number one priority for many organisations in MEA, what pitfalls should CIOs avoid when implementing endpoint security solutions?<\/p>\n\n\n\n

Solling said CIOs should avoid thinking that all solutions are created equal. He added that the market contains many solutions with great capabilities, but it is also important to assess the effort required to operate and manage the solution before implementing it. \u201cRunning and operating an endpoint solution is relatively simple and most organisations of a certain size have this capability. However, getting value out of the data generated from a solution is a specialised task that requires insight into how systems and applications operate and being able to decipher data points is what takes a solution from good to great,\u201d he enthused. \u201cThus, organisations should build their reservoir of these advanced skills through investing in existing employees with specialised training programmes, as well as investing in new hires to bring endpoint security experts into the organisation.\u201d<\/p>\n\n\n\n

According to Mazibuko, many organisations are migrating from endpoint protection platforms(EPP) to endpoint detection and response(EDR) route. \u201cXDR is a new approach that provides visibility across endpoint, cloud, network and third-party data. This enrichment truly breaks down the silos taking endpoint security management to the next level,\u201d he explained.<\/p>\n\n\n\n

He said the convergence of network and security has brought the industry the secure access service edge(SASE). \u201cThis cloud-native model provides the benefit of a unified platform without the burden of legacy infrastructure. The solution is perfect for the hybrid work model, allowing efficient and secure access to cloud resources and seamless access to on-premises applications,\u201d he said. \u201cThis convergence brings the best in connectivity(SD-WAN, NaaS) and security (FWaaS, endpoint security, web security and network security).\u201d<\/p>\n\n\n\n

Remote working<\/strong><\/p>\n\n\n\n

Given that most organisations are promoting remote working and adopting hybrid work models, CIOs need to factor in several considerations and scenarios when developing a comprehensive endpoint security management policy.<\/p>\n\n\n\n

Meriam Elouazzani, Regional Channel Manager META, SentinelOne, said with many employees now working from home, organisations are exposed to a vastly increased attack surface and must re-assess their endpoint security strategies to ensure they are equipped for this new environment.<\/p>\n\n\n\n

Elouazzani said it is no trivial task to provide the same levels of security for all these employees, operating outside the (relatively) safe perimeter of their offices and local intranet. \u201cIt\u2019s best if organisations use endpoint security software that protect it against unknown forms of ransomware and other cyberattacks. One way to do that is through endpoint protection platform (EPP) that uses predictive execution inspection engines that go beyond file-based analysis \u2013 even mathematic algorithmic analysis \u2013 that observes the actual execution of every system process or thread, in real-time,\u201d she said. \u201cBy understanding the execution behaviors of all applications, programs and processes in real-time, EPP should provide ultimate defense against any type of attack.\u201d<\/p>\n\n\n\n

According Elouazzani organisations must adopt a holistic endpoint security management practice and for this, they need complete visibility into their cyber environment. \u201cYou can\u2019t protect what you can\u2019t see, so it\u2019s imperative for organisations to be able to map what is on a network and fingerprint devices to see what is connected,\u201d she said. \u201cWith the help of an AI-driven endpoint protection platform, organisations can easily identify and see each and every device connected to the network.\u201d<\/p>\n\n\n\n

Palo Alto Networks\u2019 El Kodsi, saidclearly, the pandemic has altered the ways of living, working and doing business, forever. El Kodsi said with the adoption of remote or hybrid work models, solution providers in the endpoint space need to work closely with CIOs, CISOs or IT heads of organisations and have full visibility into remote user activity. Rather than only investing in point solutions, they need to help their clients to consider security platforms to maximise integration between systems,\u201d he said.<\/p>\n\n\n\n

At Help AG, Solling said when employees are working remotely, the most important security capability an organisation has is the ability to deliver a robust endpoint. He noted that endpoint security solutions, endpoint configuration hardening and user awareness are key to achieving this. \u201cIt is also crucial to achieve visibility and protection independently of the user\u2019s location, ensuring security efficiency whether an endpoint is on the corporate network or not,\u201d he said. \u201cCloud services are massively useful here, but they come at the cost of the organisation trusting the endpoint security vendor with potentially sensitive telemetry data. Therefore, any evaluation should include an assessment of what data is required for the vendor to deliver a successful service and how the vendor is protecting the organisation\u2019s data.\u201d<\/p>\n\n\n\n

Looking ahead, Solling noted that endpoint protection has undergone phenomenal development over the last five years and most of it stems from the innovative ability to embed Machine Learning in an agent. He added that another major shift is that agents now typically send the telemetry data they generate into large data lakes operated by the vendors of the solution. \u201cThe more data, the better the solution is at early detection of changes in the behaviour of threats. To an extent, the data that agents produce is becoming the real product offered by vendors, as more data means more protection,\u201d he said.<\/p>\n","protected":false},"excerpt":{"rendered":"

Endpoint security management is a policy-based approach to network security that requires endpoint devices to comply with specific criteria before they are granted access to network resources. Endpoints can include PCs, laptops, smart phones, tablets and specialised equipment such as bar code readers or point of sale (PoS) terminals. Industry experts share insights on how […]<\/p>\n","protected":false},"author":18,"featured_media":40102,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[9058,5,328,36,9057,9059,13,9060],"tags":[11986,1213,35,122,14510,124,13127],"class_list":["post-40101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-east-africa","category-enterprise-security","category-features","category-intelligent-technology","category-north-africa","category-south-africa","category-top-stories","category-west-africa","tag-drs","tag-endpoint-security","tag-fortinet","tag-help-ag","tag-mordor-intelligence","tag-palo-alto-networks","tag-sentinelone"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/40101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=40101"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/40101\/revisions"}],"predecessor-version":[{"id":40103,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/40101\/revisions\/40103"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/40102"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=40101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=40101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=40101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}