Latest / Tech Talks With Kinsoft / Endpoint Detection and Response (EDR)

Transcript

Endpoint Detection and Response (EDR) · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. This is your
• 0:02
  guide, really, for getting up to speed on the
• 0:04
  tech that matters. Today, we're doing a deep
• 0:06
  dive into something that's, well, it's gone beyond
• 0:09
  just important. It's absolutely critical for
• 0:12
  keeping your business safe. We're talking about
• 0:14
  endpoint detection and response, EDR. Think of
• 0:18
  it like upgrading from just a standard lock on
• 0:21
  your front door to, I don't know, a full -blown
• 0:23
  intelligent surveillance system for your entire
• 0:25
  digital world. That's a great way to put it.
• 0:28
  Yeah. We're going to unpack why EDR isn't just,
• 0:30
  you know, another software package to install.
• 0:33
  It's really become a cornerstone of modern cybersecurity.
• 0:36
  We'll dig into what it can actually do, how it's
• 0:39
  such a big shift from, say, traditional defenses
• 0:41
  and maybe some crucial things to think about
• 0:43
  to make it work effectively for you. Right. So
• 0:45
  our mission today is basically to arm you with
• 0:47
  the essential knowledge about EDR. We want you
• 0:50
  to understand why it matters so much, some common
• 0:53
  mistakes people make when setting it up, and
• 0:55
  how these advanced integrated solutions, especially
• 0:58
  looking at leaders like Acronis, are really shaping
• 1:01
  what's next for endpoint security. You might
• 1:03
  be sitting there thinking, my antivirus is fine,
• 1:05
  but you're probably about to find out that cyber
• 1:08
  threats have evolved way, way beyond what that
• 1:11
  can handle alone. Okay, so let's unpack this
• 1:14
  properly then. EDR, we hear the acronym all the
• 1:16
  time. But for someone maybe still thinking in
• 1:18
  terms of just traditional antivirus, what is
• 1:21
  it exactly and why is it suddenly so crucial?
• 1:23
  Yeah, it's a really good question. And the difference
• 1:25
  is, well, it's fundamental. Your traditional
• 1:27
  antivirus, it works mostly like a bouncer with
• 1:30
  a list, right? It checks for known bad guys using
• 1:33
  signatures. If it recognizes something bad, it
• 1:35
  blocks it. End of story, usually. EDRs, it's
• 1:38
  a whole different approach. Think of it more
• 1:39
  like a proactive 24 -7 digital detective agency
• 1:43
  operating inside your network. It's constantly
• 1:46
  monitoring and recording pretty much everything
• 1:48
  that happens on your endpoints. Endpoints being?
• 1:50
  Sorry, your workstations, servers, laptops. Okay,
• 1:57
  so it's less about checking a list of known criminals
• 1:59
  and more about watching what's happening right
• 2:01
  now, spotting suspicious behavior even if it's
• 2:04
  never been seen before, like moving from reactive
• 2:07
  to, well, truly proactive. Precisely. That's
• 2:11
  the key. EDR gives you this incredible visibility
• 2:13
  into what's actually happening on those devices.
• 2:16
  Imagine like a super detailed logbook of every
• 2:19
  program that runs, every network connection that's
• 2:22
  made, every file that gets touched. And this
• 2:24
  data, things like process executions, network
• 2:26
  connections, it isn't just stored away. It's
• 2:28
  actively analyzed. This constant logging and
• 2:31
  analysis lets security teams spot subtle anomalies,
• 2:35
  suspicious patterns before they blow up into
• 2:37
  a major incident. That's how EDR can catch those.
• 2:40
  really nasty threats like zero day attacks, the
• 2:43
  brand new ones, or even fileless attacks that
• 2:45
  just bypass traditional AV because there's no
• 2:47
  malicious file to scan. And this proactive piece,
• 2:50
  it can slash incident response times. We're talking
• 2:52
  potentially going from days of investigation
• 2:54
  down to just hours. That's a huge win for keeping
• 2:57
  the business running. That makes a lot of sense.
• 2:59
  Catching things before they explode. Yeah. That's
• 3:02
  compelling. So beyond just spotting threats early,
• 3:05
  what are the other big wins? What are the tangible
• 3:07
  benefits businesses see when they put in a solid
• 3:09
  EDR solution? It really stands out. Well, one
• 3:12
  of the things that's often quite eye opening
• 3:14
  for businesses is how EDR changes the game for
• 3:17
  incident response, especially around efficiency
• 3:20
  and scale. Think about the old way. You suspect
• 3:23
  a machine's infected. Often you'd have to physically
• 3:25
  grab it, take it offline, start a lengthy forensic
• 3:28
  analysis. Very disruptive. EDR completely flips.
• 3:32
  security teams can investigate endpoints remotely
• 3:34
  potentially hundreds or thousands at the same
• 3:36
  time all without pulling them offline or disrupting
• 3:39
  the user imagine the time saved the resources
• 3:41
  saved especially if you're dealing with a widespread
• 3:44
  attack downtime is minimized dramatically so
• 3:47
  instead of that forensic shutdown grinding things
• 3:49
  to a halt you're getting live intelligence without
• 3:51
  stopping workflow that sounds like a massive
• 3:54
  productivity boost It absolutely is. And another
• 3:57
  big plus is just superior visibility across your
• 3:59
  whole network. By tracking all this detailed
• 4:02
  activity, user behavior, system changes, you
• 4:05
  get the power to spot those weird patterns much
• 4:07
  earlier. You know, like maybe one account starts
• 4:10
  accessing files it never touches or data starts
• 4:12
  moving out in unusual ways. Things that could
• 4:15
  signal ransomware starting up or malware spreading
• 4:17
  sideways. It's about catching that whisper before
• 4:20
  it becomes a full -blown crisis. And when a threat
• 4:23
  is found, EDR allows for Really rapid, flexible
• 4:26
  responses. Real -time alerts pop up, and you
• 4:29
  can often trigger automated actions. Like what
• 4:31
  kind of actions? Things like automatically isolating
• 4:33
  a compromised machine from the rest of the network
• 4:35
  with just a click. Or killing a malicious process
• 4:38
  instantly. Stops the bleeding right away. And
• 4:41
  here's where it gets really interesting from
• 4:43
  a business perspective, too. EDR can significantly
• 4:46
  cut long -term costs. Yes, by preventing breaches,
• 4:49
  but also by making your security team way more
• 4:52
  efficient. They spend less time chasing ghosts,
• 4:54
  those false positives. Because EDR often uses
• 4:57
  AI and machine learning to get smarter about
• 4:59
  identifying real threats, it cuts down on alert
• 5:02
  fatigue. Your team can focus on genuine incidents.
• 5:05
  Plus, there's the whole compliance angle. GDPR,
• 5:08
  ATA, PCA. ACIDSS, the ACSC requirements here
• 5:11
  in Australia. Many of these mandate continuous
• 5:14
  monitoring and detailed reporting. EDR basically
• 5:16
  provides that evidence, that audit trail automatically
• 5:19
  makes meeting those requirements much easier.
• 5:21
  It really does sound indispensable. But OK, I'm
• 5:23
  guessing implementing something this powerful
• 5:25
  isn't always straightforward. Yeah. What are
• 5:27
  the common tripwires? What mistakes do organizations
• 5:30
  typically make when rolling out EDR? And crucially,
• 5:34
  how can our listeners avoid them? That's a really
• 5:36
  important point because, yeah, deploying EDR
• 5:38
  isn't just like installing a simple app. It's
• 5:41
  a strategic shift. A very common mistake, probably
• 5:45
  number one, is just insufficient planning and
• 5:47
  preparation. Too many organizations jump in without
• 5:51
  really thinking through their specific needs
• 5:53
  first. You absolutely have to assess your critical
• 5:55
  assets, understand your unique threat landscape,
• 5:58
  figure out your compliance obligations before
• 6:00
  you even start looking at vendors. It's foundational.
• 6:03
  You wouldn't build a house without blueprints,
• 6:05
  right? Same idea. Okay, so homework first. Don't
• 6:08
  just buy the tech. Understand why you need it
• 6:10
  and what you need it to protect. Makes sense.
• 6:13
  What's next? Well, following on from that, a
• 6:15
  surprisingly common error is lack of endpoint
• 6:18
  visibility. It sounds basic, but you have to
• 6:20
  ensure the EDR agent, that little piece of software,
• 6:22
  gets deployed on every single endpoint, every
• 6:25
  workstation, every server, laptops, mobiles.
• 6:27
  If you miss devices, you've got blind spots,
• 6:30
  huge ones. That missed laptop could be the way
• 6:32
  attackers get in, and it needs to integrate properly
• 6:35
  with your existing management tools, too. Don't
• 6:37
  leave any digital doors or windows uncovered.
• 6:40
  Got it. Precisely. Then there's port configuration.
• 6:43
  Just installing the agent isn't enough. You have
• 6:45
  to configure it properly. This means tailoring
• 6:48
  the rule and detection settings based on security
• 6:50
  best practices, yes, but also for your specific
• 6:53
  environment. You need to tune the thresholds.
• 6:56
  Basically adjust the sensitivity so it's not
• 6:58
  constantly flagging legitimate activity as malicious,
• 7:01
  creating those annoying false positive. But you
• 7:04
  also can't tune it down so much that it misses
• 7:06
  real attacks, the false negatives. Finding that
• 7:08
  balance is key and it needs regular review and
• 7:11
  updating. Right. So it's not set and forget.
• 7:13
  It needs ongoing tweaking to stay effective for
• 7:15
  your specific setup. What about the data side?
• 7:17
  Good question. Inadequate data collection and
• 7:20
  analysis is another pitfall. You need to make
• 7:22
  sure your EDR is actually collecting the right
• 7:24
  kind of data, those process details, network
• 7:26
  flows, registry changes, etc. And you need a
• 7:29
  clear policy on how long you keep that data,
• 7:31
  your data retention policy. Most importantly,
• 7:34
  someone needs to be consistently analyzing that
• 7:36
  data, looking for those anomalies, those indicators
• 7:39
  of compromise that signal trouble. The data is
• 7:42
  useless if no one looks at it. Mistake number
• 7:44
  five. Lack of integration. EDR works best when
• 7:48
  it's part of a bigger picture. It should ideally
• 7:51
  feed data into and maybe receive data from your
• 7:54
  other security tools. Things like your SIEM system,
• 7:57
  which correlates logs from everywhere, or your
• 7:59
  network's intrusion detection systems. That integration
• 8:02
  gives you a much more holistic view of what's
• 8:04
  going on. Creates real synergy. And I guess people
• 8:07
  actually using this system are pretty critical
• 8:09
  too. You could have the fanciest EDR, but if
• 8:11
  the team doesn't know how to use it. You absolutely
• 8:13
  nailed it. Inadequate staff training is a huge
• 8:16
  one. Your security team needs proper and, frankly,
• 8:19
  ongoing training, not just in the tool itself,
• 8:21
  but on how to analyze the alerts it generates,
• 8:24
  how to conduct investigations, how to respond
• 8:26
  effectively. Threats change constantly. The tech
• 8:29
  evolves. Training has to keep pace. And finally,
• 8:32
  maybe the biggest mistake of all, failure to
• 8:34
  regularly monitor and respond. Like you said,
• 8:37
  EDR is not set and forget. You absolutely need
• 8:40
  dedicated people, whether it's an internal team
• 8:42
  or maybe an outsource service. actively watching
• 8:45
  the console, reviewing alerts, and investigating
• 8:47
  anything suspicious and responding quickly. Having
• 8:50
  a clear, practiced incident response plan is
• 8:52
  just non -negotiable today. You need to know
• 8:54
  what to do when, inevitably, an alert comes in.
• 8:57
  That's a really thorough list of things to watch
• 8:59
  out for. Sounds like getting EDR right involves
• 9:02
  process and people just as much as the technology
• 9:04
  itself. But the payoff seems immense. So looking
• 9:07
  ahead, cyber threats aren't getting any simpler.
• 9:10
  How is EDR technology itself evolving, and what
• 9:13
  are we seeing in terms of cutting -edge solutions,
• 9:15
  particularly these integrated approaches like
• 9:17
  what Acronis is doing? Yeah, the EDR space is
• 9:19
  evolving incredibly fast. It's really dynamic.
• 9:22
  We're seeing a major trend, especially for small
• 9:25
  and medium businesses, moving away from basic
• 9:28
  antivirus towards these more sophisticated EDR
• 9:31
  tools. These newer EDRs heavily incorporate things
• 9:34
  like machine learning, deep behavioral analysis.
• 9:37
  They're getting much smarter. Cloud -native platforms
• 9:39
  are also becoming the norm, which helps with
• 9:41
  scalability and management. And a huge shift
• 9:44
  is towards managed detection and response, or
• 9:47
  MD. MDR, explain that a bit more. Sure. MDR is
• 9:50
  essentially where you outsource the monitoring
• 9:52
  and response aspect. You get expert security
• 9:54
  analysts often working 24 -7 in a security operations
• 9:57
  center or SOC, managing your EDR, investigating
• 10:01
  alerts, and even handling remediation. It takes
• 10:04
  a massive burden off internal IT teams who might
• 10:06
  not have the specialized skills or the round
• 10:08
  -the -clock bandwidth. Okay, so bringing in the
• 10:10
  cavalry, basically, to handle the day -to -day
• 10:12
  security operations. Makes sense for a lot of
• 10:14
  businesses. Exactly. And this is really... where
• 10:17
  integrated platforms like Akronis are showing
• 10:19
  their strength. Akronis Endpoint Detection and
• 10:22
  Response, their EDR solution, it's AI -guided,
• 10:24
  so it learns and adapts. It's designed for really
• 10:27
  fast, often single -click response and even recovery.
• 10:30
  It actually achieved a 100 % detection rate in
• 10:33
  the SE Labs Enterprise Advanced Security Testing,
• 10:36
  which is pretty impressive, speaks volumes about
• 10:38
  its effectiveness. But here's the really clever
• 10:40
  part, I think. Akronis EDR isn't just about detection.
• 10:43
  It bundles in other critical capabilities, things
• 10:45
  like really... robust anti -ransomware protection
• 10:47
  that includes automatic rollback. So if ransomware
• 10:50
  does somehow get through and encrypt files, it
• 10:53
  can often revert them back to their clean state
• 10:55
  automatically. Plus, it includes vulnerability
• 10:58
  assessment tools, device control features, patch
• 11:01
  management assistance, even the ability to do
• 11:03
  full system restores or re -imaging. It's much
• 11:06
  more holistic. And what's particularly interesting
• 11:08
  is how Acronis maps all this to the well -respected
• 11:11
  NIST cybersecurity framework. That framework
• 11:14
  covers identify, protect, detect, respond, and
• 11:17
  recover. Akronis' platform aims to provide capabilities
• 11:20
  across all those phases, not just detection and
• 11:23
  response. So it helps with identifying vulnerabilities,
• 11:26
  protecting through patching and backups, detecting
• 11:28
  threats with EDR, responding rapidly, and crucially,
• 11:31
  recovering quickly using those integrated backups.
• 11:34
  It's building towards this idea of cyber resilience.
• 11:37
  That idea of hitting all phases of the NIST framework
• 11:39
  is powerful. It's not just point solutions anymore.
• 11:42
  So how does Akronis MDR fit? into that integrated
• 11:45
  strategy, especially for partners like Kinsoft.
• 11:47
  Right, so Akronis Managed Detection and Response,
• 11:49
  the MDR service, is specifically built for managed
• 11:52
  service providers, MSPs, like Kinsoft. It essentially
• 11:56
  gives those MSPs the power to offer their clients
• 11:58
  a top -tier 247 outsourced SOC service built
• 12:03
  on the Akronis platform. This provides continuous
• 12:05
  monitoring, rapid threat containment, and importantly,
• 12:08
  remediation and recovery actions, often leveraging
• 12:11
  the built -in backup and disaster recovery. features
• 12:14
  of the Akronis Cyber Protect Cloud platform.
• 12:16
  For the MSP, it means really easy setup, often
• 12:18
  just a click to enable the service for a client,
• 12:20
  and they get prioritized threat alerts and insights
• 12:22
  all within that single Akronis management console
• 12:25
  they already use. That sounds incredibly streamlined.
• 12:27
  Managed security, backup, DR, and now advanced
• 12:30
  MDR, all in one place for their clients. That's
• 12:33
  exactly the goal, efficiency and integration.
• 12:36
  Akronis MDR comes in different tiers, standard
• 12:38
  and advanced, so MSPs can offer the right level
• 12:41
  of service for each client's needs and budget.
• 12:44
  But perhaps the biggest benefit, the real kicker,
• 12:46
  of having MDR layered on top of an already integrated
• 12:49
  platform like Akronis CyberProtect Cloud, it's
• 12:52
  the potential TCO savings. Akronis estimates
• 12:55
  you could see up to a 60 % improvement in total
• 12:57
  cost of ownership by consolidating cybersecurity,
• 13:00
  data protection, and endpoint management into
• 13:02
  that one solution managed through one pane of
• 13:04
  glass. That unity delivers unmatched business
• 13:07
  resilience because when something bad happens,
• 13:09
  the recovery piece, the data protection is already
• 13:12
  built in and integrated. It's not just about
• 13:13
  stopping the attack. It's about getting the business
• 13:15
  back up and running fast using those secure backups.
• 13:18
  Okay, so let's try and tie this all together
• 13:20
  for everyone listening. What we've really learned
• 13:22
  today is that EDR, it's a massive leap beyond
• 13:25
  traditional antivirus, right? It gives you that
• 13:27
  real -time visibility, the ability to respond
• 13:30
  incredibly quickly. And crucially, a proactive
• 13:32
  defense against threats that are just getting
• 13:34
  smarter all the time. And when you look at these
• 13:37
  integrated solutions like Acronis EDR combined
• 13:40
  with Acronis MDR running on their CyberProtect
• 13:42
  cloud platform, well, businesses can get really
• 13:45
  comprehensive protection, ease their operational
• 13:47
  load significantly, and potentially save a lot
• 13:50
  of money too. Absolutely. Look. the reality is
• 13:53
  cyber threats are constantly advancing remote
• 13:55
  work has blown up the traditional network perimeter
• 13:57
  relying on outdated security tools just isn't
• 14:01
  viable anymore it's actually quite risky moving
• 14:04
  to modern EDR and ideally an integrated platform
• 14:07
  approach isn't just about buying better security
• 14:10
  tech it's fundamentally about ensuring your business
• 14:12
  can continue to operate that you meet your compliance
• 14:15
  duties and frankly that you stay competitive
• 14:17
  in today's digital world it's about building
• 14:19
  genuine cyber resilience the not just to block
• 14:22
  attacks, but to anticipate them, withstand them,
• 14:25
  and recover rapidly when they do occur. We've
• 14:28
  certainly covered a lot of ground today on securing
• 14:30
  those digital frontiers. If this deep dive has
• 14:32
  got you thinking, or if you want to discuss your
• 14:34
  own specific security situation and IT needs
• 14:36
  in more detail, you can find more information
• 14:38
  and talk directly to the experts over at Kinsoft.
• 14:41
  Just visit their website, www .kinsoft .com .au.
• 14:45
  That's www .kinsoft .com .au. We really hope
• 14:50
  this discussion has given you a clearer, more
• 14:52
  strategic view on how to protect your business
• 14:54
  effectively. Until our next Tech Talk, stay cyber
• 14:56
  safe out there.