endpoint security

James Harrison

min read

What is endpoint security?

Endpoint security is the process of protecting user devices (everything from desktop workstations, laptops and mobile devices to IoT sensors and switches) from threats such as malware, ransomware, and zero-days.

‍

Why is endpoint security important?

It shouldn’t need saying, but endpoint security is more essential than ever now that today’s dispersed and mobile workforces create a fast-moving and ever-expanding attack surface.

And because devices are now more mobile, they leave sensitive private networks (e.g. when workers work from home, or at a coffee shop) and enter less-trusted environments where there is little oversight, centralized security solutions are no longer enough.

If a device is compromised, endpoint protection needs to be in place to detect this, especially if the device is sitting outside the corporate network.

Endpoints are one of the most common targets for attack, given the sheer number of devices now in use around the world. According to Strategy Analytics, there will be 38.6 billion devices by 2025 and 50 billion devices by 2030, while Verizon’s threat report found that up to 30% of data breaches involved malware being installed on endpoints.

‍

What are endpoint devices?

Endpoint devices are any devices your organization uses to connect to your network. As more services migrate to the cloud, staff work remotely, and use their own devices and unauthorized apps for work, these devices have the potential to be a target for attackers:

Laptops
Desktops
Servers
Tablets
Smartphones
Smart watches
Printers
Switches
ATM machines
POS devices
Medical devices
IoT sensors

‍

Is endpoint protection the same as antivirus?

Antivirus and endpoint security are almost interchangeable today because most products billed as antivirus offer the same functionality as endpoint security. Both consist of software (or an “agent”) that’s installed on each endpoint to protect it from attack.

However, antivirus solutions use signature-based detection and prevention which makes more advanced signature-less threats or fileless malware hard to detect for it. More advanced Endpoint Detection and Response (EDR) solutions typically use complex rulesets, often including machine learning and/or AI to prevent and detect sophisticated attacks, including fileless, zero-days, and ransomware across all your endpoints.

EDR can provide actionable responses to incidents such as investigation, triage, and even remediation, and can support a variety of operating systems including Windows, Linux, macOS/iOS and Android.

‍

Which is best for your business?

Endpoint security	Antivirus
Endpoint security solutions such as EDR are designed for SMBs and larger businesses who have multiple endpoints and large, remote workforces to protect. And if they allow bring-your-own-devices (BYOD), investing in an endpoint security system may be a better idea.	Antivirus is designed for individual devices and smaller businesses without complex networks. The software runs in the background of the device to safeguard the device against potential malware. If the business has few devices to protect and a small network, antivirus software can do the work for you.

‍

Endpoint protection or Mobile Device Management?

While endpoint protection and Mobile Device Management (MDM) solutions sound similar, they perform different functions and shouldn’t be confused either. MDMs like Kandji ensure endpoint devices are properly configured and installed software is up to date – which in itself offers a degree of protection – but comprehensive endpoint protection is designed to stop threats like malware, phishing and ransomware as well.

‍

Get our latest news, research, and expert cyber security advice straight to your inbox by joining our newsletter.