October 08, 2015
If you look around any organization, it is clear that the number of endpoints and applications in use is growing exponentially. Data is being accessed from local and cloud-based storage through mobile devices that can be used as an access point to your most sensitive information.
The use of mobility, and all it entails (from shared passwords in apps to employee behaviour in sharing corporate data) has introduced new risks and areas of vulnerability, expanding the endpoint attack surface. The attack surface is not typically limited to one threat vector, and it is a misconception that malware is often the sole culprit. Attacks can be internal or external, targeting the network, software, or even the user themselves. The reality is that sophisticated attacks often involve a combination of these components. Neutralizing endpoint threats should be one of your top priorities.
In an article I wrote on TechZone360, An Endpoint Has Been Breached - Isolate to Minimize the Damage, I take you through a security model that prioritizes the endpoint. As I note, your organization probably has application blacklisting and patch management in place to address some endpoint security risks, but these still place your organization at risk from zero-day vulnerabilities, spear phishing and other advanced threats. So, what do you do if these attacks occur? Restricting the endpoint is one option, but it hampers productivity, and we all know employees will find a way to remain productive.
Shrinking the attack surface can help plug holes, but you still need to have strategies in place to mitigate the potential damage an attacker could inflict. Attacks evolve, your security posture must evolve too. At Absolute, we talk a lot about a framework that is layered, focusing on internal and external threats and including training & policy plus network, endpoint and data security solutions that are constantly refreshed. For the endpoint, which is so mobile, visibility is important: know where your endpoints are and that data is constantly protected, with alerts to any irregularities to hardware, software or user behaviour. With this level of control over devices, you can react quickly to isolate an attack or freeze a device. As I mention in the article, this flexibility allows your organization to constantly monitor and remediate based on your own unique risk threshold.
To learn how Absolute DDS provides this level of endpoint security, visit Absolute.com
Share this article
