REAL TIME ENDPOINT INSIGHTS

REAL TIME ENDPOINT INSIGHTS

• 1.
  Real-time Endpoint Insights Pluggingan Important Security Gap There is a security gap with the way in which we secure today’s endpoints. This gap forces IT to work in a reactive manner, putting out the proverbial fires as they break out instead of being able to proactively monitor and manage based on information gathered and synthesized in real-time.
• 2.
  Organizations of recenthave seen a rise in data breaches, disruptions and threats of malware attacks. Figure 1 shows the number of major data breaches and attacks that organizations have faced in just the three first months of 2016! Any delay in identifying vulnerabilities and threats due to potential security holes can have damaging financial implications. However, IT endpoint management and security still remains functional (e.g. patch deployment, configuration, etc.) dealing primarily with actions targeted towards a large set of endpoints as a monolithic activity that is far removed from the reality of each endpoint’s state. This functional view has largely been the essence of endpoint security and management for almost as long as computing endpoints have existed. JAN 25 FACC AG - email cyberattack activities - hackers steal $54.5M from Boeing supplier. FEB 8 University of Central Florida - 63K students’ SSNs exposed - $100K to notify potential victims. FEB 9 RubberStamps.Net - hackers gained access to order management system - 7K customers affected. FEB 29 UC Berkeley - hackers stole financial data of more than 80K UCB students and faculty members. MAR 10 Internal Revenue Service - identity thieves used stolen SSNs to generate IRS e-filing pins - 100K taxpayers affected. MAR 23 21st Century Oncology - cyber breach affecting 2.2M patients - results in class-action lawsuits. MAR 25 Verizon Enterprise Solutions - hackers stole and sold customer contact info - 1.5M customers affected. MAR 28 Systema Software -1.5M records compromised via Amazon Web Services - data remained exposed for 75 days. MAR 30 MedStar Health Inc. - Cyberattack forces computer system offline - attack caused by known security flaw. Introduction Figure 1: List of major data breach incidents (Q1/2016) - Source: Identity Theft Resource Center (ITRC) Data Breach Report
• 3.
  Traditional Endpoint Managementand Security Systems Traditional computing endpoints – primarily PCs and servers – have been only recipients of changes that the IT administrators make on them based on the information they receive from various Information Sources (Figure 2). Supporting Information Sources in the context of endpoint security solutions is a matter of integrating with the right databases and security information brokers who have a list of latest vulnerability, threat and patch information – all valuable to maintaining and enhancing the security posture of any organization. Traditionally, corporate endpoints within the sheltered corporate “boundaries” – both physical and network boundaries – have been managed and secured using many different tools such as network monitoring and security tools, firewalls, website blockers, and many others. These tools have come together to comprehensively manage and secure endpoints as well as corporate servers. Endpoint management, endpoint security and OS providers have added further value towards creating a safe and secure environment for endpoints that work in the corporate environment. The Information Source consisted of software vendors, security and vulnerability databases, patch databases and so on. Corporate “Boundaries” Endpoint Information Source Software Vendors Patch DB Vulnerability DB IT Administrator Figure 2: The Trinity of Endpoints, Administrators and Information Sources for Endpoint Security
• 4.
  Same Endpoint ButA Widening Security Gap Endpoints today – even the traditional ones such as laptops – operate in a dramatically different environment. They operate more “out” of physical and network boundaries than the earlier ones thanks to better connectivity and a more distributed and mobile workforce operating remotely and from home. They are also more dynamic (i.e. used for varying purposes undergoing significant changes in a short span of time), and are prone to variations due to a more “hostile” local environment. Approaching their security and management in the same way as traditional endpoints leaves a gaping hole in the overall IT security and management, even as endpoints undergo frequent changes in configuration and are prone to hacking, malware attacks, theft, spyware, and open vulnerabilities. Apart from periodic checkpoints that can be spread weeks or months apart, IT is essentially “flying blind”! The problem with the traditional way of managing endpoints is clear – even as IT grapples with a ton of informa- tion from its current information sources, it has limited information from the endpoints themselves! While reports provide varying degree of detail, they are built for a very different purpose. They are primarily for seeing results of past actions performed on endpoints than gathering fresh information on them (see inset for additional limitations of endpoint reports). Reports: Looking backward, not acting forward • Oriented towards results and outcomes of past actions on endpoints rather than future actions that need to be taken • Appear without any context of changes that might have happened anywhere in the endpoint universe – from the information source to corporate IT environment to the endpoint themselves • Viewed infrequently with information in them often days and weeks old • Not in the clear line of sight of the administrators while they are “acting forward” on the endpoints
• 5.
  This gap inendpoint management trinity of Information Source, Administrator and Endpoint is illustrated in Figure 3. As these endpoints proliferate through the organization and workforce becomes more mobile with them, this gap will only widen further. Security tools residing on the endpoints are a key mechanism to secure them against vulner- ability and attacks. However, without using endpoints themselves as an active source of information, IT will miss a critical piece of information that can help them make informed and timely decisions. Following are four key issues that IT administrators face due to this gap in their current enterprise architecture, and what they need to look for in any proposed solution: 1. According to a recent report from Hewlett Packard Enterprise called the HPE Cyber Risk Report 2016*, “Attackers have shifted their efforts to directly attack applications”. The report goes on to say that they have “shifted their focus from servers and operating systems to applications” – meaning, your endpoints. It is clearly not enough to monitor and secure the network and data from one end while the attacker is attacking the other! The solution needs to bring endpoints into the realm of information source as depicted in the diagram. Corporate “Boundaries” Endpoint Information Source Software Vendors Patch DB Vulnerability DB IT Administrator Endpoint Endpoint X Figure 3: Modern Endpoint Environment * HPE Cyber Risk Report 2016, http://techbeacon.com/resources/2016-cyber-risk-report-hpe-security
• 6.
  2. Endpoint informationis much more dynamic than the other sources. It changes on a daily and sometimes even hourly basis. Not getting timely information from them can give a false sense of security, which only worsens as precious days and weeks go by since the “last scan” was performed! Given the fast-changing and dynamic nature of endpoints and corporate working today, it is important for the solution to be able to provide the most current information. 3. Endpoints are diverse and numerous by nature, and covering the entire set to gather the most comprehensive information on the state of the network with the present set of functional and monolithic tools presents a formi- dable challenge for IT teams. The result is piecemeal fixes and a target that is constantly moving, which prevent IT security teams from getting a foot in and creating a watertight setup without security holes. The solution should be able to run “out-of-cycle” from the current operations, and at the same time be well-integrated with them in order to be truly effective. 4. While the attackers are sharpening their attacks on individual endpoints and applications, IT’s remediation and fixes turn out to be blunt at best, and off-the-mark at worst. The solution should provide the ability for administrators to quickly zero in on configuration items that are critical, identify patterns in them, and be able to visually view the results to ease their actions. Accelerite Sentient - Plugging the Gap Due to the above gap in the current enterprise architecture, IT is forced to work in a reactive manner, putting out the proverbial fires as they break out instead of being able to proactively monitor and manage based on information gathered and synthesized in real-time. Plugging this gap is only possible if the endpoint itself is capable of being an information source for IT administrators. But how do you go about fixing the enterprise architecture to incorporate a change of this nature? What are the key considerations and parameters that one needs to keep in mind when incorporating this change? Accelerite Sentient has been built with these questions in mind, and with considerations that most effectively fill this gap. With Accelerite Sentient, IT administrators can query endpoints for their current status – including applications installed on them and their versions, potentially malicious software they are running, existence of rogue files in them, harmful configurations, available disk space and other critical parameters.
• 7.
  Sentient has thefollowing key characteristics that are critical to solving the four key issues faced by IT that we saw in the last section: 1. Real-time information for immediate action - Sentient pulls together real-time information from enterprise endpoints for IT administrators to quickly identify critical security threats and vulnerabilities, and address com- pliance and configuration issues in their endpoint network within minutes. 2. Proactive oversight and management - The solution should enable IT admins to get ahead of the problem and be able to proactively address their endpoint security and configuration. Sentient allows administrators to proactively query the current status and existence/non-existence of configurations and files from the point of view of actively unearthing issues in real-time, which is in contrast to standard reporting queries from current tools that are only targeted towards analyzing outcomes of actions that administrators have previously taken. 3. Targeted operations across diverse endpoints - With agents residing in each endpoint and responding in real-time, administrators can take more targeted actions that effect a narrower set of relevant endpoints instead of casting a wide net every time and having to put undue pressure on their network and many end-points at the same time. 4. Insights-driven for maximum impact - With so many configuration parameters to monitor, it is important for the solution to provide an easy way to query endpoints and get back visualizations and graphs that can be interpreted quickly and intelligently. Sentient classifies and presents the information gathered in visual format with drilldown information, and makes it easy for IT to locate problem areas in their network of endpoints quick- ly. The search queries in Sentient are in freeform text format, which enables IT to easily query their endpoints using natural language phrases. Sentient also provides the option to integrate with endpoint management tools (e.g. Radia Endpoint Manager), which allows for IT departments to have in-place remediation and avoid multiple systems of record for their endpoints status.
• 8.
  Conclusion As workforce becomesincreasingly mobile, working from home, working remotely, and attackers attacking more applications than servers, endpoints need to be more proactively involved in the decision-making processes such as patching them, updating software versions, changing configurations, installing and uninstalling files or software, and so on. It is no longer enough for them to be just “managed” as a reactive measure based on only information that is external to them. They need to be made smarter and be included in information gathering for security, compliance, audits, asset utilization, etc. Accelerite Sentient provides IT departments the means to gather information from them in real-time for proactive security and management. Interested in seeing Accelerite Sentient in action? For more information, please visit accelerite.com/site/real-time-security or contact sales at +1-800-787-9540 or [email protected]. Accelerite delivers business-critical secure infrastructure software for Fortune 500s, telecom operators and SMEs around the globe. Accelerite’s product suite includes solutions for cloud life cycle management, endpoint security, enterprise mobility management, and the Internet of Things. Headquartered in Santa Clara, CA, Accelerite serves as the products business of Persistent Systems (BSE & NSE: PERSISTENT), a global leader in software product development and technology services, with 9,000 team members worldwide.