-: Endpoint analysis.
Now, endpoint analysis is used
when we're conducting monitoring, logging,
and analysis of our endpoints.
An endpoint is simply any device that we may use
to connect to our network.
Now, for example, your desktop or your laptop at the office,
that's considered an endpoint,
so is your smartphone or your tablet.
As a cybersecurity analyst, you must be able to use tools
to identify behavioral anomalies
and then identify the techniques used by malware
to achieve privilege escalation
and persistence on your host.
Now, there are lots of different
endpoint protection tools out there.
And in this lesson, we're going to cover five different
endpoint security capabilities that we can use for analysis.
These are antivirus, host intrusion detection systems
and host intrusion prevention systems,
endpoint protection platforms,
endpoint detection response platforms,
and user and entity behavioral analytics.
Let's talk about each of these in this lesson.
First, antivirus.
Antivirus is a software that's capable of detecting
and removing virus infections.
And in most cases, other types of malware,
such as worms, Trojans, rootkits, adware, spyware,
password crackers, network mappers,
denial of service tools, and others.
Often, you'll hear this called antivirus or anti-malware.
At this point in your career, you should be pretty familiar
with what antivirus and anti-malware is.
The next one we're going to talk about
is host-based IDS and IPS, which is HIDS or HIPS.
This is a type of IDS or IPS that monitors a computer system
for unexpected behavior and drastic changes
to the system state on a given endpoint.
Now, most of these are going to use signature-based detection
using log or file monitoring systems to figure out
if something bad is trying to happen to your endpoint.
They may use file system integrity monitoring too
to see if your operating system files have been changed,
or drivers have been changed,
or an application has been changed.
All of these things are things
that a host-based intrusion detection system
or intrusion prevention system can help you with
that a network-based intrusion detection
or intrusion prevention system really can't see.
Now, the next one we have
is an endpoint protection platform or EPP.
This is a software agent and monitoring system
that performs multiple security tasks.
They can do things like antivirus.
They can do host intrusion detection or prevention systems.
It can have a firewall.
It can have data loss prevention, or DLP,
and it can have file encryption,
all of this in a single product.
Essentially, it's your Swiss army knife of security tools.
We call this an EPP.
Now, there are a lot of EPPs on the market and every year,
there's a thing called the Magic Quadrant
that's put out by Gartner.
Gartner goes and rates all the different systems
to see who's the best, which ones are the leaders,
who are the challengers, who of them are niche players,
and who of them are visionaries.
And you can see that here on the screen.
As you can see, the top three
is Microsoft, CrowdStrike, and Symantec,
and all three of them have great
endpoint protection platforms that you can choose from.
The next one we're going to talk about is EDR,
which is endpoint detection and response.
Now, where EPP is mostly based on signature detection,
EDR is focused more on behavioral and anomaly analysis.
It starts logging the endpoint's observables and indicators
and combines that with analysis
and tries to figure out what's wrong.
So, this is a software agent
that's going to collect system data and logs for analysis
by monitoring the system
to provide early detection of threats.
Now, because of that,
the aim of EDR is not to prevent an initial execution,
but instead, to provide runtime and historical visibility
into a compromise, and once you've been detected,
it can start responding to that
and it helps you as an incident responder
to gather more information and facilitate your remediation
to get it back to its original state.
The final one we want to talk about here is UEBA,
which is user and entity behavior analytics.
This is a system that can provide automated identification
of suspicious activity by user accounts and computer hosts.
Now, this solution is less about endpoint data collection
and more about the actual process
of analyzing the data you're getting.
The idea here is to have a baseline of good knowledge,
and then we're going to compare anything
that goes outside that baseline
and start thinking that might be suspicious
and look into it further.
Now, a lot of UEBA is focused on the analytics
and because of that,
there's a lot of data that has to be processed.
So, UEBA solutions are heavily dependent
on advanced computing techniques,
things like artificial intelligence and machine learning.
There's a lot of these different players out there
in the marketplace that are doing UEBA.
Two of the big ones out there right now
is Microsoft and Splunk.
Microsoft has the Microsoft Advanced Threat Analytics.
And you could see this diagram here on the screen.
Essentially, we have some unknown threat that comes in.
It goes into some sort of a sandbox environment
for detonation. Based on that,
it does a heuristic behavioral model of what it saw.
It passes that into machine learning,
and based on the machine learning models,
it will decide whether or not this is really a threat
or if it's not a threat.
And based on that, it'll let that message go through.
Now, on the other hand, Splunk is another one out there
and it's called the Splunk User Behavior Analytics.
This tool will allow you to get all that data
into a nice dashboard, so your analysts can go through it
and they can see what are threats, what are anomalies,
how many users you have, how many devices you have,
and all the different statistics.
And you can drill down into each area of that
and look at all the analytics
and make your decisions based on that.
Now, I know we just covered
these five different technologies
and we try to keep it very clear cut and say,
this one does this and that one does that,
but as everything in security,
things evolve and things merge together.
And so now, many companies are starting to market
advanced threat protection, ATP,
advanced endpoint protection, AEP,
and NextGen AV, which is NGAV,
and all of this just becomes essentially a hybrid
of the different technologies we talked about before,
like the endpoint protection platform,
the endpoint detection response,
or the user and entity behavior analytics.