Endpoint Detection and Response (EDR) platforms have received
incredible attention as the platform for security teams.
Whether you’re evaluating an EDR for the first time or looking
to replace your EDR, as an information security professional, you
need to be aware of the gaps prior already to implementation so you
can best prepare how to close the gaps.
It’s important to understand that each company is unique, and an
EDR that a large company uses might not necessarily be the
technology that works best when you are leading a small security
team, even if you’re within the same industry vertical.
Understanding your threat detection technology requirements
based on your unique company characteristics will help you choose
the right one.
The eBook and webinar “The Dark Side of EDR. Are You Prepared?”
helps you in that requirement definition process. It points out the
dark side(s) of EDR and provides guidance as to how to overcome
them according to your company’s unique environment.
The guide takes an in-depth look at these seven considerations
during evaluation:
- What does “detect” really mean. When at the
end of day detection equals alerts, this guide shows how you can
overcome the potentially overwhelming amount of alerts. - How efficient is the detection. EDR has its
share of blind spots. The authors point out these gaps and provide
suggestions on how to close them according to your company’s risk
appetite. - What does “respond” really mean. When response
runs the gamut from manual guidance to automated remediation, you
need to understand the terminology and decide on the level of
automation that you require. - What is the management overhead. Think of EDR
as a process – from deployment, detection, and response to
maintenance. You receive necessary tips as to how to reduce
overhead across all process stages. - What reporting is provided. Some EDR vendors
have all the bells and whistles. Is that, though, right for your
environment? Learn how to determine what are your reporting
needs. - What complementing technologies are still
required. This section focuses on what else you might
potentially need beyond the EDR tool– whether it’s closing
detection and response, integration with security and IT systems,
or even outsourcing services. - Cost. The article rightfully points out that
cost is not just about the direct cost of the product. It spells
out how you can factor in how to stretch the dollar as well as to
the intangible costs such as team burnout, maintenance, etc.
As opposed to most resources that present the value of EDR, this
guide focuses on the practical aspects of an EDR evaluation, not
just the glorification of the platform. This is a particularly
useful approach to small security teams. The good news is that
there are new trending approaches, technologies, and methods to
overcome these dark sides.