Endpoint Protection

Question 1

Anti-Virus

Answer 1

Protects against Trojans, worms, macro viruses.

Question 2

Anti-malware

Answer 2

Protects against broad malicious software category. Stops spyware, ransomware, and fileless malware. Uses signatures to ID threat.

Question 3

EDR

Answer 3

Endpoint Detection and Response

Question 4

Signature

Answer 4

Specific pattern of code in code for viruses/malware.

Question 5

What are the objectives of EDR?

Answer 5

1.Examine what a file is doing.
2. Use ML and process monitoring on device to block based on activity.
3. Can be done with lightweight agent on endpoint
4. Can do root cause analysis and find code used

Question 6

How can EDR resolve an identified threat vector?

Answer 6

1. Isolate system from network
2. Quarantine malicious software into different part of OS.
3. Roll back config to a known, clean version. Delete malware.

Question 7

Data Loss Prevention (DLP)

Answer 7

Design to prevent sensitive data being sent in the clear or in an encrypted format.

Involves different solutions
1. Firewall-based
2. Cloud-based
3. Client-based