So, my family very recently had a DNA test done and found that we are far more Scottish
than we realized, so ever since that I've definitely had that on my list.
But all of the UK and Europe has always been on my list as well.
Just to be very generic about it, basically that whole part of the world.
I mean, if we're talking money's no object, I mean the world is your oyster.
Go be Jeff Bezos, let's go to space.
If money's no object, then you can really go anywhere you want to go.
So, yeah, let's go everywhere.
That would be a dream vacation.
Yeah.
Tour around the world?
Yeah.
I think for me, I'd probably choose.
I think Rome would be really cool.
I think it'd be really cool to see the Colosseum and all the history within that space.
I'd primarily want to hit that and then maybe trek over to Egypt as well and see the pyramids.
I think the mysteriousness of that is just so interesting to me.
And if money's no object, paying off the tour guide to take to undisclosed locations in
the pyramids would be cool.
I'll see you got one.
I think Matthew stole mine.
It was so rude that I was like, come on, man.
But yeah, money was no object.
I was like, so could I just move over to Europe and then just keep on taking these weekend
vacations because that's really what sounds good is being like, let's fun just moving.
And then I can just take these small little vacations instead of doing one big trip.
But maybe that's just me that I'm like, I'd rather just go somewhere and stay.
But what about you, Tara?
I would say this isn't necessarily on my top.
It just comes to mind is one of my favorite vineyards is actually in New Zealand.
So I would love to go there and have some other wine.
Nice.
Very cool.
Yeah.
New Zealand is beautiful.
I really want to support anyone going to New Zealand as well.
Love it.
I was going to say August kind of stole mine going to Egypt or I kind of think the first
thing that came to mind was maybe going to Italy.
I spent so much time in like art history classes.
It would be so fun to like go and be in front of these things that I have only seen in books
or on the internet.
I think that would be pretty awesome.
I would agree.
That would be really neat.
Yeah.
Well, today on our tech for business podcast, Kelsey, Tara and myself are joined by Matthew,
our GRC analyst, August, our sock technician and Andrew, our security engineer and incident
response team lead.
I got it.
We're doing a little deep dive today into our world of EDR and how it can save your
business.
I'm going to kind of pose our first question to Matthew just before we really jump in.
We've talked about EDR before.
I have a podcast linked in our description, but what are some quick basics and overview
that someone should know to really understand what we're talking about today?
Yeah, definitely.
So I don't think I was in that other podcast, though I believe the rest of the group was.
But in short, it's endpoint detection and response.
So it's a tool that runs on an endpoint, which is the language you use for workstations,
desktop PCs, laptop PCs, and mobile devices as well, whether that's phones, tablets.
And the goal is that it detects issues as they're occurring.
We've also done a lot of podcasts on AI and deep learning.
And this is basically a form of that where it's tracking what's going on in the work
station and finding actions that are unexpected or non-hobitual that it's trying to detect
those rather than just finding things like an original antivirus did.
Original antivirus would just look for specific file types, would look for specific things
that were done.
And if they happen to match with something that was done previously, they'd still block
it.
If they happen to be something that you did every day and they decided that that day,
that was a bad thing.
All of a sudden, your antivirus could stop you from doing anything, which we may have
all had experience with before.
So EDR is really the next step of that.
If you've listened to myself and Todd on any of the other podcasts, you'll have heard
him mention specifically how important EDR is now.
In fact, I think the MFA podcast that came out a week ago when this one's coming out
directly talks about that in depth.
So EDR and MFA are kind of what we're talking about in there.
And in this part, EDR is the endpoint side of things, how it can be stopped and saved
for a workstation.
Have I missed anything there?
I don't think so.
I think you covered a lot of the ground of what it is.
So I guess how I can take on the portion of how it can save your business of some real
case scenarios of what we've seen of it taking anonymous action, anonymous, I can't say that
word, autonomous action on different types of threads that are coming through.
Just looking for hash based signatures and just types of any type of malicious activity
going on, seeing something such as Mimikatz, which is a credential stealer basically for
that can be ran on systems, and seeing something like Sentinel-1 or any EDR tool blocking that,
and then seeing an attacker try a different form of Mimikatz to try and steal credentials,
and that being blocked and seeing the real time action log of a 10 minute span of an
attacker trying multiple different forms of attack vectors and being stopped from that
one tool that saved pretty much your multiple days of being down.
So I think it's a super important part of a business.
Definitely.
Just to kind of tie in with that a little bit, August, we've mentioned a couple of times
now the autonomous actions as well as how it's reacting to the actions being taken.
So autonomously it's stopping.
It's not asking for requests to make these changes, and it will block an action.
You mentioned a couple tools in there which are hacking tools, which it's going to look
for and stop, but it's also looking for things that are maybe unexpected behavior in some
way.
So it's trying to get access to file systems that maybe you hadn't accessed before.
Maybe it's a file that's instantly trying to duplicate itself across multiple areas
or changing too many files at once, the type of thing that ransomware does.
EDR tools very quick, and obviously there's a lot of variables, but when it does what
it's meant to do, it's doing it very quickly.
It can stop these things in its tracks.
I'm not on the incident response team.
That's more Sherf's area here.
How often do you see it that the alerts were getting on not, hey, this machine needs to
be recovered.
This machine has already stopped this issue.
What do you want us to do to clean it up and resolve it?
I mean, when it comes to an incident, be it a single device, single endpoint is some
user downloaded their free cursors and now that there's some malicious software on that,
it asks for forgiveness then permission.
It's going to rip it out and block it even at the extreme level, disconnect your networking,
and then ask for forgiveness later.
It wants to protect you versus say, hey, can I block this?
I think from a business point of view, I think it'd be more important that, hey, we allow
this application on the device if it is something business related versus the off chance that
it's something that's not.
That's one huge benefit with EDR.
Definitely.
Just something that I want to mention quickly here then because it does come up in the way
we're talking about this.
Based on what you mentioned there about asking for forgiveness, Andrew, I want to mention
the CIA triad, which is the confidentiality, integrity, and availability triad that defines
how we talk about cybersecurity.
In short, this is how do we keep things safe?
How do we make sure all the data has integrity and is not changed?
How do we make sure it's available when it's meant to be available?
Now, generally when we're making things safer and immutable, that means we're increasing
things on the confidentiality and integrity side of things, which tends to make the availability
side of things lower.
You'll tend to hear this when people make MFA available, when people make different
tools available to you, you think it's harder to get into your system and harder to do things.
I may have mentioned this previously, but I once had a CIO tell me that in my perfect
world, no one would have access to their workstations because then the data is safe, which is true.
If we completely remove availability, keeping something safe is far easier.
When we talk about asking for permission, what we're saying is that some of these tools
do maybe make parts of your job sometimes more difficult if they accidentally trigger
on something that isn't a problem.
But it's better that they trigger on something that isn't a problem than that they don't
trigger on something that is and all of a sudden ransomware has taken over your network.
I'm not sure about everyone else here, but personally, I think losing a little bit of
availability to increase the security so that me clicking on a link or accidentally going
to a website doesn't cause me to take down the business is a worthwhile trade-off.
On speaking about that, I think we've said this in past podcasts, but the average downtime
for a ransomware incident is two weeks.
Is your business prepared to be down for two weeks to restore your business or would you
want to put a tool in place that could in all likelihood protect it?
Stop this kind of thing from happening.
There is a buy-in, but end of the day, that buy-in is worth what that two weeks of no
money coming into your business would be.
Exactly.
That two weeks is generally just the uptime.
Chef, getting back to having machines up and running, we also have the side of things
with the forensics teams dealing with the insurance that that process can take another
month, two months just to get everything back.
There are a lot of factors that need to be, if this doesn't apply to any and every business,
but average downtime is two weeks and that's business back to maybe 60%.
How would I say is comfortably that's the two-week window.
Sometimes you can get back up in 24 hours.
Sometimes it could be a month and a half.
Average time two weeks and that is not full functionality.
There is still going to be much more time of hurting, getting you back to 100%.
Exactly.
It wouldn't be a podcast without me mentioning an incident response plan, which you should
have, as well as business continuity and disaster recovery, which can definitely help
you cut down on that time.
But I think by saying that I cut you off, August, sorry.
Oh, no, I was just going to say sounds to me that paying per agent is a little bit of
a better trade-off than being down for two weeks on average.
So, it wouldn't be worth the cost.
All more.
When I've dealt with ransomware incidents, one of the first couple things I say is to
set the expectation to be prepared for two weeks.
If we get you back up in 24 hours, that's icing on the cake.
But when I tell people that it's two weeks average time, I just hear gasps.
So that is kind of that.
Send the shot across the ballot.
Do be aware that if you did have ransomware and you didn't have, say, an EDR product in
your network, that is where that trade-off is coming there.
Exactly.
Now, we've covered some of the things that can happen as a result of not having EDR or
when EDR doesn't catch it.
It's not a perfect system.
There are times when things get around it, but that's not as often as when it's caught.
So why then, I think that kind of covers the why we think it's important, why we see it
and why we recommend it.
It's something we recommend heavily and push as soon as we can to everyone.
Are there any things that you guys have seen recently or that are coming up that are maybe
stopping people from wanting to use it?
Have you guys heard any of those types of arguments?
I would just say, primarily, it's the false positives that come through.
Some of the processes that get ran are something like a PDF converter.
Something as easy as that being blocked.
People just don't like it.
It comes back to the availability part of the CIH end of, I want to be able to do my
work now and not be blocked by anything.
If I want to run a PDF converter, I'm going to run it.
I think it just all ties back into availability.
Real life example, where something like that, August, I think you're talking about a little
bit about line of business applications.
There was a company that we had dealt with that had this Excel application, a technically
plain application.
They had macros out the wazoo on this Excel document that they've had for 10 years and
it's doing 70,000 different things.
It's essentially their ERP through a single Excel file, malware spreads, ransomware spreads
through macros in an Excel file.
That's why Sentinel-1 killed it, caused downtime for them, caused problems.
It raises a larger question of why you're doing that.
Using that false positive, it is some downtime best cost of those problems.
I would say that it's really trying to run that line of how your business needs to function
and protecting at the same time.
Exactly.
This tool as part of it is that deep learning.
It's the machine learning.
It learns what's normal for your organization.
There might be some hiccups as it's coming on board, as it's learning that maybe your
organization does something that is unique to the way that organization runs.
Over time, it does learn that that's okay and it will stop doing that.
We can also teach it very quickly if need be and tell it, hey, that's fine.
In those cases, if it is catching something that you're doing that is unique, it's important
to remember that maybe what you're doing is unique in a way that's negative.
Yeah, like Andrew said, using it as a full ERP is, Excel is not a database, as we're
all very fond of saying.
Using it as one is probably creating an attack vector and attack surface that isn't going
to exist in other organizations.
Finding out that that's happening and if this tool is catching things that you're doing
that it thinks are malicious or dangerous, let you learn about how you're working and
find new ways and better ways to keep yourself safe.
One of the arguments that I hear pretty regularly and less now but still occasionally is that
antivirus does everything that they need.
I covered this very briefly at the start about how antivirus should be thought of static.
It looks for specific types of things as it's going through.
I think I'd probably compare it to antivirus being the bouncer at the front door checking
everything and then EDR is more like the people running the perimeter and making sure no one's
trying to jump the fence or sneak through putting on disguises or hiding in the back
of trucks that are going in.
It's more about finding patterns and ways around it.
What do you guys say to someone who says that antivirus is meeting their needs already?
They don't need EDR.
From an incident response perspective, I've seen many times where antivirus did not catch
something and their network was compromised.
As you were saying as antivirus works, it's static.
It knows that a threat does this, this and this and there's a signature for that.
Well antivirus knows that.
EDR is seeing hope.
This application is interacting with us other thing and it normally doesn't do that and
there's no signature for how that's acting, but it's blocking it because it shouldn't
be doing that.
That's where antivirus may be doing its job, but you're paying minimum wage for a bouncer
at the front door where you could be paying a security team to watch your perimeter.
There's a cost with that.
Is your business, again going back to the two weeks, is your business able to sustain
a two week downtime if you don't have this more advanced security product?
Yeah, I like how you worded that.
Some of the applications that are touching some of the files that it shouldn't be is
in going back to some of those macros of why is this Excel document making file modifications
to a configuration file five-folder past deep?
Whereas EDR can remediate against that and then not only stop the threat, but also if
it wasn't the macros, if it isn't true positive, roll back the device to an image right before
that process occurred.
Restoring all the files that it did touch to the state right before of modification.
I would say another one of going for why there are pushback against it is that Macs don't
get viruses.
We can shut that down quickly, can't we?
I've heard that one a few times.
As an Avid Mac user at home, I can tell you that they definitely do.
I can also confirm that there are tools out there that can help you.
I would also say if you have one of the M1 or M2 chip Macs, you should be extra vigilant
as people are finding them a very fun target to try and find flaws and vulnerabilities in
just because they are so new.
That doesn't mean they're more vulnerable.
It just means that people who like to take on a challenger using them as target practice.
A lot of people, if they do have Macs as their business PCs, they're considering that idea.
Everyone should have EDR.
Everyone should have some form of safety of that tracking what they're doing.
That's a great point, August.
I really like that one.
I like that you mentioned that from experience.
What were you downloading your free cursors and screen savers and you got a virus?
No.
There's a lot to that question.
No, I did not download one.
I have been the Mac specialist amongst my friends for almost a decade at this point.
I will often get that question and often get asked what's going on and what's happening.
I spend more time reading Mac vulnerabilities and Mac changes than I do reading.
We can do these vulnerabilities and changes, which really shows a lot about how much I'm
reading of this stuff more than anything else.
I would say going back to that, the M1 and M2 chips are pretty exciting attack vectors.
Google's bug bounty program is a pretty good payout if you find a zero-day, non-clickable
thread.
Definitely a very solid attack vector in that regard.
Exactly.
Yeah, there's some good money to be made if you are a bug hunter, finding them within
Mac systems.
You can see what those payouts are very easily online, as well as what some of the most recent
ones were and how much these individuals get paid.
There are people whose sole job is finding flaws and vulnerabilities in systems.
Just some side reading if you're looking for that.
On the case of EDR, obviously I think we've made it clear why it's more useful than antivirus,
as well as how it's tied in with the other sections like incident response and things
like that.
I had a point from something you said before August and I've lost it in this Apple side
track.
I think one of the things that I'm seeing from this conversation, which maybe hadn't
been clarified for me before, was that EDR's handling is a lot more aggressive than antivirus
as well.
Maybe some of the ways that some of the pushback we're seeing is because of that aggressiveness.
Do you think that there's part of this in if people are doing things that are outside
of what they should be doing?
Let me phrase that.
Everyone's going to be doing things that they've done from learning how to do it and
learning what works for their business.
Because the EDR's aggressive nature is maybe bringing out some of those, I don't want to
say flaws, but non-best practice actions that the organization is taking.
That's a have-it's-good or bad.
Exactly, yeah.
I will say then that I think that one of the things that I like from EDR then, and this
may just be a me thing, is that it does let me know if the actions I'm taking are also
the actions that might be taken by someone trying to take over a network.
Maybe it's a learning experience to be able to say, hey, if I keep getting stopped from
doing that action, is there a better way to do it?
Is there a quicker way to do it?
Is there a smoother way to tie it in with things I have already?
I know a lot of us are very ingrained in the way we like to do things.
When applications update or change, that can be quite annoying.
I at least like the idea that EDR is telling me, hey, this Excel document you've been using
for the last 20 years is problematic.
Maybe that's a good idea to start looking at other solutions.
The circling back a little bit to the people who are pushing back for antivirus, or pushing
back for EDR, think about it like in the 90s when antivirus was the brand new thing.
Hey, it's causing problems with my XYZ because it's blowing it up or doing something like
that because it thinks that it's malicious based off of signature.
We're at that point now for EDR, is that antivirus is going the way the dinosaur, EDR is the
new thing.
Previously, antivirus wasn't on computers in the 90s or whenever, I remember when first
antivirus product came out.
We're at that point in computing, is antivirus isn't good enough anymore?
EDR is better.
We're moving away from that to a more robust solution.
I'll say as something else you just mentioned, alert fatigue is a real thing.
I'm sure we're all remembering those times when we first started using antivirus and
it just pinged at us for 20 minutes straight because it's like you have three different
PDFs named new PDF one, two, and three.
One of the upsides to EDR is that oftentimes, depending on who you go with obviously, but
oftentimes because it is autonomous and especially at a business level when you're getting it
through someone else or with a SOC team included, you aren't seeing those alerts at all.
It's completely silent for you because it is making these actions and asking for forgiveness.
It may tell you that something isn't working if you try it enough times, but more often
than not, you'll get a call from our SOC team, someone like August, letting you know, hey,
this has been blocked.
Was it something you meant to do?
Is it something that you want allowed on this system?
It really removes a lot of that annoyance of seeing a ping every time something you do
that again, maybe you've done a million times is suddenly being called up.
You're really handing off that part of it, which even though it might seem like a small
part of your day seeing those pop-ups and seeing those alerts, it does take into it.
It does bring up your stress levels.
It does take over part of what you were doing previously and distract you.
I like that you say you want to call from August because that means the tool is doing
its job.
If you get a call from me, that means that something is not going well and there's bigger
problems.
You want to call from August.
You don't want to call from me.
Yeah.
If you get a call from me, it's because I want to talk about policy.
Be excited.
I hadn't really considered that taking it off their hands as well.
Maybe you have someone in your office who is not really the IT person, but has fallen
into that role and they're actively handling these every time there's pop-ups.
So much easier.
Just to pass that off to the EDR and SOC team.
Yeah.
Then August jumps in and handles it for you.
Yeah.
I was going to say the jumping into the passing it off to a SOC team member is a lot more
efficient than having to deal with it yourself.
This is a stat that I heard.
I don't know if it's, I believe it's correct, but it takes about seven minutes for the brain
to switch from focusing on one task to another.
So if you're deeply working on a project and you get blocked by your EDR tool, having to
go in, make the exclusion, figure out how to do it, opposed to someone like myself giving
you a call and saying, hey, let's get this figured out and then be on your way.
So it saves, I think, time, money, efficiency, and just to offload that work onto us.
So.
Exactly.
And that's before we get to the two weeks of downtime for not having.
Exactly.
You don't want to hear Sherp.
I don't want to call you guys either.
It's no fun for me either.
Yeah.
And, Chef, when you messaged me the other day saying you wanted to chat, I'm like, oh,
no, what's happened?
Perfect.
Wow.
Well, we've gone deep into the technology of EDR, and I'd love really quickly if somebody's
listening to this and they're like, I got to jump on that bandwagon.
What would be an action step as our closing thoughts, if there's anything else you want
to share?
And then what is an action step that someone could take to start their journey into implementing
planning or researching EDR?
Well, without just straight up being a sales thing here, I mean, you can tell we all love
to talk about this.
There's a bunch of stuff online.
There's blogs and YouTube videos that you can dig into.
But you can spend as much time researching this as most of us have here.
I know Sherp and I spend, and August as well, spend so much time reading about these, reading
about the tools that exist and how it changes.
And everyone's free to do that.
The information we're reading is the same information you're reading.
But also, do you want that in your brain?
Do you want to have to keep all that there?
Not just us, there's a lot of organizations that will help with this, but reach out to
us.
We're friendly.
We'll say hi.
That next step is really about finding out how it will integrate into your business.
So whether you're doing that research yourself or getting some assistance, think about how
you can integrate it in a way that allows you to keep that triad, the CIA triad in your
mind and secure the system better without causing any additional complexity or harm
to the way that you currently work.
To also add to note, as you're researching, do keep in mind that there are many tools
out there, but EDR itself is not going to be a catch all stop all year 100% protected.
There is still other layers that should be put in place and should be discussed.
EDR is a huge step forward, just like MFA is for your logins.
If you put this in place, it's going to give you a huge amount of protection, but it's
not going to protect everything.
You need to factor in other things that are going on.
I know this podcast is purely about EDR itself, but as we're talking about this, it's important
to know that there's no one size fits all perfect solution for everything.
So you need to understand what is right for your business.
EDR will help immensely, but there are other things that do need to be considered when
you are trying to increase your security posture.
Please listen to any of our other compliance podcasts for more information.
Yes, I love it.
Yes.
And if you have any questions or want to learn more about EDR or talk to any of these people,
feel free to reach out to us at info at cit-net.com or head out to our website at cit-net.com
slash podcast.
Thank you Matthew, August, and Andrew for joining us today and we'll be back next week
with an all new episode.