Is EDR The Silver Bullet For Malware?
VP and CISO for Star and Disney India, overseeing the company's cybersecurity strategy in India. Passionate Whitehat hacker. LinkedIN. getty  Back in 2010, malware was tacked onto files and would execute malicious activities on systems on which it was downloaded. To address this, antivirus solutions were developed to scan files for known malware signatures, which came in the form of series of characters, bits of code or binary files. These traditional solutions were, thus, limited to protecting against known malware signatures. In 2011, a new form of malware called Duqu came onto the scene, and in 2014, another form of malware surfaced called Poweliks. This form of malware runs seemingly user-requested ads on the users system, requiring a large amount of machine memory, all unbeknownst to the user because it covers its encrypted payload in the Windows registry. This application is a good example of a living-off-the-land attack, where a family of threats leverages Windows default components to compromise the host. This new type of malware made traditional antivirus solutions redundant. Companies struggled to protect their assets from this threat, so the entire security industry sprung into action and developed an antidote. In 2013, Anton Chuvakin of Gartner coined the term EDR, which stands for endpoint threat detection and response. EDR tools were designed to grant greater visibility into systems using machine learning and behavior analysis to evaluate system events and identify anomalies. Many companies have installed EDR tools to protect their assets from file-less malware attacks and have proven effective because of their algorithmic implementation. Absolute security isnt possible, as we all know  our control framework is only as strong as our weakest link. In recent years, weve seen great strides in innovation surrounding virtualization tools. This new technology, while useful to organizations and users in general, has also given hackers more power to bypass traditional defenses. To prove this, I carried out a small exercise  I aimed to avoid an EDR solution using a virtualization tool. Virtualization technology has opened up many doors for businesses hoping to scale up, but security controls havent scaled fast enough to secure these virtualized environments. As such, were currently only focused on deploying EDR solutions on physical endpoints because many people assume that anything running on a physical host will be protected from malicious activities. When it comes to virtualization, these tools create an opaque layer on which they manage an environment. Because of this, any EDR solution running on the physical host wont have visibility on the files and services running on that virtualized image. I used this concept to bypass an EDR solution running on a physical host to simulate an attack on the network. Any adversary can use this technique to move laterally through a system, identify vulnerable services, map the whole network, access vulnerabilities and successfully execute a breach. Its clear to see, from this, that new technological adoptions can facilitate the breach of security controls that were once considered invincible. Industries are adopting virtualized solutions to run their production environment in the hopes of securing better scalability and availability. Because of this, we need to ensure that these solutions are assessed against security benchmarks like NIST and CIS. This will help security professionals develop a better security requirement checklist before adopting any new technology solution. In this fast-paced industry, technology is constantly evolving  and it will continue to do so. To match this constant evolution, every organization should form a technology council, in which their business, IT and cybersecurity departments come together to evaluate any new technology solution the organization might need. From there, they can assess that solutions ease of adoption and its security resiliency. Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives.