Endpoint Detection and Response: The Closest Thing to a Silver Bullet to Stop Ransomware

6/16/2021

By Paul Caron

 

In its recent report “Combating Ransomware,” the Ransomware Task Force says there’s no silver bullet to solving the ransomware challenge. Instead, the group touts a multi-pronged approach and provides an extensive list of recommendations to help companies better defend against this growing threat.

While I don’t disagree, for example, that coordinated global action and greater awareness to the severity of this threat are necessary, I couldn’t help but notice a glaring omission from their list: behavioral endpoint detection and response (EDR).

Why aren’t more companies using EDR solutions to combat ransomware?

For our clients, our number one recommendation to prevent or recover from a ransomware attack is to deploy endpoint protection. It’s the closest thing to a ransomware silver bullet you’re going to find — and should be a best practice.

EDR solutions are not based on malicious signatures that ransomers can easily evade. Rather, behavior-based EDR tools search for suspicious patterns of behavior that could indicate malware. And unlike antivirus, they are capable of spotting yet unknown malware, including more sophisticated threats like zero-day attacks; and they combine real-time continuous monitoring with automated analysis and response.

Cost effectiveness of EDR

EDR is not costly, especially considering the potential expense of a ransomware attack. Beyond the ransom payment itself come all the associated attack costs. As Kevin Baker detailed in his “Hidden Costs of Cybercrime” blog, companies must understand that, in the event of an attack, they will be paying for: remediation, repair, restoration of data and IT infrastructure, legal counsel, litigation defense, breach notification, business downtime, reputation damage and lost customer trust, regulatory fines, and increased insurance rates.

Many companies choose to stick with traditional antivirus solutions because they are a slightly less expensive option than EDR. But while EDR may cost more upfront, it’s much more cost-effective in the long run. And too many companies are realizing this after it’s too late, once they’ve been hacked and painfully understand they should have and need to invest more in security.

Ease of deployment and effectiveness

EDR is as quick and easy to deploy as a traditional antivirus solution. Like antivirus, EDR is agent-based, and organizations can automatically install it via a group policy or on an individual basis and, within a day, begin to reap the solution’s benefits.

When Arete’s incident response teams are called on to help victims recover from ransomware attacks — on average, 50 cases per month — this speed and ease of deployment are critical. They immediately deploy EDR technology to contain the attack and provide clients with a clean, safe environment to restore their data and operations.

On top of EDR solutions being intuitive and not requiring a high-level of security expertise, they are incredibly effective, offering functionality far beyond the basic scanning, detection, and “known” malware removal of a traditional antivirus tool. They are designed to protect all endpoints, automatically identify suspicious activity, and mitigate threats in real time. In the case of ransomware, this can mean stopping ransomware encryption, lateral movement, and data exfiltration.

At Arete, we’ve only seen threat actors successfully attack behavior-based EDR systems four times in the past five years. In two of those cases, the  client had not fully deployed the EDR solution to all endpoints on the network; in the other two, the client had not protected the EDR management console with two-factor access control, which allowed the attackers to turn off the EDR system.

By comparison, antivirus solutions continue to fall a bit short on effectiveness. Because they are based on pre-populated signatures, attackers can easily evade them with simple changes to their code and sadly, almost all the ransomware victims Arete has worked with have had an antivirus solution in place that failed to detect or block the attack.

If the government can’t solve the ransomware problem, what can I do?

It’s good that the U.S. and international governments are calling for actions to end the ransomware scourge — a threat the director of the FBI has likened to the 9/11 terror attacks. Unfortunately, time is not on anyone’s side.

The daily costs of ongoing ransomware attacks to companies and their clients are too high to wait for possible government action — especially when a cost-effective, near-silver-bullet solution is at hand. If organizations, of any size, want to put ransomware attackers out of business, they should look to deploy behavior-based EDR systems today.