Antivirus catches known malware but can fall short against attacks using stolen passwords and legitimate tools. EDR, updates, restricted privileges and disk encryption should be considered together.
In many businesses, the first thing that comes to mind when security is mentioned is an antivirus program installed on the computers. Antivirus is still a necessary layer, but a significant share of today's attacks proceed without any known malicious file, using a stolen password or tools already present on the system. This article looks at what antivirus catches, what it can miss, and what you need to add alongside it to protect your computers.
What counts as an endpoint?
An endpoint is the general name for any device that connects to the network and handles data: desktops and laptops, company phones and tablets, servers. Endpoint security is the set of measures that protect these devices from malware, unauthorised use and data loss. Because attacks often start on a user's device, this layer matters as much as network security.
Start with a device list. How many computers, phones and servers are there, who has each one, and which operating system version does it run? A device that isn't on the list can't be protected or updated, and nobody notices when it goes missing. Don't forget laptops used by remote staff who rarely come into the office.
What classic antivirus does, and where it struggles
Traditional antivirus compares files against definitions of known malware, called "signatures". It is good at catching known malicious files, and most current products add detection of suspicious behaviour on top. Even so, some situations stretch this approach:
- Stolen credentials: A sign-in using an account whose password was captured through a phishing email may fall outside antivirus's scope, since there is no malicious file involved.
- Misuse of legitimate tools: Attackers often use command-line and administration tools that already exist in the operating system. These tools are not harmful in themselves; what is harmful is how they are used.
- New or modified malware: Malware whose signature has not yet been published may go unnoticed in the first hours.
- Disabled protection: A user with administrator rights, or an attacker, can switch the protection software off.
EDR: seeing an incident and responding to it
EDR (endpoint detection and response) is an approach that continuously records what happens on a device and tries to spot when steps that each look harmless form a suspicious chain. For example, an email attachment being opened, followed by a command-line tool running, followed by that tool connecting to an unknown address on the internet, are assessed together. When something looks suspicious, the device can be isolated from the network remotely and the incident traced back to see how it began.
| Classic antivirus | EDR | |
|---|---|---|
| Focus | Blocking known malicious files | Seeing suspicious behaviour and the chain of events |
| Response | Deleting or quarantining the file | Isolating the device, stopping the process, investigating the incident |
| Records | Limited | Detailed record of activity on the device |
| People needed | Low | Someone has to assess the alerts |
EDR shows its value when someone is looking at the alerts. If nobody in-house has time for this, consider a managed service that monitors the alerts on your behalf. Otherwise a powerful tool can turn into a list of alerts that nobody reads.
Layers to add alongside antivirus
Updates
A route attackers use frequently is vulnerabilities whose patches have been released but not applied. Keep not only the operating system up to date, but also browsers, office applications, PDF readers and other commonly used software. Being able to see centrally whether updates are installing automatically is far more reliable than walking from computer to computer. Operating systems that have reached the end of the manufacturer's support no longer receive security updates; put those devices on the replacement plan.
Remove administrator rights
A user who does their daily work with an administrator account unknowingly hands the same rights to any malware they run. Have users work with standard accounts, and use a separate administrator account or an approval process for tasks such as installing software. This change helps limit the impact of many attacks.
Disk encryption
The biggest risk of a lost or stolen laptop is the data on it. Turn on the disk encryption built into the operating system, and store recovery keys somewhere secure that the company, not just the user, can access. With encryption on, removing the disk and connecting it to another computer is not enough to reach the data.
Locking down protection settings
Turn on "tamper protection", which prevents users or malware from switching off the protection software, changing its settings or uninstalling it. In the central management console, regularly review devices where protection is off, signatures are out of date or the device has not checked in for a long time.
When malware is detected on a device, don't settle for deleting the file. Disconnect the device from the network, change the passwords used on it and try to understand how the malware got there. As long as the same route stays open, a similar incident can happen again.
Phones and servers
Phones used to open company email and files are endpoints too. Mobile device management (MDM) lets you enforce screen locks on phones, manage apps and remotely wipe company data from a lost device. Where company data sits on an employee's personal phone, solutions such as a work profile that separates work and personal space respect both security and the employee's privacy.
Servers should also fall within endpoint protection. Defining broad exclusions on servers for performance reasons is a common habit; limit exclusions to the folders and processes the manufacturer recommends, and note the reason for each.
Questions to ask when choosing a solution
The feature lists of endpoint protection products look alike; the difference often shows in day-to-day use. Before deciding, look for answers to these questions:
- Coverage: Can it manage every operating system in use across the company, covering computers, servers and, if needed, mobile devices, from a single console?
- Visibility: Can the console easily list devices where protection is off, that are not up to date, or that have not been seen for a long time?
- Clear alerts: When an alert arrives, is it clear even to a non-specialist what happened and what needs to be done?
- Response options: Can a suspicious device be isolated from the network, and a suspicious process stopped, from the console?
- Performance: Does it put an acceptable load on older computers and busy servers? See this for yourself on your own devices during a short trial.
Run the trial with a few different user profiles: for example, a computer that uses the accounting software heavily, a laptop used in the field and a server. That way you can spot compatibility problems before the product is rolled out across the whole company.
Checklist
- Is there an up-to-date list of all computers, phones and servers?
- Is protection software running on every device, and can it be monitored centrally?
- If EDR is in use, is there a person or service assessing the alerts?
- Are operating system and application updates applied regularly, and have systems past end of support been identified?
- Do users do their daily work with accounts that lack administrator rights?
- Is disk encryption on for laptops, with recovery keys stored somewhere secure?
- Are settings that prevent the protection software from being switched off enabled?
- Are phones that access company data managed with a screen lock and remote wipe?