Zero Trust Security

Chapter 8 Endpoint Detection and Response

As you check your email, an alert from the network monitoring team catches your attention: malicious traffic detected from a satellite office workstation. This situation highlights a critical gap in your Zero Trust implementation – while you’ve established network segmentation and monitoring, you lack the ability to verify and validate endpoint security status in real-time. The choice between sending an incident responder or shipping the computer back to headquarters represents an unacceptable delay. It’s time to implement comprehensive endpoint monitoring.

First, let’s look back at what we have achieved so far. We segmented the network to help mitigate the possibility of lateral movement. Gained visibility into the network using a network monitoring system. Looked at identifying and separating the engineering ‘normal’ activity from their administrative activities on the operational technology (OT) network, using Jump Box. The next project we will look at is getting visibility into all the endpoints in our organisation. This will help us determine if they have been compromised. The goal is to know if we can trust the system. One solution to this problem is Endpoint Detection and Response (EDR). This is a software agent that sits on the computer and constantly monitors the system for any threats and responds in real time, by either blocking or alerting to malicious activities. With all the agents controlled from a centralised location, ...