This post was from the August edition of our newsletter. Want to get content like this delivered straight to your inbox for free? Sign up here!

Cybersecurity Basics: Anti-malware platforms

When engaging with security vendors, you’ll usually hear waaay too many acronyms. I often say that our industry suffers from TMT (Too Many TLA (Three Letter Acronyms)).

My goal this edition is to bring a little clarity into some of these TLAs. When dealing with anti-malware platforms, there are usually three that are thrown around most often:

EDR – Endpoint Detection and Response MDR – Managed Detection and Response XDR – eXtended Detection and Response. EDR was already taken so they had to get creative.

Before we dive into defining each of these, it’s important to know what we’re talking about: what exactly is an anti-malware platform?

What is an Anti-Malware platform?

An anti-malware platform, sometimes casually referred to as an antivirus, is a program that runs on your computer that helps protect it against threats by scanning and monitoring your system for unauthorized applications, processes, scripts, and more. These unauthorized applications, processes, and scripts are collectively referred to as malware. Threat actors are constantly creating new, dangerous malware, and anti-malware platforms stand as one of the most important lines of defense against these attacks.

How many hacks could a hacker hack if a hacker could hack hacks?

Simple enough. Where things really start to get muddy is with the additional features and systems that these platforms feature, and how they work. Here’s where we start to delineate further.

EDR

An EDR is your basic anti-malware system. It runs on your machine, it checks, scans, but may not have the latest, most powerful features, or may not connect to a central control panel for centralized management.

EDRs are usually best suited for small companies (less than 10), since their easy deployment and minimal management make them ideal for organizations that just want some simple protections. However, they have one main issue: because there is no central management system, they don’t scale well as a company grows.

MDR

MDRs resolve the big issue we discussed with EDRs. MDRs introduce a management layer on top of the anti-malware platforms themselves. This management layer will usually be something like an online portal that offers visibility into the status of all configured endpoints. MDRs allow teams to keep an eye on the security of all endpoints under their watch simultaneously.

With an MDR, organizations have more tools to manage multiple endpoints, and respond to potential security issues. Here’s where MDRs fall short: they only monitor and protect endpoints. What happens if you have other layers that you want to… eXtend.. protection to, like… Emails, or online file sharing?

XDR

Introducing the final (so far) evolution of detection and response systems: the XDR. Like the name suggests, XDR’s go beyond just protecting endpoints, they provide a unified platform to protect multiple aspects of your business.

Cyber attacks are more sophisticated than ever. Attacks may involve endpoints, emails, web activity, etc. For example: traditional EDR or MDR may have great visibility into what’s going on in a computer, but what if the attack originates from an email, or even a malicious website? If malware is installed, the EDR/MDR may be able to respond to it, but a proper XDR would be able to detect and prevent the attack even earlier (and thus, prevent the attack more securely and reliably), since it has visibility into multiple systems.

Basically…

EDR is like having a security guard watching over one computer. MDR is like a team of guards working together from a central office, protecting many computers at once. XDR is like a security team that not only protects computers, but also watches over emails, network traffic, and other systems while coordinating defense across everything at the same time. They all share the same goal: Stop and prevent cyber attacks.

EDRs, MDRs, and XDRs all work relentlessly to keep you safe

Now here’s the big question: which one is right for your business?

Here is my guide:

If your organization has less than 10 computers, and you use less than three cloud apps for business (an app can be your email services, online storage, project management software, etc.), EDR is probably fine. If your organization has more than 10 computers, but you still use less than three apps for business, an MDR is probably fine. If you use more than three cloud apps for business and more than ten computers, an XDR is probably the best route, since your security requirements have likely surpassed the capabilities that an EDR or MDR can provide.

This isn’t an exhaustive guide, and the truth is that each business is unique, with different needs and priorities. If you’d like to learn more about which tool may be right for you, reach out to us and we’d love to help you with that!