Published on September 10, 2015

Must know before buying an endpoint security system

Cyber security is a hot topic. Quite frankly it always was an interesting subject, though today threats have been advancing at an alarming rate, companies are increasingly more concerned about their data, especially after the amount of data breaches reported this year and actively pursuing strategies to build better guards for their intellectual property.

With all that said, the cyber security industry is changing and at a fast pace. This causes market confusion where companies become unsure on where to invest.
The purpose of this article is to, at a high level, offer some guidance when purchasing a new cyber security product.
Firstly, there are three types of solutions one could go for.

Signatures and Heuristics

The first are signatures and heuristics-based security solutions, these are the most basic types of protection. Several antivirus solutions and internet security suites, claim to utilize heuristic detections to find malware. What this claims is that the heuristic technologies can find viruses that have previously been unknown, detecting and defending from new malware that has yet to be discovered and added to virus definition files. Antivirus software may use one or several techniques to proactively detect malware. The main essence of each method is to analyze the suspicious file’s characteristics and behavior to determine if it is indeed malware. The challenge with heuristic solutions are that they can easily be bypassed and we won’t delve into signatures, since as of 2015 it’s crystal clear that they are not reliable anymore, especially against new malware and variations of old ones.


The second security solution type are called sandboxes. Sandboxing solutions are more effective than heuristic solutions. A sandbox is a safe isolated environment that replicates an end user’s operating environment where one can run binaries, observe the environment and rate it based on activity rather than attributes. This is an effective way and looking at a behavior of a file before passing it on to the actual environment provides a higher level of protection.
The problem with sandboxing is that malware today can lie dormant for weeks or they can activate on a particular series of events that is never triggered inside the sandbox. This means that the sandbox environment will perceive the file to be safe, when in fact it is just waiting to be transferred to the real environment before attacking.

Real-time Behavioral Analysis

Lastly, we have behavioral analysis based solutions. Behavioral analysis based solutions work by studying how the applications behave in real time, flagging or stopping any threat as it happens. With the power of artificial intelligence and low level programming, behavioral based solutions are in an ideal place to protect against malware of tomorrow with negligible impact on the end user.

A behavioral based solution extends the inspection window time to the whole application’s life as opposed to just those few minutes of a traditional sandbox.

When developing a security strategy, companies are today realizing the importance of the end points. This is lending to strategies of an endpoint-first approach where by the primary focus is on delivering leading end point protection, followed by network monitoring solutions. Security today is made of layers and missing one can jeopardize your business forever.
Having the right approach to security is essential to surviving in today’s world. Studies are increasingly showing warning signs of ineffective security systems and as we replace old technology with new, peace of mind starts to become a reality.
If you wish to know more about how the cyber security industry is evolving, contact us today.