Cyber Essentials and Cyber Essentials Plus Explained
Cyber Essentials is the UK Government backed scheme that shows your business has the basic security controls in place. Here is how it works, what it costs and how to prepare.
What is an endpoint?
An endpoint is any device that connects to your network and is used to do work: laptops, desktops, servers and sometimes phones and tablets. Each one is a potential entry point for an attacker, whether through a malicious email attachment, a dodgy download, an infected USB stick or a security hole in out of date software.
Endpoint protection is the security software that runs on those devices to stop, detect and deal with threats. For a business, it needs to be centrally managed so someone can see every device, know that protection is working and act quickly when something is found.
Antivirus, EDR and MDR explained
These three terms come up a lot, and it is worth understanding the difference.
Antivirus (endpoint protection)
Traditional antivirus looks for known threats. It compares files against a database of malware it has seen before and blocks matches. Modern business products such as VIPRE Endpoint Security Cloud go further, using machine learning to spot new malware and protecting at the file, application and network levels. This stops the large majority of everyday threats.
Endpoint detection and response (EDR)
Some attacks do not involve an obvious malicious file. An attacker might use legitimate tools already on the computer, or run code that only exists in memory. EDR deals with this by watching behaviour. It records what processes are doing, flags activity that looks wrong and gives the person investigating the tools to isolate the device, stop processes and see exactly what happened.
Managed detection and response (MDR)
EDR is powerful, but it creates alerts that someone needs to look at, including at 3am on a Sunday. MDR adds a team of security analysts who monitor those alerts around the clock, decide which are real and take action to contain threats. For many small businesses, MDR is the most practical way to get round the clock security monitoring without employing a security team.
How VIPRE protects against ransomware
Ransomware encrypts your files and demands payment to unlock them. VIPRE uses several layers to stop it: blocking known ransomware, detecting the behaviour of encryption in progress and, on supported plans with VIPRE Advanced Active Protection, rolling back changes made to files on Windows devices. We combine this with properly tested backups, because no security product can promise to stop everything, and backups are what let you recover if something gets through.
Which level of protection do you need?
Every business we look after should have centrally managed endpoint protection on every device. That is the baseline.
EDR is worth considering for most businesses, particularly if you hold sensitive client data, work in a regulated profession such as law or accountancy, or have staff working remotely. MDR makes sense if you want round the clock monitoring and a faster response outside office hours, or if a customer, insurer or contract expects it.
We will look at how your business works, what data you hold and what your budget allows, and recommend a level that makes sense. We will not push you towards the most expensive option if you do not need it.
What happens when a threat is found
When VIPRE detects something, it blocks or quarantines it and raises an alert. Our team reviews the alert, checks whether it is a genuine threat and, if it is, investigates how it arrived and whether anything else was affected. Where needed, we isolate the device from the network, clean or rebuild it, reset any affected passwords and restore files from backup. We then let you know what happened in plain English and whether any further action is needed.
Endpoint protection as part of a wider plan
Endpoint protection works best alongside the other layers of security. Email security stops many threats before they reach a device. Regular updates close the security holes that malware exploits. Multi factor authentication protects accounts even if a device is compromised. Staff training reduces the number of risky clicks in the first place.
Malware protection is also one of the five technical controls in Cyber Essentials, so getting it right helps if you are working towards certification.
Local support when an alert goes off
When a threat is detected on one of our clients' devices, our team in Sunderland investigates. If a device needs to be isolated, cleaned or rebuilt, we do it, remotely where possible or on site across the North East when needed. You get a clear explanation of what happened and what we have done about it. Get in touch to talk about protecting your devices.