Endpoint Security Technologies

What it is

Endpoint security technologies run on the host itself and decide whether files, processes and connections are safe.

Three are central here. A host based intrusion detection system watches for suspicious activity, antimalware software finds malicious files and behaviour, and a host firewall controls connections to and from the machine.

Each can work with rules, signatures or predictive AI. Knowing how those three differ is the heart of this topic.

How it works

The three technologies protect different things, and the three detection approaches trade accuracy against coverage.

Host based intrusion detection (HIDS)

A host based intrusion detection system monitors one machine for signs of attack. It looks at system logs, file integrity, running processes, registry or configuration changes, and local network use.

A common feature is file integrity monitoring. The system records a hash of important files, and raises an alert if a hash changes unexpectedly.

A HIDS detects and alerts. A host based intrusion prevention system (HIPS) goes further and blocks the activity. Because it runs on the host, it can see activity after decryption, which a network sensor often cannot.

Antimalware and antivirus

Antivirus was built to find viruses, and antimalware is the wider term that covers worms, trojans, spyware and ransomware. Modern products blend several methods.

They scan files when they are written or opened, watch processes as they run, and check reputation. Many report to a central console, so an analyst sees detections across all hosts.

Host based firewall

A host based firewall filters traffic to and from a single machine, by address, port, protocol and often by program. It limits what a compromised host can reach on the network, and what other hosts can reach on it.

On Windows, the built in firewall can be checked from a command prompt. On Linux, tools such as iptables or ufw manage the rules.

C:\> netsh advfirewall show allprofiles
$ sudo iptables -L -n
$ sudo ufw status

A network firewall protects a whole segment, and a host firewall protects one machine even when it is off the corporate network.

Rules, signatures and predictive AI

Signatures are the oldest method. A file hash is a precise signature, but changing one byte changes the hash, so attackers alter files to avoid it.

Rules describe suspicious behaviour, such as a word processor starting a command shell. They find attacks by what they do, without needing the exact file.

Predictive AI, also called machine learning, learns from large sets of known good and bad samples. It looks at features of a file or of behaviour, and produces a verdict or a score. It is useful for unknown threats, though analysts still review its alerts.

Most products use all three. Signatures catch the known threats cheaply, rules catch known techniques, and AI covers what is new.

Where each fits

• Use HIDS or HIPS to watch for integrity and behaviour changes on a key server.
• Use antimalware on every endpoint for files and processes.
• Use a host firewall to restrict ports on every machine, including laptops that travel.