CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

For effective detection, most EDR solutions provide threat hunting tools to scan all the endpoint
data coming from millions of endpoints to see the spread of the infection or malicious intruder
activity. They allow the administrator to then remediate the infected endpoint by providing tools
such as a remote shell where the administrator can login to the infected endpoint and remove the
malicious files.
However, EDR solutions also have certain limitations. Customers and solutions can get
overwhelmed with the amount of data that needs to be recorded and analyzed to see malicious
behavior. Remediation becomes increasingly hard. The volume of data will only increase as a
company keeps adding headcount with more employees who generate more data. This is the
reason why EDR solutions often package managed security services along with their product as
regular customers are not able to handle the complexity of managing a Security Operations
Center and personnel who can analyze this data.
Whitelisting, Blacklisting and Process Controls
A doctor rarely tells you to eat everything and then runs a series of tests to tell you what is wrong
and prescribes medicines to control your ailment. Rather, (s) he asks you to avoid certain types
of food which could make you sick. It is no different with security. Rather than allow the user to
run every possible application and every possible sequence of commands and then check in the
cloud whether a sequence was malicious or not, an alternate approach would be to simply stop
the user from doing certain sequences of actions or running certain applications.
Whitelisting and Blacklisting techniques are extremely effective in fixed function devices and
environments with limited change to the endpoints. Here, it would be much easier to simply
analyze all the running processes, create a set of process controls and then lock the device down.
With this approach, rather than scan the universe for all possible bad sequences, vendors prefer
to lock down systems to known good behavior. In such an approach, any new process created
outside the known list of allowed processes would trigger an alert or be blocked before execution.
Likewise, any process which triggers a network connection other than the well-known utilities like
a browser or a file transfer utility will trigger an alert or be stopped prior to execution.
Bringing It All Together - ColorTokens Approach to Security
At ColorTokens we want to bring the power back to endpoint and make it smarter. The endpoint
is the start of any communication and therefore the best place to enforce security. We start by
sitting at the endpoint, understanding the user who is at the endpoint, understanding his/her
access permissions, understanding what applications (s) he uses, and of course all the files (s)
he downloads as payload using these applications. The rest of the endpoint security is all about
the last part where we focus on analyzing the files (s) he downloads into their endpoint and
examining the malicious behavior of the payload.
Color Tokens RADAR360 performs the analysis of the files using traditional Endpoint Protection
Controls. We record events to ensure that some malicious sequence is not skipped. However, we