A comprehensive analysis of EDR (Endpoint Detection & Response), EPP (Endpoint Protection Platform), and antivirus security technologies

Cappello, Michael; Καππέλλο, Μιχαήλ

Τεχνολογίες ασφαλείας EDR (Endpoint Detection & Response), EPP (Endpoint Protection Platform) και antivirus

Master Thesis

Author

Cappello, Michael

Καππέλλο, Μιχαήλ

Date

2024-07

Abstract

In today's digital landscape, where cyber threats and data breaches pose significant risks, the need for robust endpoint security solutions is paramount. This thesis delves into the intricacies of three prominent technologies in the realm of endpoint security: Endpoint Detection and Response (EDR), Endpoint Protection Platform (EPP), and traditional Antivirus solutions. Through a comprehensive examination, this research aims to elucidate the functionalities, strengths, limitations, and evolving roles of these technologies in safeguarding endpoints against a myriad of cyber threats. The advent of sophisticated cyberattacks has necessitated a paradigm shift in endpoint security strategies. EDR emerges as a proactive approach focusing on continuous monitoring, threat detection, and swift response to mitigate potential damages. Its ability to provide real-time visibility into endpoint activities, coupled with advanced analytics and machine learning algorithms, empowers organizations to detect and neutralize threats effectively. Complementing EDR, EPP consolidates various security functionalities into a single platform, offering a holistic approach to endpoint protection. By integrating antivirus, anti-malware, firewall, and other security features, EPP fortifies endpoints against a wide spectrum of threats, ranging from known malware to emerging zero-day exploits. Moreover, its centralized management and policy enforcement capabilities streamline security operations, enhancing overall efficacy and scalability. Despite the advancements in EDR and EPP, traditional antivirus solutions remain a cornerstone of endpoint security architectures. While primarily focused on signature-based malware detection, antivirus software continues to play a vital role in thwarting prevalent threats. However, its reliance on signature updates and susceptibility to evasion tactics pose inherent limitations in combating sophisticated and polymorphic malware strains. Furthermore, this thesis delves into the evolving threat landscape and its implications on endpoint security technologies. The proliferation of ransomware, file-less attacks, and supply chain vulnerabilities underscores the need for adaptive and resilient defense mechanisms. As cybercriminals continue to innovate, leveraging AI, automation, and evasion techniques, the efficacy of endpoint security solutions hinges on continuous innovation and proactive threat intelligence. In conclusion, this research offers valuable insights into the dynamics of EDR, EPP, and antivirus technologies, shedding light on their respective roles, capabilities, and evolving challenges in safeguarding endpoints. By understanding the nuances of these security paradigms, organizations can devise informed strategies to fortify their digital perimeters and mitigate the ever-evolving cyber threat landscape. Additionally, it provides an opportunity to review existing solutions and offer recommendations for improvement to providers.

Postgraduate Studies Programme

Κυβερνοασφάλεια και Επιστήμη Δεδομένων

Department

Σχολή Τεχνολογιών Πληροφορικής και Επικοινωνιών. Τμήμα Πληροφορικής

Number of pages

Language

English

URI

https://dione.lib.unipi.gr/xmlui/handle/unipi/16751
http://dx.doi.org/10.26267/unipi_dione/4173

Collections

Τμήμα Πληροφορικής

Show full item record

Except where otherwise noted, this item's license is described as
Αναφορά Δημιουργού-Μη Εμπορική Χρήση-Όχι Παράγωγα Έργα 3.0 Ελλάδα