Case for endpoint intelligence

BETHESDA, USA: Automation and process to monitor endpoints for threats are lacking in organizations, according to a survey completed by 948 IT professionals conducted by the SANS Institute. Full results of the survey, sponsored by Guidance Software, will be discussed during a March 13 Webcast at 1 PM EDT.

More than 47 percent of 948 respondents to complete the survey say they operate under the assumption that they've been compromised.

The survey also indicates that attackers are evading edge security without the use of advanced technologies. In the survey, 51 percent indicated that the majority of compromises they experienced were the result of unsophisticated attack technologies.

Compromises directly relate to lack of automation and visibility into endpoints, according to responses. "Survey participants clearly identified the need for automation in their detection and remediation operation," says SANS Analyst Jacob Williams, author of the report. "The good news is that automation is on the rise, and most respondents will be automating some aspects of endpoint intelligence and remediation in the next 24 months."

Respondents would particularly like to be collecting more data from their endpoints and coordinate it with their network information for a clearer view of their threats and vulnerabilities, continues Williams.

"Survey respondents are not collecting as much data from their endpoints as they would like," he says. "This collection gap was most clear when considering network artifacts stored at the endpoint (for example ARP cache entries)."