The cost of a data breach has reached an all-time high. It averaged $4.35 million in 2022, according to the newly published IBM Cost of a Data Breach Report. What’s more, 83% of organizations have faced more than one data breach, with just 17% saying this was their first data breach.

What can organizations do about this? One solution is endpoint detection and response (EDR) software. Take a look at how an effective EDR solution can help your security teams. 

What is a data breach?

A data breach is a cyberattack where a threat actor infiltrates a data source and exposes sensitive, confidential and protected data. This can occur as a result of ransomware attacks, phishing or malware attacks or other types of data theft. Whatever the source of the breach, it always leads to a loss of trust and damages the victim’s good name. It leaves many questions. How did the attack begin? How many devices did it strike? Have attackers stolen data? If yes, how much and from where?

Sharing an example of how threat actors might launch a phishing attack, Stephanie Carruthers, chief people hacker for IBM X-Force recounts:

“We had a client that wanted us to launch a phishing campaign against a hundred of their employees. We started to look through the company’s website and blogs, and we found a website where employees can post reviews about their employer. One common issue that we saw, which a lot of people complained about, was the parking at their job. So, we crafted a phishing campaign that actually explained how starting Monday, it was going to be assigned parking, and they just had to view the map to see their space, or else they would get towed. And that was one of our successful campaigns because we saw what people absolutely hated, and we tried to fix it in a way. And just by that website where we found all that information, it made our campaign extremely successful.”

What to do after a data breach

After a breach, cyber defenders or blue teams work under a lot of pressure to find answers quickly. Often there is a state of temporary shutdown, resulting in loss of revenue and critical data, which threatens business continuity. After the attack, defenders try to find the infrastructural weaknesses that lead to the attack and fix them. At the same time, they try to neutralize persistent and dormant threats to avoid a second infection.

Attacks often don’t happen randomly. They’re often well-planned by the attackers, who follow a staged process, like what is shown in the MITRE ATT&CK framework, to reach specific goals.

3 stages of a data breach where EDR can help

For defenders, consider data breaches in three primary stages: pre-attack, the actual attack and post-attack. EDR can come into play during each of them.

Pre-Attack Stage of a Data Breach 

At this stage, the organization’s infrastructure appears to be running normally. However, behind the scenes, threat actors may already be busy with reconnaissance. They harvest email addresses and other company information useful for sneaking in.

Often, at this stage, attackers will test defenses to find possible entry points. EDR solutions can improve awareness by offering deep insight into the endpoint and server environment. They offer the telemetry needed to detect an attack in real-time, giving defenders the chance to defend themselves. The threat hunting portion of an EDR can also help in this stage by searching for newly discovered malware or suspicious activities.

Actual Attack Stage 

During the attack stage when the actual malware has been delivered — via email, web, USB keys or other means — speed of reaction is of the essence. Defenders need to neutralize the threat before it can do harm or spread across the entire infrastructure.

Attackers often use targeted malware. So, signature-based defenses like antivirus software that lack behavioral detection don’t help. However, with an EDR solution, defenders can detect the threat quickly by analyzing the attackers’ behavior. They also have several options at their disposal to automatically delete the malware, create blacklists, isolate affected endpoints and track the malware to find out what the attacker is targeting.

To be clear, the last option should only be used by seasoned defenders. Novice defenders should set their EDR in a protective mode, which blocks and remediates malware by itself.

Post-Attack Stage

The primary objective during the post-attack stage is to get back to a normal state fast. It is critical to minimize losses and reduce other operational damage.

A modern EDR solution can collect information about the attack and help reconstruct it to find out how the attack took place in the first place and reveal the weak spots that need to be fixed immediately. To make sure persistent or hidden threats are removed to avoid reinfection, defenders can use the threat hunting capabilities of the EDR tool to hunt for the presence of specific indicators of compromise (IOC), binaries and behaviors in real-time and remediate them. This will help the compromised organization recover and get back to business swiftly.

How to prevent a data breach

Statistics from the Cost of a Data Breach report show that security breaches at organizations with fully deployed security artificial intelligence (AI) and automation cost $3.05 million less than breaches at those without. To help prevent a data breach from happening, companies can employ these five best practices:

1. Limit or restrict access to sensitive or valuable data
2. Train your employees on common threats and protocols to follow
3. Monitor your network remotely, around-the-clock
4. Leverage advanced security protection
5. Develop a security breach response plan.

Cybersecurity is a process, not specific tools. Any tool by itself will not keep your organization safe, but it will help to protect you as part of a well-thought-out cybersecurity strategy backed by processes and people. At the same time, having an EDR solution as part of your security strategy is beneficial as cyberattacks on endpoints will continue to grow, get executed faster and become more sophisticated.

EDR offers detection and remediation capabilities that prove valuable to any organization during all stages of a data breach. For more information on choosing the right EDR solution for your business, download the EDR Buyer’s Guide.