{"id":25167,"date":"2021-10-15T08:29:44","date_gmt":"2021-10-15T08:29:44","guid":{"rendered":"https:\/\/www.apen.es\/?p=25167"},"modified":"2025-02-28T10:48:30","modified_gmt":"2025-02-28T10:48:30","slug":"cuando-nuestro-antivirus-ya-no-es-suficiente","status":"publish","type":"post","link":"https:\/\/www.apen.es\/en\/blog\/cuando-nuestro-antivirus-ya-no-es-suficiente\/","title":{"rendered":"When our antivirus is no longer enough\u2026"},"content":{"rendered":"

For years the antivirus<\/strong> They have kept our small and medium-sized businesses safe. However, in recent times threat patterns are changing rapidly, and we need a complementary protection tool to safeguard ourselves.<\/p>\n\n\n\n

If we only have one antivirus<\/strong> Traditional vaccination only protects us against known viruses. From that point on, we increase our risk of infection. viruses, malware or even ransomware<\/strong>.<\/p>\n\n\n\n

The consequences of taking those risks can be disastrous for our business, since in addition to losing all the information, it negatively impacts customer service and our reputation.<\/p>\n\n\n\n

What is an EDR?<\/h2>\n\n\n\n

EDR<\/strong>, English acronym for Endpoint Detection Response<\/strong>, It is a system for protecting the company's equipment and infrastructure. It combines the antivirus<\/strong> traditional methods combined with monitoring tools and artificial intelligence to provide a fast and efficient response to risks and potential threats zero day<\/strong>.<\/p>\n\n\n\n

In recent times, companies of all sizes are exposed to the rData theft, espionage, fraud, and malware infections<\/strong> of different natures. The impact of these types of attacks can range from service availability problems to a considerable financial impact.<\/p>\n\n\n\n

How does an EDR work?<\/h2>\n\n\n\n

A system EDR<\/strong> monitors the activity of the endpoints<\/strong> and classifies files as safe, dangerous, or unknown. When it detects unknown files in one of the endpoints<\/strong>, (such as an email attachment), it automatically sends it to the cloud and remains isolated in a test environment. There, it runs, mimicking the behavior a user would have.<\/p>\n\n\n\n

At the same time, a machine learning system observes and learns from the behavior of that threat. After observing it for a while, our system EDR<\/strong> It will determine if it is a safe or dangerous file, blocking it on all endpoints if it considers it dangerous.<\/p>\n\n\n\n

In this way, if we detect that file again in any of the endpoints in the future, it will directly block it, preventing its execution.<\/p>\n\n\n\n

Detects<\/h2>\n\n\n\n

They use AI (artificial intelligence) to reduce the false positive rate and are designed to monitor and respond to a wide range of threats, such as ransomware, malware, botnets, and other known and unknown threats. These include unauthorized access, stealth attacks for data theft, and more.<\/p>\n\n\n\n

Contains<\/h2>\n\n\n\n

It allows for advanced threat blocking. EDR<\/strong> Not only is it capable of quickly detecting new threats, but it can also handle attacks in real time and protect us while they occur.<\/p>\n\n\n\n

Investiga<\/h2>\n\n\n\n

He EDR<\/strong> It allows for a quick and accurate response to incidents. The goal is to stop an attack and get back to work as soon as possible; remember that any company is vulnerable to cyberattacks.<\/p>\n\n\n\n

Elimina<\/h2>\n\n\n\n

Finally, the most important component of a solution EDR<\/strong> It is their ability to eliminate security threats. When a malicious file is removed, the affected parts of the network must also be repaired.<\/p>\n\n\n\n

New generations of zero-day viruses<\/h2>\n\n\n\n