Outbreak control: keep functioning throughout an attack

Cyber protection is often a balance between stopping breaches and allowing a company to continue functioning. “Basically, there's always a certain balance between usability and protection. In many cases, companies may have to accept some risks or have some settings which are a little bit more lenient to ensure that people can do their daily work in a way that doesn't cause friction,” says Mika Arasola, Senior Product Manager at WithSecure.  

This update allows both to happen simultaneously. So, what exactly does it mean and how will it help your company?

Firstly, we can now see all EDR detections in the EPP device view. This is because our EPP and EDR are seamlessly integrated and work together at all times. With this update, EPP can see even further into what is happening on the EDR side and react accordingly. 

Once the detection has automatically occurred, there is an added ability to change the profile assignment. This means you can create a separate EPP profile that has somewhat stricter rules, as well as automated tasks that could improve the situation – such as installing patches for all available security updates immediately, as well as turning on application control rules, automatically implementing stricter firewall configurations and launch manual malware scanning. 

You can also choose to specify the EDR severity when the profile is changed and whether you only deal with severe detections or lower priority as well. 

Once those EDR detections have been closed in the EDR portal, the original profiles will change back to whatever other profile should be assigned to that device. “Essentially, it gives the partners the ability to dynamically react to some risks or potential issues in their environment,” Arasola continues.