Cyber Threats
A Better Way to Secure Servers & Cloud Workloads
Why endpoint security falls short in the complexity of modern IT infrastructure
Save to Folio
The scope of modern IT infrastructure extends well beyond user endpoints to encompass servers and cloud workloads. These workloads range from basic files and print servers to mission-critical systems, employing physical servers, virtual machines, cloud workloads, containers, and often a combination of these technologies. Complexity increases with the evolution of infrastructure, as does the need for security.
While it may seem convenient for organizations to extend their existing user endpoint security licenses to cover their servers, this approach might not result in the best security posture. Sure, iit'ssimple to have one protection product across the environment, but it could leave critical vulnerabilities unaddressed.
User endpoints and servers have different security needs
According to Gartner1, "the end-user endpoint is regularly exposed to threats through email, websites, cloud services, or USB drives. By contrast, threat actors target server workloads using software and configuration vulnerabilities, lateral movement, and stolen employee credentials. These differences in threat exposure create a need for distinct security requirements and protection strategies for end-user endpoints and server workloads."
A simple padlock is probably enough to secure your belongings for an hour or two in a gym locker, but would you use that same padlock to secure all the valuables in your home? Probably not. We are not saying that endpoint security is a simple padlock, but it's not always sufficient. User endpoints and servers are exposed to distinct security threats and require different forms of protection. Given the critical importance of some servers and workloads, it's crucial to prioritize and optimize their protection to prevent potentially catastrophic breaches.
Cloud workloads require dedicated security features and protection
Whether you use Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform, or other cloud services, workloads are susceptible to vulnerabilities from their instantiation.
Integrating a built-in workload discovery capability with cloud service providers is crucial for both efficiency and security. Beyond discovery, you'll want automation and visibility functionalities to ensure that security gets configured and deployed automatically as soon as new workloads are instantiated.
Most organizations manage their workloads across servers, virtualized data centers, and cloud. Many also work with multiple cloud service providers for different business use cases and cost considerations. This is only getting more complex over time, so it's critical to have a security solution that supports hybrid and multi-cloud strategies. You need to be able to meet your business goals without complicating IT and security operations.
Some key capabilities that should be considered for your server and cloud workload protection:
- Linux platform support – A substantial portion of workloads are based on Linux. A solution supporting an extensive range of Linux platforms can secure your current and future environment as the infrastructure grows.
- Virtual patching -- Virtual patching (using host-based intrusion detection systems/intrusion prevention systems (IDS/IPS)) is critical for detecting and blocking server operating systems and application vulnerabilities, especially before a vendor patch is released.
- Integrated EDR/XDR across endpoints, servers, and cloud workloads – A single EDR or XDR solution helps cross-layer correlations and visibility, simplifies your IT and security operations and improves your security outcome.
- Integrity monitoring -- Detects changes to files, running services, ports, and critical system areas, like the Windows registry, which could indicate suspicious activity. The ability to detect unauthorized changes is a critical component in your server and cloud security strategy because it provides visibility into changes that could indicate the compromise of the system.
- Log inspection – Collects and analyzes system and applications logs. It lets you detect suspicious behavior and collect events across heterogeneous environments containing different operating systems and diverse applications to create and maintain audit trails of administrator activity.
Conclusion
It is imperative for organizations in any industry to have modern security so they can pursue their business objectives safely and with confidence. It's best to use a security solution optimized to protect user endpoints, servers, and cloud workloads for a strong security posture without added complexity.
Trend offers leading security solutions in one powerful, SaaS-based solution— Trend Vision One – Endpoint Security™. Our platform is designed to support a wide range of hybrid IT environments with detection and response and attack surface management. It can automate and orchestrate workflows and connect you to cybersecurity experts to help quickly stop threats and take back control of your cyber risk.
1 Gartner, Prioritizing Security Controls for Enterprise Servers and End-User Endpoints (Evgeny Mirolyubov, Peter Firstbrook, January 2023)