The days of simple endpoint security by way of basic antivirus software is over. Antivirus software works by detecting viruses when they have the signatures of the particular virus in their database, but in today’s day and age, viruses have evolved to the point where antivirus software is not able to detect them on time in order to sandbox them and mitigate their effects. Scanning, screening and protecting endpoints from viruses has become a complex process and in reality, a something that any organisation should consider compulsory. Unfortunately, most antivirus or anti-malware tools available today only find a small fraction of potential infections from constantly adapting attackers.

It’s no secret that distributing malware is a growing business, and the malware epidemic shows no signs of slowing. It has become easier to create and obtain botnets, crypts and zero-day exploits needed to pull high level attacks as malware creation and management education is on the rise. Therefore, it is crucial for organizations to employ the use of stronger security options that do more than traditional anti-virus software, while retaining these functions.

By using endpoint security platforms, cybersecurity engineers are able to monitor, detect, investigate and mitigate suspicious activities and issues on endpoints while learning about various attack life cycles.

Endpoint security platforms should be built on these basic principles for increased efficiency.

1. They should do more than just protection or prevention, they should have detection and behavioral analysis capabilities to mitigate attacks early on.
2. They should correlate data across the whole environment so that the system as a whole can learn and is able to easily mitigate similar attacks.
3. They should be able to monitor the endpoints and its activities without interfering with the normal workflow of the endpoints.
4. Good data visualization should be employed to display results for the benefits of technical as well as non-technical users.

Of course, elements of good endpoint security platforms are not limited to these, but these are the most basic points to look out for when considering endpoint security platforms.

These days, there are numerous advanced endpoint detection and response tools (EDR) that find, mitigate and block the most subtle attacks.

In this post, we will be reviewing three open source tools that take endpoint security to the next level by proactive monitoring and looking closely for threats. They evaluate threats learned and mitigated from each endpoint in a larger ecosystem by examining individual processes on each endpoint and sometimes combining it with the best aspects of network intrusion detection for better security. Each of these are open-source, which has the advantage for the end user of being free. Though there are paid endpoint security platforms available, no single product can offer absolute security, and one has to make compromises or choose one that works best with the particular situation. These open source tools are good enough for sufficient endpoint security for most situations, especially for SMEs who are concerned with keeping costs down.

OSSEC:

OSSEC is an open-source host based intrusion, detection and prevention system (HIPS) that performs both signature based and profile analysis, real-time integrity monitoring and tracking of endpoint activities, and prevents endpoint intrusion. It supports most operating systems including Windows, Linux, Solaris, and others. OSSEC performs log analysis – you are able to see everything that goes on with the endpoints in question. OSSEC collects, analyses and correlates these logs so you can notice any attack, misuse or anomaly. It also performs  file-integrity checking – every attack on your endpoints change a configuration, so the goal of file-integrity checking is to detect these changes in real-time and alerts you whenever they happen no matter how subtle they are. Windows registry monitoring is also part of OSSEC’s features- this feature is particular to the Windows Operating System. OSSEC identifies rootkits and can mitigate related attacks and provides active response with time-based alerting.

This is a very powerful endpoint detection and response security tool and it supports both agent-based and agentless monitoring. It also has a cross-platform architecture that enables you to monitor multiple systems from a centralized location.

Security Onion:

The official catchphrase of Security Onion is “peel back the layers of your network”. Security Onion is a free Linux distribution for intrusion detection, enterprise security monitoring and log management. It works with many other security tools to achieve better efficiency. It is a distinct operating system on its own used for enterprise security management amongst other things. Though it might be expected that due to it being an operating system, it would be difficult to install and work with, this fortunately isn’t the case. This great tool is rather useful when you are pressed for time because the installation is straightforward, as is working with it.

Security Onion integrates three core functions; it is able to perform full packet capture, it has network-based and host-based intrusion detection capabilities, and it serves as a powerful analysis tool.

It is able to do all these and get enough data due to the accompanying security tools that can work with it, amongst which are Snort and Suricata for rule based and analysis based network intrusion detection respectively. It also works with our very own OSSEC for Host based intrusion detection, and Squil and Kibana for data analysis.

Tripwire:

If you want to become more efficient with  managing your security infrastructure, Tripwire is another perfect tool for you. It is available as both an open-source version and full-fledged Enterprise version. The open-source version is a very effective tool, though it is worth noting that the Enterprise version does have more features than the open source version. Just like the other tools mentioned above, Tripwire is able to do configuration management, file-integrity monitoring, asset discovery, vulnerability and log collection. However, the open-source version will only run on Linux and Unix machines, with no support for Windows – though support for Windows is provided for the Enterprise version.

Tripwire monitors Linux systems to detect and alert users to unauthorized changes to files and directories. It creates a baseline of all files in an encrypted file and monitors the files for changes such as  permissions, internal file changes and timestamp details. Cryptographic hashes are then used to detect changes in files without storing its entire content in the database. Tripwire is useful for discovering intrusions after they’ve occurred, and can also serve many other purposes including policy compliance, integrity assurance and change management.

The list of open-source endpoint security platforms is constantly growing. This is critical because cyber-attacks have become a profit-making business and attackers are unrelenting in their efforts to commit cyber-crimes. Thanks to the effort of the creators of open-source tools, attacks can be mitigated and nipped in the bud, and malware can be studied and analyzed to make cybersecurity easier in the future.

 Chert Security is a security consulting outfit that specializes in installation and management of open source and enterprise endpoint security platforms among other services. Contact us today.