2019年Gartner魔力象限：云驱动的终端防护平台崛起

版权申诉

90 浏览量更新于2024-07-04 收藏 515KB PDF 举报

2019年的"Magic Quadrant for Endpoint Protection Platforms"报告发布于2019年8月20日，反映了当时endpoint protection市场正经历深刻变革。随着新的方法挑战现状，该研究重点评估了那些在强化防御、检测高级和无文件攻击以及响应能力方面表现出色的解决方案。特别青睐的是基于云的EPP（Endpoint Protection Platform）产品，它们融合了产品和服务，提供了一体化的保护。战略规划假设指出，到2025年，基于云的EPP解决方案将从新交易中的20%增长到95%，显示出云部署在这一领域的巨大潜力和发展趋势。这意味着企业越来越倾向于选择无需本地服务器管理，而是通过云端实现的高效且可扩展的安全解决方案。市场定义或描述部分强调，这份报告是2019年8月23日修订后的版本，用户应查阅Gartner网站上的更正页面获取更多信息。传统的EPP解决方案依赖于客户端代理，由企业内部管理服务器控制，而现代EPP则采用云原生架构，这种转变带来了以下几个关键优势： 1. 云化部署：基于云的EPP消除了对本地基础设施的依赖，允许随时随地访问，提高了部署灵活性和响应速度。 2. 硬核防护：这些平台通常具有更强的恶意软件防护能力，包括深度检测和实时防护，以抵御不断演变的威胁。 3. 检测与应对：它们能够智能地识别和分析潜在的高级攻击，如文件less攻击，确保更快地发现并采取行动。 4. 动态响应：云EPP能够动态适应安全环境，通过自动化和机器学习技术，实现快速而精准的威胁响应。 5. 服务集成：云平台常常集成了多种安全功能，如防病毒、防火墙、入侵检测等，为用户提供一站式的安全解决方案。总结来说，2019年的这份报告不仅描绘了EPP市场的当前状态，还预示了云化安全解决方案将在未来几年内占据主导地位，为企业提供更高效、弹性和智能的终端保护。对于IT决策者来说，理解并考虑这种转型至关重要，以确保组织在不断变化的安全威胁面前保持最佳防御态势。

 The EDR incident response management experience is enhanced by contextual

information on process and automatic correlation of suspect events. Remediation

capabilities include encrypted file restoration, full attack chain sterilization and machine

isolation.

 SandBlast Mobile for Android and iOS provides jailbreak detection, device

configuration and profile monitoring, malware and man-in-the-middle attack prevention.

Cautions

 Despite its long history in the market, Check Point has struggled to gain market and

mind share.

 Only incident-related data and event forensics reports are stored in the central

management system. Raw data is stored locally on the endpoint. Other enterprise-

class features such as workflow, advanced threat hunting and custom rule creation are

lacking.

 Rogue client detection is limited to data stored in Active Directory. The vendor does not

offer any vulnerability or configuration management capabilities.

 Management experience is inconsistent. Investigations traverse several different

interfaces, tabs and windows. Some of the user interfaces are Win 32-application-style,

while other components were more modern UI designs. Policy configuration involves

myriad pop-up windows. Mac and Linux searching can only be done via command line.

 Check Point does not participate in regular testing of its effectiveness, appearing in

only four tests in the past 12 months. Check Point cloud management for the

SandBlast agent is new and has limited adoption at the time of publication.

Cisco

Cisco offers Advanced Malware Protection (AMP) for Endpoints, which consists of

prevent, detect and respond endpoint security capabilities deployed with a cloud or on-

premises management console.

Cisco’s AMP for Endpoints makes use of AMP capabilities that are also available in other

Cisco security offerings including threat intelligence data from Threat Grid and Talos

security research. AMP for Endpoints integrates with other Cisco security products, such

as secure email and web gateways and network security appliances in the Cisco Threat

Response incident response console.

Cisco’s AMP will appeal to existing Cisco clients, especially those that that leverage other

Cisco security solutions, and that aspire to establish security operations around Cisco

products.

Strengths

 Cisco AMP is highly reputed for its threat intelligence from its well-known Talos

security research team and for its exploit prevention capabilities, both used as a means

of reducing the endpoint attack surface. Cisco recently licensed Morphisec to add

exploit prevention.

 Cisco AMP can perform discovery of unprotected and unmanaged endpoints that

present malicious behavior based on network security information.

 Cisco offers a broad range of managed services, including SOCs, active threat

hunting, and incident support.

 Cisco Threat Response integrates AMP and other Cisco security offerings, such as

firewall, intrusion prevention system (IPS), secure email and web gateways. This

allows for centralized alert consolidation and incident response, as well as intelligence

sharing and policy synchronization in the Cisco Threat Response console.

Cautions

 The Exploit Prevention engine, Malicious Activity Protection engine and System

Process Protection (SPP) engine are only available for Windows. Mac and Linux rely

on the open-source ClamAV for signatures.

 EDR navigation between screens is neither fluid nor intuitive to get a full understanding

of the state of an endpoint or the incident and to pivot to find related items.

 Although the threat hunting functionality has expanded, Cisco AMP still lacks certain

advanced threat hunting capabilities, such as the creation of customized behavioral

protections and the integration of threat feeds. Also, it lacks a community portal for

collaboration with industry peers.

 The majority of Cisco AMP deployments are deployed with another EPP solution to

augment existing protection solutions and interoperate with other Cisco security

solutions via Threat Response.

 Cisco still needs to consolidate its various endpoint agents for Duo, Umbrella,

AnyConnect, Tetration and AMP.

 Cisco is new to public comparative testing, appearing in the NSS Labs test and one

AV-Comparatives test. Its underlying antivirus engine (Bitdefender) is an active

participant in tests.

CrowdStrike

CrowdStrike’s cloud-native architecture provides an extensible platform that enables

additional security services like IT hygiene, vulnerability assessment and threat

intelligence. Its app store, the CrowdStrike Store, allows customers to acquire additional

security functions, such as user and entity behavior analytics (UEBA) and file integrity

monitoring, through partners that exploit the same client and cloud management console.

CrowdStrike has been a leader in the fusion of products and services, with very high

adoption of the Falcon OverWatch service, which provides managed threat hunting,

alerting, response and investigation assistance. CrowdStrike also offers the Falcon

剩余35页未读，继续阅读

matlab大师

粉丝: 2674
资源: 8万+

2019年Gartner魔力象限：云驱动的终端防护平台崛起

2019 Gartner Magic Quadrant for Network Firewalls1.pdf

2019 Gartner Magic Quadrant for Web Application Firewalls.pdf

quadrant[m.qualification <0 & m.local<0] <- 1

Python粒子树代码

帮我用python在四个象限中分别画不同的图形并标注我的名字“蔡锐烨”

string itemName = list[quadrant][i];

iapp中如何做一个四象限 裕语言V3代码

最新资源

iapp中如何做一个四象限裕语言V3代码