NEW: Microsoft Vulnerabilities Report 2022 - Read the Findings of Our Annual Report Read Now

  • Partners
  • Support
  • Careers
  • English
    • Deutsch
    • français
    • español
    • 한국어
    • português
BeyondTrust
  • Products

    Privileged Password Management

    Discover, manage, audit, and monitor privileged accounts and credentials.

    • Password Safe
    • DevOps Secrets Safe
    • Privileged Access Discovery Application

    Endpoint Privilege Management

    Enforce least privilege across Windows, Mac, Linux, and Unix endpoints.

    • Windows and Mac
    • Unix and Linux
    • Active Directory Bridge

    Secure Remote Access

    Centrally manage remote access for service desks, vendors, and operators.

    • Remote Support
    • Privileged Remote Access
    • Privileged Access Discovery Application

    Cloud Security Management

    Automate the management of identities and assets across your multicloud footprint.

    • Cloud Privilege Broker

    BeyondInsight

    Experience the industry’s most innovative, comprehensive platform for privileged access management.

  • Solutions

    Use Cases

    • Cloud Security
    • Compliance
    • Cyber Insurance
    • Digital Transformation
    • Endpoint Security
    • Operational Technology
    • Ransomware
    • Service Desk Efficiency
    • Zero Trust

    Industry Applications

    • Financial Services
    • Government Agencies
    • Healthcare
    • Law Enforcement
    • Manufacturing
    • Schools & Universities

    Solutions

    The BeyondTrust Privileged Access Management portfolio is an integrated solution that provides visibility and control over all privileged accounts and users.

  • Resources

    Learn

    • Blog
    • Customer Stories
    • Competitor Comparisons
    • Datasheets
    • Demos
    • Glossary
    • Podcast
    • Whitepapers

    Attend

    • Events
    • Go Beyond
    • Training
    • Webinars

    Support

    • Changelog
    • Professional Services
    • Technical Documentation

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

  • Company
    • About
    • Leadership
    • Core Values
    • Partners
    • Careers
  • Watch Demo
  • Contact Sales

Using Unified Endpoint Management (UEM) & Endpoint Security to lay the Groundwork for Digital Transformation

December 4, 2020

  • Blog
  • Archive

Come winter, COVID lockdowns, or digital transformations, business must still manage and secure their multitude and varied assortment of enterprise devices. In my recent webcast: Pathways to Unified Endpoint Management (UEM), I suggest a strategy for choosing from a menu of controls to best meet the requirements.


NIST Cybersecurity Framework 5.1

BYOD and WFH Security Challenges

Let’s start by perusing some common challenges in the current IT environment that are driving most companies’ requirements, and probably should influence yours:

  • Most users, or at least most information workers, are working from home (WFH)
  • The endpoint environment contains Windows, Macs, iOS, and Android devices, at the very least. Security planners may also be required to look for synergies between client device, server workloads, and other endpoint management or security solutions
  • The number of users working in the bring your own device (BYOD) is increasing
  • Many users’ WFH environments have security deficiencies, such as all-in-the-family device sharing, password sharing, insecure WIFI connections, and more
  • Displaced and disconnected from secure corporate networks, users are forced to learn new tools and technologies
  • The IT service desk becomes over-burdened in trying to support so many devices and scenarios
  • Due to the increase in BYOD and other endpoint support challenges, more PC users are over-provisioned with local admin privileges

Unified Endpoint Management and Security Requirements

To solve the security challenges discussed above, businesses need tools that meet the following requirements:

  • Facilitate a low-friction, least privilege user experience
  • Offer or integrate with digital workspace tools via Virtual Desktop Interface (VDI) images and provisioning required applications
  • Manage mobile devices through native IOS and Android controls, and provide modern PC management via the latest Windows, Mac, and Chrome OS APIs
  • Collect or aggregate events and report analytics from users, apps, and devices
  • Simplify compliance and audit reporting
  • Control costs
  • Integrate with endpoint protection platform (EPP), endpoint detection and response (EDR), and other security tools to better facilitate incident response, backup, and recovery

Endpoint and Network Security Interdependencies

Network security tools such as Extended Detection and Response (XDR) can help security teams plug visibility gaps by reporting suspicious or anomalous behavior on guest devices or BYOD devices, which lack agents for directly monitoring the endpoint.

Network security solutions can also team up with identity management systems and provide zero trust authentication to protect against any compromise of the endpoints. Zero trust authentication should be risk-based and continuous. For that purpose, network and identity-based security systems need to obtain device context, or health assessments, from endpoint security systems.

As shown in the figure above mapping the NIST Cybersecurity Framework (CSF) model to endpoint security, we have defensive opportunities in all 5 of NIST’s control categories. In practice, however, businesses tend to emphasize (i.e., spend money on) one category over others. Often, that category is “Detect.” But a detective emphasis for endpoint security risks ultimately becomes too reactive. It may be too late to stop a breach.

The Preventative Versus Detective Tradeoff

Organizations under security pressure must control the threats and risks to endpoints. If they lack effective preventative controls, they will need to invest more into tools to detect, respond, and recover from cyberattacks. Because they experience many more incidents and alerts without effective preventative controls, they will also need more staff to operate tools like EDR systems. And they’ll probably need a larger security operations center (SOC).

Removing Admin Rights

In their Guide To Endpoint Privilege Management, BeyondTrust points out that the majority of Windows vulnerabilities could be rendered harmless by removing local admin privileges for users. However, absent enterprise-grade endpoint privilege management software, trying to accomplish this may imperil productivity, especially in the WFH environment. What if a user of company-provided device needs to install a printer, reset the time, or save a file on a USB stick for business reasons?

Anecdotal experience suggests that about 1/3 of the organizations we run into have successfully removed local admin rights from company-provided devices, another 1/3 would like to, but haven’t been able to complete the process, and the final 1/3 won’t or can’t remove the privileges.

Fortunately, endpoint privilege management software makes it easier than you might think to remove blanket PC admin privileges, while still providing a way to temporarily and selectively enable the user to perform individual admin tasks, like changing the time, when needed.

Foundational Security for Digital Transformation, BYOD, & WFH

At the end of the day, endpoint security teams must scope out their use cases and define specific requirements. In your strategy planning:

  • Consider a UEM solution that is strong on managing both PCs and mobile devices, so as to get a good breadth of coverage
  • Make the case for Preventative Controls from endpoint privilege management solutions, like least privilege administration and application control wherever possible. This approach has the rare quality of combining risk and cost-reduction
  • Deploy EDR or managed detection and response (MDR) solutions as required to deal with any threats that cannot be proactively prevented
  • Cover remaining endpoint security visibility gaps through network security solutions, and be aware of the interdependencies between network security, endpoint security, and identity management in zero trust, as well as secure access, and secure edge (SASE) architectures.

For a deeper dive on this topic, check out my on-demand webinar: Pathways to Unified Endpoint Management (UEM).

Photograph of Dan Blum

Dan Blum, Cybersecurity Strategist and Author

Dan Blum is an internationally recognized strategist in cybersecurity and risk management. He was a Golden Quill Award winning VP and Distinguished Analyst at Gartner, Inc., has served as the security leader for several startups and consulting companies, and has advised 100s of large corporations, universities and government organizations. He consults with clients on identity management, PAM, risk management, and other topics. He's made his new book Rational Cybersecurity for Business: The Security Leaders' Guide to Business Alignment freely available for Open Access via Apress, or on Amazon.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Whitepapers

Microsoft Vulnerabilities Report 2022

Whitepapers

Cybersecurity Insurance Checklist

Whitepapers

Privileged Access Management: PAM Checklist

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support
  • Cloud Privilege Broker

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Podcast
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press
BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2022 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.