Carbon Black

Carbon Black CB Defense

Antivirus (AV) has been accepted as part of any strong cybersecurity regimen since the early days of endpoint computing. But if your organization has taken a set it and forget it’s approach to AV, you could be at much greater risk for malware infection than you know. The industry-leading CB Defense from Carbon Black replaces legacy AV solutions with its next-generation antivirus (NGAV) and endpoint detection and response (EDR) functionalities.

Next-Generation Antivirus (NGAV)

Traditional AV protection relies on unique file signatures, essentially just comparing each executable, attachment and web download to a list of known malware. Attackers have found that they can easily sidestep this type of solution by obfuscating their malicious code or by deploying fileless malware via Windows PowerShell or VBScript embedded in Office documents. These approaches either result in a new signature that the antivirus protection does not recognize as malicious or avoid antivirus scanning entirely by hiding in the endpoint runtime memory, or RAM.

CB Defense scans not only the files and executables on an endpoint, but also monitors for suspicious activity such as commands and scripts commonly used to launch an attack. By leveraging the CB Predictive Security Cloud, CB Defense can detect not only the same known attacks as traditional AV, but also unknown attacks that bypass signature-based filters.

Endpoint Detection and Response (EDR)

Visibility into the events occurring on endpoint devices has historically been achieved via a combination of desktop-based agents and network-level monitoring. This approach can leave unseen gaps in coverage that allow attackers to penetrate an internal network undetected. Further, network-based monitoring tools offer no insight into or control over endpoints residing outside of the organizational network, such as [list common endpoints here]. These vulnerable endpoints are a growing blind spot for companies with a mobile workforce.

CB Defense offers unprecedented insight into activity occurring on endpoint devices. Managed from a single, cloud-based console, CB Defense requires no on-premises infrastructure and gathers event data from endpoints even outside of the traditional local area network (LAN). With the ability to see and respond to suspicious activity wherever it happens, security and IT operations teams can remediate potential security issues more quickly than ever before.

Schneider Downs can help with your implementation of Carbon Black CB Defense.