Endpoint security vs network security: Why one is not enough

Endpoint security vs network security; are you an IT person who is confused about this commonly heard security jargon or at the least a cyber security enthusiast who is interested in knowing the difference between the two? Then, this article is for you, yes, I’m going to break it down for you today. Endpoint security and network security, are the two pillars of cybersecurity, one responsible for securing your endpoints and the other for securing your network.

Cyberattacks are a major concern for all organizations, private as well as government ones. As more and more companies are shifting towards work from home culture or using personal devices for work, the need for proper cybersecurity systems is at an all-time high.

In the earlier days of the IT field, cyberattacks were mainly focused on networks. Unauthorized access to corporate networks was the main objective of attackers. This made companies take a strict approach towards corporate network security.

As technological advancements took place, network security became an integral part of all IT companies. Cyber-attackers had to find a new way to get their hands on corporate data.

Endpoints or end-user devices like mobile phones, laptops, PCs, and tablets that had access to corporate networks became the next target. More and more cyberattacks have started targeting endpoints. This made companies rethink their cybersecurity strategies.

What is network security?

Network security is a part of cybersecurity that is mainly concerned with the access and control of data in corporate networks. Whether it is data in rest, motion, or use, network security takes care of it.

Since more and more companies are switching to a remote work system and allowing personal devices to be used for work, the need for securing corporate access via public networks is increasing. Unless proper network security is ensured, it’s easy for attackers to breach corporate data.

Some common network security technologies

1. Network access control (NAC)

Network access control does exactly what the name implies, that is, control the access to a corporate network based on company specified policies. Using NAC, organizations can monitor all devices that try to access the company network.

NAC is critical for organizations that allow remote working and BYOD. Hackers, data thieves, and other cybercriminals can snoop their way into networks if it is not guarded properly.

NAC can be used to provide conditional access to the organizational network. This means that employees can access organizational network only if their device meets certain standards set by the company.

NAC is mainly of two types:

1. Pre-admission: Entry to the network is limited to authorized devices and users. Here the device requesting access to a corporate network is assessed based on a predefined set of rules. If the device passes the assessment, then the connection is allowed.
2. Post-admission: Users are required to re-authorize when they try to access different sections of the network. Here the assessment of the device happens right after the connection is allowed. This is important because devices can alter their security stature after the connection is made.

By limiting network access, NAC can ensure that no unauthorized personnel can get their hands on corporate data in the network.

2. Firewall

A firewall acts as a barrier between internal and external networks. A firewall keeps track of all network traffic in and out of a private network. Not only does it monitor, but it also restricts traffic based on a set of parameters set by the organization.

A firewall acts as a filter that blocks all suspicious traffic and allows only approved traffic to enter the system. A network firewall can have multiple firewalls between external and internal networks.

Firewalls use either a pre-set list of rules or a dynamic set of rules to filter traffic. The filter may consist of the following parameters:

1. Source: Point where a connection is attempted from.
2. Destination: Point to which the attempted connection desires to go.
3. Content: The matter or content that the attempted connection is trying to send or receive.
4. Protocols: Protocols used in the connection. Examples include HTTPS and DNS.

3. VPN

VPN or Virtual Private Network ensures that the connection between a device and a network is encrypted. By encrypting this connection, we can ensure that the data transferred is safe and secure.

VPN is a good way to prevent unauthorized personnel from eavesdropping on your internet traffic. VPN is a must-have if you are working remotely. Apart from encrypting your connection to networks, VPN also masks your IP address so that you remain anonymous on the internet.

4. Intrusion prevention system (IPS)

An intrusion prevention system or IPS is a type of network security system that constantly monitors a network to find and prevent potential threats. If your IPS system finds a possible malicious entity in your network, then it reports the event to the IT admin and takes preventive measures.

Some of the actions IPS can take if it detects a threat are:

1. Terminate the session and block the IP or user from accessing any resources in the network.
2. Make changes to the firewall in such a way that such an attack won’t happen in the future.
3. Delete and replace all exploited content if any.

There are multiple approaches to IPS and the mainstream ones are based on threat signature, anomalous behavior, and custom network security policies.

5. Sandboxing

Sandboxing in general is referred to the act of isolating an app, software, a browser, or even a piece of code within a device like a PC or a mobile phone. By running programs/apps/software in an isolated area, we can ensure whatever happens during its execution does not affect the rest of the device.

Most companies use browser sandboxing so that even if a cyberattack takes place it is confined only to the sandbox.

Sandboxing can make sure that even in the event of a cyberattack, all endpoints and the data stored in them are isolated from the threat and secured.

6. Zero trust security

As the name suggests, a zero-trust security system requires all individuals and devices, both inside and outside the network, to authorize their user accounts each time they access the company network.

It is important for IT admins to know more about the device as well as the user they manage before trusting the same. It is also possible for attacks to happen through apps and websites. So, details like device information and user credentials should be verified.

Moreover, once authenticated, access to the corporate network must be limited to just the authorized apps and services, while keeping the rest of the infrastructure hidden to the user or device.

7. Wi-Fi security

Wi-Fi security is very important because it prevents unauthorized users from accessing a wireless connection. Hackers can attack Wi-Fi devices like routers to get access to a wireless connection. Once in the connection, they can access all the data that is transferred through that connection.

WPA vs WPA2 – Are you adopting the right wireless (WiFi) security?

IT admins should set minimum Wi-Fi security levels on endpoints so that devices under their control will not connect to networks that fail to meet these security standards.

There are mainly four types of Wi-Fi security protocols available:

1. Wired Equivalent Protocol (WEP): Developed in the late 1900s, WEP was built to provide wireless connections with a level of security that a wired connection would have. As advancements came in the security sector, WEP was found to be outdated and was ditched by the Wi-Fi alliance in 2004.
2. Wi-Fi Protected Access (WPA): WPA was introduced as a replacement for WEP and it made use of a dynamic 128-bit key for authentication. This feature of using a dynamic key was called Temporary Key Integrity Protocol or TKIP.
3. Wi-Fi Protected Access 2 (WPA2): WPA2 was like an improvement of WPA technology. Here TKIP was replaced by a more advanced system called Counter Mode Cipher Block Chaining Message Authentication Code Protocol.
   WPA2 also used other advanced technologies like Advanced Encryption System or AES. All these newer technologies did a better job at encrypting the data transferred through the network.
4. Wi-Fi Protected Access 3 (WPA3): WPA3 is also an upgrade on the WPA technology. WPA3 has a separate security structure for personal and enterprise connections. Advanced security protocols like 256- bit Galois Counter Mode Protocol (GCMP) or 384-bit Hashed Message Authentication Code (HMAC) are used.

What is endpoint security?

Endpoint security is also a part of cybersecurity but it is not the same as network security. Endpoint security is mainly focused on protecting end-user devices or endpoints like mobiles, tablets, PCs, laptops, and even IoT devices from malicious threats.

Threats that get past network security systems ultimately find their way into endpoints. Recently threats with endpoints as targets have also started to gain popularity. So, it must be a priority for organizations to secure endpoints.

Endpoints are the access points to a corporate network and once these devices are compromised, all data in it is exposed. Compromised endpoints can act as a back door entry into corporate networks.

Some common endpoint security technologies

1. Endpoint Detection and Response or EDR

Endpoint Detection and Response or EDR is an endpoint security system that constantly monitors and gathers information from endpoints. It then automatically analyses and responds to threats based on pre-set rules.

All the above-mentioned processes happen in real-time, so, if a threat is found in an endpoint it is identified and dealt with very quickly.

2. Browser security

Browser security can be seen as a set of actions taken to secure web browsers used on endpoint rather than security technology. Browser security can be ensured using techniques like blacklisting and whitelisting of websites, keeping your browser updated, using private and secure browsers, and so on.

Featured resource

Hexnode Kiosk Browser

Understand the full capabilities of Hexnode’s Kiosk browser for your organization and implement cutting-edge web browsing features with top-notch security.

Download datasheet

3. Antivirus

Antivirus has been in the endpoint security scenario for a considerable amount of time. Antivirus itself has seen few changes over the years. There are mainly two types of antiviruses:

Traditional and Next-gen/Next-generation Antivirus.

Traditional Antivirus has been protecting endpoints since the 1980s-90s. This antivirus is usually deployed to find and eliminate known threats like malware, trojans, etc. Traditional antiviruses use a signature-based approach to detect known threats.

When it comes to unknown threats, traditional antiviruses can’t do anything. Another drawback of traditional antivirus is that it can be a bit too harsh on the device performance and cause the device to slow down a bit.

Next-generation or next-gen antivirus (NGAV) can not only provide security against known threats but also against unknown and new types of threats. NGAV does not use a signature-based approach to finding threats.

NGAV constantly analyses your endpoints and can recognize new threats by detecting a deviation in the normal behavior of a device. Unlike traditional antivirus, NGAV provides protection against zero-day exploits.

4. Email security

Email security is very essential both for personal as well as corporate ones. This is because almost every new account or subscription or social media account is created using emails and if your email is hacked the results can be devastating.

When it comes to corporate emails, it might contain sensitive information that could be dangerous if it goes into the wrong hands. Many threats are sent via email as links and downloadables disguised as spyware, malware, etc.

Some security tips that can be done on a personal level are the use of strong passwords, frequently changing passwords, using spam filters, and being careful while opening emails from unknown senders.

Common email security systems used are email encryption, multifactor authentication, use of secure email gateways, and backing up of important files and documents.

5. Encryption

Data encryption is one of the most commonly used security technologies. Data encryption simply means to encode your data into an unreadable form based on an encryption key. By doing so, you can ensure that the data is safe even if it is stolen. The encoded data can be decoded only using the key.

What is device encryption and why do you need it?

Data encryption is mainly of two types:

1. File-based encryption: Only select files in a device/drive are encrypted.
2. Full-disk encryption: The entire disk is encrypted.

There are different types of algorithms used for encrypting data and the level of security for encrypted data depends on the complexity of the algorithm used. AES or Advanced Encryption System is one of the most commonly used algorithms.

6. OS update management

Detecting and exploiting vulnerabilities with operating systems is a very common practice among cyber-attackers. So, operating system providers are always on the lookout for such vulnerabilities so that with the next update the issue can be fixed.

It is important to keep your operating system updated because, with almost every software update, a security patch is also released. Using older OS with security vulnerabilities can act as a point of entry for cyberattacks.

7. Device wipe

Device wipe is the last resort when it comes to endpoint security. If any endpoints in an organization are under a cyber-attack and there is no way of protecting the data in that device, then wiping the device would be the best option.

Device wiping must be considered only if there is no other way to save the data in the device. Keep in mind that once a device is wiped, there is no way to recover the data in it. So, always make sure that your employees back up essential data.

Endpoint security vs network security: Why is it better to use both together

Network security has its advantages. The main positive is that it can ensure a very strict network environment. Traditional network security technologies can do an amazing job at keeping known threats at bay. New generation network security technologies are capable of detecting and preventing even unknown threats.

The main downside of network security is that once a threat gets past it, it can’t do anything to secure endpoints, which obviously will be the next target. Not only this, due to its lack of support for endpoint security, cybercriminals have started targeting endpoints instead of networks.

So, having a very high-end network security system without proper security for endpoints is a very bad idea if your company takes cybersecurity seriously.

Endpoint security is a very underrated security requirement and most companies ignore it. As mentioned earlier, network security on its own can’t protect your corporate data from cyber threats.

Network security when coupled with endpoint security can provide all-around protection for your corporate data. Each of the security systems compliments each other very well and covers the flaws of the other.

Even though endpoint security and network security together can ensure a near-perfect security system, it cannot provide 100% security against cyber threats. As a matter of fact, almost no system can provide 100% security from cyberattacks.

Apart from using all these security features, it is always good to conduct a device inspection from time to time. Inspections and audits are a great way to get an idea of what is going on with devices used in an organization and also find out about any unusual activity that might have slipped past the radar.