What is NGAV?

In this 101, we’re going to cover:

• What is NGAV?
• How Does NGAV Work?
• What is the Difference Between NGAV and EDR?
• Benefits of NGAV
• How to Choose the Right NGAV Solution for Your Organization
• How is Cybereason NGAV Different?

In the 90s, most considered antivirus software the cornerstone of IT security. That same term today doesn't carry nearly the weight it used to. When it comes to endpoint security, antivirus software is probably still the most prolific and ubiquitous solution around. But is it sufficient? 

Attacks grow in sophistication, and traditional heuristic and signature-based detection methods struggle to keep pace. Traditional antivirus was never particularly good at dealing with zero-day vulnerabilities, even in the best of times. That's because these tools primarily rely on known, pre-identified attack signatures to identify and contain malware. 

Businesses can't afford to leave open such a gaping hole in their defenses to secure user devices and endpoints. For these reasons, Next-Generation Antivirus (NGAV) is starting to make some noise in the security world. 

WHAT IS NGAV?

NGAV represents the first natural evolutionary step forward for antivirus protection in decades and aims to deliver endpoint protection against today's most sophisticated attacks. What sets it apart from traditional antivirus is a technical approach that approaches the problem with a more holistic, system-oriented view using intelligent algorithms to identify, isolate and block the tools and methods attackers rely on to compromise modern systems. 

Meaning, instead of focusing on detecting malware based on file characteristics and behaviors like traditional AV, NGAV observes all processes in a system. That includes network activity, interfaces, configurations, and access patterns. In doing so, NGAV systems establish a baseline of the expected system and user behavior, which helps it identify anomalies that may signify attacks over the long term. 

HOW DOES NGAV WORK?

Cyberattackers design their attacks around the predictable behavior of traditional antivirus software. Contemporary, high-quality malware is complicated to thwart on day-zero. NGAV bypasses this problem by continuously observing all system files, processes, applications, interfaces, and network activity. It uses AI and machine learning-based analytics to establish a baseline of expected behavior and detect malicious activity. While traditional antivirus approaches tend to become more vulnerable as attackers learn to work around them, NGAV protected systems naturally become more secure over time, as the AI and machine learning algorithms learn more about user and system behavior. 

WHAT IS THE DIFFERENCE BETWEEN NGAV AND EDR?

NGAV is fast becoming a cornerstone cybersecurity technology, particularly when securing user devices and endpoints. That said, another well-known technology is critical in helping organizations mitigate the risk of cyberattacks. Endpoint Detection and Response (EDR) systems provide cybersecurity operators with visibility into any activities occurring at endpoints in the network. EDR and NGAV systems have a similar purpose but differ in which use cases apply and how they work. 

NGAV aims to prevent cyber threats from entering and infecting the network at its core. NGAV systems can anticipate and avoid both well-known and zero-day attacks over time as the first line of defense. EDR, on the other hand, comes into play if a threat manages to circumvent NGAV. In these cases, the EDR solution would detect the malicious activity and provide operators with the information and capability to contain the threat within the endpoint before infecting other areas of the network. 

BENEFITS OF NGAV

Relative to traditional malware, NGAV provides users and organizations with several critical benefits:

1. NGAV can prevent highly sophisticated attacks that use unknown threat signatures and behaviors. Rather than detecting malware, it can detect attacks based on system behavior resulting in far more reliable prevention.
2. AI and machine learning help NGAV provide the root cause of attacks and give a system-centric view of exploited vulnerabilities.
3. NGAV is complimentary to EDR capabilities and offers far superior protection to traditional AV or EDR alone when combined. 
   
   

HOW TO CHOOSE THE RIGHT NGAV SOLUTION FOR YOUR ORGANIZATION

NGAV software is rising to meet the needs of the modern cybersecurity environment. With several solutions available, organizations must understand how to choose the right product to protect their systems. Here are some key considerations when evaluating NGAV products:

EFFECTIVENESS AGAINST ZERO-DAY THREATS

The best NGAV systems leverage machine learning, data science, and AI to identify attack methodologies even if they have never been in use before. 

AVOID FALSE POSITIVES

False positives are relatively rare in traditional antivirus software since they rely on well-known attack signatures and heuristics to identify threats. Because NGAV systems use predictive models to assess systems, how well they deal with false positives can be a differentiator between products. While some expect false positives, too many can overburden security operators and reduce an organization's security posture. 

EFFECTIVENESS AGAINST FILELESS MALWARE

Fileless malware attacks use scripting languages rather than binaries to perform malicious activities. These attacks can be challenging because IT and security administrators leverage scripting languages in their day-to-day jobs. Some NGAV solutions impose a heavy burden in determining which scripting should be allowed or blocked. 

EFFECTIVENESS AGAINST RANSOMWARE

Ransomware attacks infect systems and immediately encrypt as much data as possible for leverage against the victim. It's critical for an effective NGAV system to prevent these attacks before encrypting vital data. 

HOW IS CYBEREASON NGAV DIFFERENT?

With ransomware attacks on the rise and attacks continually growing more sophisticated, organizations can't afford to focus on malware. Cybereason's NGAV solution stands apart from other solutions because of its best-in-breed attack protection against zero-day file-less attacks. 

It minimizes operator burden compared to competing products and can be deployed at scale in a matter of hours, with minimal impacts or downtime. Guided remediation that leverages automation helps eliminate complex workloads and mitigate threats across all network and user devices. It's no surprise that the Cybereason Defense Platform attained the prestigious AV-Comparatives Busines Security product certification. 

Back to Cybersecurity 101