EPP and EDR capabilities with new platform enhancements

BlackBerry helps to proactively reduce risk from cyber security threats with a Unified Endpoint Security (UES) layer that can work with BlackBerry UEM to deliver zero trust security.

The lightweight, single-agent deployment is managed from a central management console, allowing organisations to easily deploy both EPP capabilities with CylancePROTECT and EDR capabilities with CylanceOPTICS, maximising the results of their security investment.

“The addition of custom role-based access controls to BlackBerry’s endpoint protection offering reduces risk by granularly defining and enforcing administrative permissions based on roles within an organisation,” said Michael Suby, Research Vice President, Security and Trust Products at IDC. “Security teams will appreciate the ability to limit each user to only the features needed to perform their business functions.”

CylanceOPTICS extends the threat prevention delivered with CylancePROTECT by using AI to identify and prevent widespread security incidents. BlackBerry customers now benefit from increased search parameter flexibility, alignment with the MITRE ATT&CK Framework, and expanded automated response via CAE rules.  

To protect from the fallout of a widespread incident, businesses need the ability and agility to investigate and respond to an attack with speed and certainty. CylanceOPTICS v2.4 introduces several new product enhancements to provide faster incident response:

• Improved Registry Introspection
• DNS Visibility
• Windows Logon Event Visibility
• RFC1918 Address Space Visibility
• Enhanced WMI introspection via Windows API
• Enhance PowerShell introspection via Windows API

“BlackBerry’s AI-driven threat detection provides comprehensive attack surface protection, even against unknown malware,” said Dominic Grillo, President at Atrion. “With the lightweight single agent we are able to automate detect and respond capabilities, and drive consistent levels of security throughout the organisation.”

Further, BlackBerry will introduce additional enhancements to extend the value of its endpoint protection solution, including:

• Feature and functionality parity of CylanceOPTICS for Windows and Mac with several popular Linux operating system versions including RHEL, Ubuntu, CentOS and SUSE.
• Partial Device Lockdown to quickly isolate an infected or potentially infected device to stop command and control (C2) activity, exfiltration of data, or lateral movement of malware. The lockdown feature gives administrators time to investigate the device or physically remove the device from the network while maintaining connectivity to business-critical systems and processes.
• Remote Response, which streamlines system information and actions from within the Cylance Console by providing an interface for users to intuitively and interactively execute scripts and run 'traditional' or 'native' commands. Users can quickly triage a system and see the results of those commands in near real time in the Cylance Console without ever needing to navigate away to view returned data.

“BlackBerry simplifies endpoint security management with a lightweight machine learning model and improved user interface," said Hector Lorenzana, Director of Security Engineering at Trace3. “Trace3 is excited about the upcoming Linux for CylanceOPTICS agent, which will extend prevention-based EDR capabilities across customer data centres and critical business systems."

“Prevention-first security can significantly reduce the number of alerts generated by the security stack, decreasing the burden and frustration associated with perpetual alert investigations that lead nowhere,” said Thomas Pace, Vice President, Global Enterprise Solutions at BlackBerry Cylance.

“With CylancePROTECT preventing malware, malicious scripts, rogue applications and fileless attacks from harming the business, CylanceOPTICS provides the AI-powered EDR capabilities required to keep data and businesses secure.”