Endpoint Resilience Starts With the Hardware

As artificial intelligence reduces the time required to exploit cybersecurity vulnerabilities, organizations need an endpoint security strategy that not only prevents attacks but also enables systems to withstand them and recover quickly.

AI is helping organizations work faster and more efficiently, but attackers are using those same capabilities in techniques such as social engineering, a scenario that is rapidly changing the endpoint security landscape. Years ago, a phishing email may have contained obvious grammatical errors or other clues that something was suspicious. Today, attackers can use AI to create convincing messages free of errors and to produce deepfake messages with realistic voice and video. They also can develop malicious code quickly with AI.

At the same time, the definition of an endpoint has expanded to include not just a laptop sitting on a desk or a server locked away in a data center but also edge devices and cloud workloads (workloads running in the cloud ultimately rely on physical infrastructure somewhere).

In today's environment, an expansive endpoint resilience strategy is more critically important than ever.

IT leaders should think about endpoint protection and endpoint resilience differently.

Endpoint protection is about preventing an attack. Leaders can build a wall around a castle and post guards on top of it, but along with that detection and response, organizations need endpoint protection and other layers of defense to thwart attacks.

What happens when something gets through? The answer lies in endpoint resilience.

How quickly can an organization respond? Can affected systems recover fast? What is the operational impact of the attack? Can systems automatically restore themselves when something goes wrong?

Security teams must ask these questions because they cannot chase every new threat. They can’t possibly prepare for everything that may happen in today's environment of AI-enhanced attacks. Organizations must build security into their environments from the very beginning.

Lenovo’s ThinkShield strategy views endpoint security as layers stretching from the supply chain and physical hardware through the operating system, applications, identity and cloud.

To establish truly effective security, organizations must look below the operating system. The BIOS is firmware that helps initialize and control the hardware before the OS takes over. If an attacker compromises the BIOS or other firmware, organizations will find it very difficult to detect and remediate the threat. 

Organizations need capabilities such as detecting BIOS changes, maintaining known-good firmware states and enabling self-healing. These are important parts of endpoint resilience. IT teams also should ensure they have configured devices correctly and applied security policies consistently across endpoints.

In essence, these resilience measures represent the cybersecurity equivalent of locking the front door without leaving the windows open.

The ThinkShield strategy builds on this layered approach. Lenovo works with partners such as SentinelOne to bring endpoint and security information together to address emerging issues including the use of shadow AI applications. Our work with Absolute Software also helps organizations to fully understand the locations of their endpoints and to maintain visibility of those devices.

Organizations cannot build endpoint resilience through technology alone. Security teams often collect a great deal of endpoint and security telemetry, but that information may be fragmented across multiple tools. In this scenario, they may not need to collect more data but instead must find the most useful data they already possess — the signal in the noise.

Security teams should correlate device information with signals such as application activity, security events and user identity so that teams can turn existing data into meaningful insight.

And organizations must establish clear lines of responsibility. Teams should know who owns an issue and how to escalate it. A tabletop exercise can help organizations test these lines of responsibility. If an incident occurs at 2 a.m. on a Saturday, does the person on call know exactly whom to contact and who has responsibility for making decisions? If the answer is no, that is an important resilience gap.

Organizations must evaluate their endpoint security strategies, and they should measure more than how effectively they prevent attacks. They should examine if teams can make decisions quickly, if systems can withstand and recover from an attack — and how long recovery may take.

That is what endpoint resilience is all about: preparing an organization not only to defend itself but also to continue operating when something inevitably goes wrong.