In the fast-changing world of cybersecurity, how we deploy EDR/NDR solutions is just as important as the protection they provide. A recent problem with CrowdStrike, a top cybersecurity company, showed this clearly. Their security software update accidentally made Windows computers stop working, highlighting the risk of system disruptions with agent-based deployments.

CrowdStrike Windows Outage

The faulty update from CrowdStrike caused a Blue Screen of Death (BSOD) loop on Windows computers, making them unusable. The problem got worse because the update was automatically sent to many machines overnight. Fixing this issue required technicians to manually repair each affected computer.

An Alternative Approach to Prevent System Disruptions

There is an alternative approach to prevent system disruptions: non-intrusive, container-based deployments for Linux. This method reduces the risk of disrupting the host system, offering many strategic benefits. Unlike traditional agent-based methods, this approach focuses on autonomous operation with minimal cloud dependencies, preventing issues like those experienced with CrowdStrike's update.

Why Linux?

Linux-based platforms are often regarded as more stable and secure compared to Windows, particularly in server environments and among IT professionals. This perception is grounded in several core aspects of Linux architecture and community practices.

Core Reasons for Linux's Stability and Security

• Open Source Nature: Linux's open-source code allows a large community to inspect, modify, and enhance it, identifying and fixing security vulnerabilities rapidly.

• User Privilege Model: Linux provides a robust user privilege model, minimizing the risk of malware gaining system-wide access unless explicitly authorized by the administrator.

• Lesser Target for Malware: While Linux's smaller desktop market share makes it less attractive to malware developers, its dominance in server markets means vigilance remains critical.

• Package Management and Distribution: Centralized repositories reduce the risk of installing malicious software compared to downloading executables from the internet, as is common with Windows.

Examples Illustrating Linux's Stability and Security

• WannaCry Ransomware: In May 2017, the WannaCry ransomware attack affected over 200,000 computers across 150 countries running unpatched Windows software. Linux systems were inherently immune to this attack.
  
• NotPetya Attack: NotPetya, which emerged in 2017, exploited vulnerabilities in Windows systems, causing billions in damages. Linux systems were not affected, highlighting the frequent impact of cybersecurity incidents on Windows environments.
  
• System Stability: Linux servers are renowned for their uptime and stability. Many of the world's top supercomputers run on Linux due to its robustness and efficiency. Windows systems, in contrast, generally require more frequent maintenance, introducing periods of vulnerability and instability.

AI EdgeLabs: The Future of Non-Intrusive Cybersecurity

AI EdgeLabs is a cutting-edge Linux-based cybersecurity product designed to offer robust protection while ensuring minimal interference with the host system's operations. Unlike traditional security solutions that rely on deeply integrated, often intrusive agents, AI EdgeLabs utilizes a container-based, agent-like approach. This method harnesses the isolation and flexibility of containers, allowing the security functionalities to operate independently of the host's system services.

Key Features of AI EdgeLabs:

1. Container-Based Deployment: AI EdgeLabs deploys its security agents within containers, isolating security processes from the host's operating system. This prevents conflicts and ensures that updates to the security agents don't impact system stability.
   
2. Client-Managed Update Process: Unlike systems that push automatic updates, clients control updates via a dedicated portal, allowing them to schedule updates during off-peak hours or after thorough testing, avoiding unexpected disruptions.
   
3. No Bootloader or System Service Modifications: AI EdgeLabs maintains system integrity and reliability by not modifying bootloaders or core system services, which is crucial for environments where uptime and stability are paramount.
   
4. Compatibility with Distributed Environments: Designed to integrate with modern environments like Kubernetes and OpenShift, AI EdgeLabs scales with infrastructure, applying consistent security policies across multiple nodes and clusters.
   
5. Portal for Centralized Control: AI EdgeLabs centralized portal provides comprehensive visibility into security status, allowing administrators to monitor threats, adjust policies, and deploy agents across environments.

Benefits of AI EdgeLabs:

• Reduced Risk of System Disruptions: By avoiding modifications to critical system components and using containers, AI EdgeLabs minimizes the risk of system instability or failures during updates.

• Enhanced Flexibility and Control: The client-managed update approach empowers organizations to handle their cybersecurity measures on their terms, aligning their cybersecurity measures with operational requirements.

• Scalability and Ease of Deployment: Container technology simplifies the deployment, scaling, and management of security agents across various environments.

• Isolation and Security: Containers provide inherent isolation, helping contain security breaches and preventing them from affecting the host system.

AI EdgeLabs and Prevention Techniques

Prevention often involves intrusive activities that block processes considered harmful. AI EdgeLabs employs various prevention techniques, including:

• IPS (Intrusion Prevention System): Network blocking based on resource scope, severity levels, and algorithms deployed on the Edge.
  
• Quarantining: Automated response scenarios for potentially malicious files by blocking and putting them into quarantine for further investigation.
  
• EDR Blocking and Playbooks: Automated prevention events based on predefined playbooks from AI EdgeLabs, providing low-latency responses to potentially dangerous activities.
  
• AI-Generated Playbooks: Contextual playbooks generated based on current situations, speeding up remediation and helping analysts interpret incidents and apply effective prevention measures.
  

It's crucial for resource-critical applications to have an approval flow for remediation and prevention actions, typically controlled by clients based on resource severity with the help of AI-based algorithms to reduce noise and lower required skills for incident research.

Conclusion

AI EdgeLabs represents a paradigm shift in how cybersecurity solutions are deployed and managed. With robust security, operational flexibility, and system compatibility tailored for modern IT infrastructures, AI EdgeLabs offers a blend of innovative, non-intrusive protection. Emphasizing the stability and security of Linux, AI EdgeLabs provides a forward-thinking solution to prevent system disruptions and ensure reliable cybersecurity defenses.

Oleg Mygryn, CTO, AI EdgeLabs