Why Endpoint Security Agents Alone Fall Short in Cloud Environments
Summary
The article outlines coverage gaps, deployment burdens, vulnerabilities, supply-chain risks and attacker evasion associated with endpoint agents, and argues that agentless tools can complement them in cloud environments.
Key points
- Wiz reports that only 20% of the virtual machines it covered had an endpoint protection agent, leaving potential visibility and patch-management gaps.
- The article says 54% of agents in cloud environments were not on the latest version, and cites vulnerabilities in endpoint products as risks heightened by their privileges.
- It describes supply-chain compromises as a risk because agents run broadly across valuable systems and may receive privileged access.
- Attackers may identify or bypass endpoint agents; Wiz reports that 27% of the malware-infected VMs it detected had security agents deployed.
- The article argues that deploying and maintaining agents across varied cloud workloads takes time and may encounter compatibility issues.
- It presents agentless scanning as a complement to endpoint agents, while acknowledging that agents still have a role in organizational security.
Article Details
- Topic
- Limitations of endpoint security agents in cloud environments and the role of agentless security
CVE
CVE-2021-1647Microsoft · Microsoft Security Essentials; Microsoft · Microsoft System Center 2012 Endpoint Protection; +3 moreAnother example for this is CVE-2021-1647, a CVSS 7.8 remote code execution (RCE) vulnerability published in January 2021 within the popular Microsoft Defender Anti-Malware Engine, allowing attackers to execute code onCVE-2022-0015Palo Alto Networks · Cortex XDR Agentand vulnerable. Just recently, Palo Alto Networks published that Cortex XDR agents are vulnerable to CVE-2022-0015, a privilege escalation vulnerability that enables authenticated local users to execute programs with
Malware
Vendors
Kaseyathat affected thousands of networks all over the world. Another example is the ransomware attack on Kaseya, an IT management software company: a zero-day vulnerability in their management servers allowedMcAfeeCVE-2021-31843 7.8 McAfee Endpoint Security for Windows Improper Privileges ManagementMicrosofta CVSS 7.8 remote code execution (RCE) vulnerability published in January 2021 within the popular Microsoft Defender Anti-Malware Engine, allowing attackers to execute code on target systems. This vulnerabilityPalo Alto Networkswith the latest available version, leaving unpatched agents exposed and vulnerable. Just recently, Palo Alto Networks published that Cortex XDR agents are vulnerable to CVE-2022-0015, a privilege escalationSolarWindsinstalled – the customer environment is infected. This, for example, is what happened in the notorious SolarWinds attack that affected thousands of networks all over the world. Another example is the ransomware attackSymantecCVE-2020-5837 7.7 Symantec Endpoint Protection Privilege Escalation
Products
Cortex XDRleaving unpatched agents exposed and vulnerable. Just recently, Palo Alto Networks published that Cortex XDR agents are vulnerable to CVE-2022-0015, a privilege escalation vulnerability that enables authenticatedF5 BIG-IP Advanced Firewall Managerour research found that one of every seven companies covered by Wiz that have a VM running F5 BIG-IP Advanced Firewall Manager has at least one publicly exposed instance with exploitable vulnerabilities. These VMs areMcAfee Endpoint SecurityCVE-2021-31843 7.8 McAfee Endpoint Security for Windows Improper Privileges ManagementMicrosoft Defender Antimalware Platforma CVSS 7.8 remote code execution (RCE) vulnerability published in January 2021 within the popular Microsoft Defender Anti-Malware Engine, allowing attackers to execute code on target systems. This vulnerability isSymantec Endpoint ProtectionCVE-2020-5837 7.7 Symantec Endpoint Protection Privilege Escalation