CrowdStrike Falcon vs. VMware Carbon Black App Control

It helps to detect and prevent malwares automatically which saves the response time to act. The machine learning and AI feature which helps to detect unusual behavioural based malwares which use defence evasion techniques. The fusion workflow feature which helps to automate the detection and blocking of less important files such as PUP/Adwares so the focus can be on real threats. The host logs are easy to filter and use which helps to do quick incident response

Incentivized

Cb Protect is best suited somewhere where you want to maximize the lockdown of workstations. So moving past no local admin rights to blocking specific applications and peripherals. The idea would be to have a list of applications you want to run, and then anything else is not able to be used. As stated prior, if you have a very fluid environment where you are having all sorts of new applications installed frequently (I feel for you!!) this is still do-able, but it misses the general idea. I think especially in environments that are more sensitive to new applications, like banks, healthcare systems etc, this is a good fit. The ability to look at application levels, drift, unapproved software etc is very useful.

Incentivized

• Updates are seamless and rarely fail compared to past products
• The tool leverages the largest Cybersecurity threat database in the world
• The response to a potential threat or inquiry by the managed services team is lightning fast
• Extremely thorough responses from the managed services team on potential threats
• Onboarding quick and painless

Incentivized

• Controls file writes, executions of the scripts
• Defends from process injections, memory protection
• Visibility and lock down posibilities

Incentivized

• The Dashboard can become overwhelming at times, too much information to absorb
• Computers that may have made it out into the field without the endpoint sensor are very difficult to find
• As with all systems that rely on machine learning false positives occurr

Incentivized

• Perhaps more specific training.

Incentivized

so far no major breaches occurred in the organizations that we deployed CrowdStrike at. so for me that is the biggest win

I think it is a complete and very trustful XDR platform, with very few False Positives. It is very well supported by highly skilled professionals on all levels: from pre-sales engineers, Customer Account Managers and support engineers.

Incentivized

Support is generally pretty fast and gets right to the issue. We haven't had to use them much, fortunately, but the issues and questions we've had are usually answered quickly. The customer success manager/account manager you're assigned will also follow up with you on a regular cadence to ensure you're getting the most out of the subscription. There's not a whole lot of room to improve, other than the general confusion about what is/what is not covered in custom packages you're subscribed to. The initial purchase took much longer because of a package name changes and realignments of different modules into those packages.

Incentivized

CrowdStrike Falcon Endpoint certainly comes in with a slight price premium compared to other offerings, but when you're talking about your last line of defense against malware it's well worth it. From a feature perspective, many players offer similar feature sets but what sets CrowdStrike apart is the ease of implementation. The management is simplistic in nature for the items we managed on our own (we were using Falcon Complete which is a managed solution).

Incentivized

The big difference between Protect and Barkly/AMP is how exactly it goes about what it's doing. Protect is application whitelisting and program reputation. So the way it's protecting you is using a proprietary reputation service, and hash values to identify applications, and then hitting a list of whitelisted programs to decide if you are able to run that or not, based on the policy you are in. There is a LOT of value in that. We actually are working on transitioning to Cisco Advanced Malware Protection (AMP). The main reason is cost (about the same cost as Cb Protect, but with (most of) the featureset of all 3 Carbon Black products for less than 1/3 of the total spend. AMP works differently, looking at a reputation service powered by Cisco's Talos cloud. You don't really have application whitelisting, but that also reduces how many "requests" you get for applications. So I'll have to find a different way to do whitelisting and USB blocking and the like, but I'm getting more visibility across my network and also built in antivirus (TETRA engine - ClamAV with some work). Barkly is an add that we are looking to put in as it looks at behavior of programs. So specifically it watches for privilege elevation and the like. Thus far all the big name problem children (WannaCry, other ransomware problems) have been caught natively in Barkly day 0.

Incentivized

• Centralized resource management means we need less tools to do the same job.
• EDR data is massive and has to be factored into the overall cost of the product. You are exponentially punished for more devices.
• CS has allowed larger coverage over devices and has discovered massive pockets of no protections.

Incentivized

• App Control can ensure Continuous Compliance.
• Solution can reduce expenses on different security software.
• Nowadays Zero Trust approach is very important for any organization and Application control is one of the main parts of it.

Incentivized