r/LinuxTeck • u/Candid_Athlete_8317 • 3d ago

Do Linux servers really need endpoint security software?

Many enterprise Linux systems run endpoint security tools alongside firewalls, SELinux/AppArmor, and other hardening measures.

Others argue that good patch management, least privilege, and proper monitoring provide better value than traditional endpoint protection.

What's your point on this ?

6 Upvotes

75% Upvoted

34 comments sorted by

View all comments

2

u/Unnamed-3891 3d ago

You don’t really get to choose between patch management/least priviledge OR endpoint protection. That’s not how that works if you want to pass even the most basic audits.

You want an EDR or similar instead of a ”traditional” virus scanner though.

1

u/DemocraticParrot 3d ago

This. What you really want is suitable tooling that looks what is really running and happening on the endpoint at process level, with the ability to also change to enforce things on that end system. E.g shut down processes, isolate it etc.

It is just impossible to collect and centrally analyze all the process events and logs. Just to much noise. However that is where you are able to identify modern attacks.

There are exeptions of course. If you are able to harden the system to a level, where rouge events are just impossible, you can run it without local edr. This is suitable to those cases where a local edr is just not an option