Cyberstudy
PDF p.262 In progress

Endpoint Configuration

Open PDF at p.262 23 flashcards

Summary

PDF p.262

Endpoint configuration involves securing devices by managing access controls, applying the principle of least privilege, using access control lists (ACLs), setting file system permissions, implementing application allow/block lists, monitoring, and enforcing configurations.

In plain words

Supplementary — not from your PDF

Match the fix to the cause: training for social engineering, patching or isolation for vulnerabilities, adding controls where they're missing, and reapplying baselines for configuration drift. Apply least privilege everywhere (users, apps, OS) using RBAC and temporary privileges. Use ACLs and file permissions (on Linux, r/w/x for user, group and others, changed with chmod). Application allow lists (deny unless approved) are stronger than block lists (allow unless listed). Enforce and monitor configurations with Group Policy, SELinux and automated tools.

Detailed explanation

PDF p.262
  • Mitigation Vectors
    • Social Engineering: Use security education and awareness; review permissions.
    • Vulnerabilities: Install patches or isolate systems.
    • Lack of Security Controls: Deploy endpoint protection, firewalls, content filtering, DLP, or MDM.
    • Configuration Drift: Reapply baseline configurations; improve configuration management.
    • Weak Configuration: Review and improve security settings.

Access Control

  • Principle of Least Privilege (PoLP)
    • Implementation: Audit user roles and privileges; use role-based access control (RBAC); apply temporary privileges.
    • Application: Applies to users, applications, and operating systems.
  • Access Control Lists (ACLs)
    • Purpose: Enforce access control policies.
    • Usage: Define rules for network traffic and file system access.
    • Management: Requires proper planning, periodic reviews, and best practices.
  • File System Permissions
    • ACLs: List accounts and permissions for file system objects.
    • Linux Permissions: Read (r), Write (w), Execute (x) for user (u), group (g), others (o).
    • Commands: chmod for modifying permissions.

Application Allow Lists and Block Lists

  • Allow List: Denies execution unless explicitly authorized.
  • Block List: Allows execution but explicitly prohibits listed processes.
  • Updates: Regularly updated based on incidents and threat hunting.

Monitoring

  • Purpose: Detect changes that weaken security configurations.
  • Compliance: Provides data for compliance and auditing.

Configuration Enforcement

  • Methods
    • Standardized Baselines: Defined by organizations like NIST, CIS.
    • Automated Tools: Apply and maintain configurations.
    • Continuous Monitoring: Detect deviations.
    • Change Management: Review, test, and approve changes.
  • Example: Managing firewall rules with automated tools.

Group Policy

  • Feature: Centralized management in Windows environments.
  • Usage: Enforce security settings across systems.
  • Examples: Password policies, firewall settings, software restrictions.

SELinux

  • Feature: Access control security policies in Linux.
  • Purpose: Granular permission control over processes and system objects.
  • Application: Limits resource access to enhance security.

Important terms

taken from the text above
Social Engineering
Use security education and awareness; review permissions.
Lack of Security Controls
Deploy endpoint protection, firewalls, content filtering, DLP, or MDM.
Configuration Drift
Reapply baseline configurations; improve configuration management.
Weak Configuration
Review and improve security settings.
Management
Requires proper planning, periodic reviews, and best practices.
ACLs
List accounts and permissions for file system objects.
Linux Permissions
Read (r), Write (w), Execute (x) for user (u), group (g), others (o).
Commands
chmod for modifying permissions.
Allow List
Denies execution unless explicitly authorized.
Block List
Allows execution but explicitly prohibits listed processes.
Updates
Regularly updated based on incidents and threat hunting.
Standardized Baselines
Defined by organizations like NIST, CIS.
Automated Tools
Apply and maintain configurations.
Continuous Monitoring
Detect deviations.
Change Management
Review, test, and approve changes.
PoLP Principle of Least Privilege ACLs Access Control Lists

Examples & real-world scenarios

Supplementary — not from your PDF
  • chmod 640 to give the owner read/write and the group read only.
  • An allow list so only approved apps run on kiosk PCs.
  • SELinux confining a web server process.

Scenario

Malware keeps appearing on reception PCs despite antivirus. Switching them to an application allow list, where only approved programs can run, stops unknown executables entirely.

Common mistakes

Supplementary — not from your PDF
  • Assuming block lists are as strong as allow lists. New threats aren't on the block list yet.
  • Forgetting that 'others' permissions apply to every other account.

Practical skills

Supplementary — not from your PDF
  • Read and set Linux file permissions.
  • Choose an allow list or block list for a device type.

What I should remember

Key Points PDF p.262
  • Mitigation Vectors: Address social engineering, vulnerabilities, security controls, configuration drift, and weak configurations.
  • Access Control: Implement PoLP, use ACLs, manage file system permissions.
  • Application Lists: Use allow/block lists for execution control.
  • Monitoring: Ensure security configurations remain in place.
  • Configuration Enforcement: Use standardized baselines, automated tools, continuous monitoring, and change management.
  • Group Policy: Centralized management in Windows.
  • SELinux: Granular control in Linux.