Cyberstudy
PDF p.257 In progress

Endpoint Hardening

Open PDF at p.257 27 flashcards

Summary

PDF p.257

Endpoint hardening involves securing operating systems and workstations to protect against unauthorized access, data breaches, and malware. This includes applying best practice baselines, managing configurations, and ensuring regular maintenance.

In plain words

Supplementary — not from your PDF

Endpoint hardening shrinks each device's attack surface: disable unused interfaces, services and ports, encrypt storage, and keep a regular patch cycle, while still leaving the device usable. Workstations need extra care because people use them for everything: remove unneeded software, limit admin rights, control USB devices, train users, and segment them. Use separate baselines for clients and servers, and manage Windows registry settings through GPOs.

Detailed explanation

PDF p.257
  • Operating System Security
    • Practices: Access controls, authentication, secure configurations, application security, patch management, endpoint protection, user training, and monitoring.
    • Hardening: Balancing security with functionality and usability.
    • Best Practice Baselines: Guidelines for secure configurations, reducing the attack surface by running only necessary protocols and services.

Key Components

  • Interfaces: Disable unused network interfaces.
  • Services: Disable unused services.
  • Application Service Ports: Disable or block unnecessary ports.
  • Persistent Storage: Use disk encryption for data security.
  • Maintenance Cycle: Regular updates and threat response.

Workstations

  • Unique Concerns: Large attack surface due to varied tasks and applications.
  • Hardening Practices: Remove unnecessary software, limit administrative privileges, manage application installations and updates.
  • User-Focused Security: Regular training on phishing, strong passwords, responsible Internet use, and handling sensitive data.
  • Security Configurations: Automatic updates, screen locks, firewalls, endpoint protection, intrusion detection/prevention, logging, encryption, monitoring.
  • Peripheral Device Security: Secure USB ports with endpoint protection software and device control policies.
  • Segmentation: Restrict communications to limit malware propagation.

Baseline Configuration and Registry Settings

  • Separate Baselines: Different configurations for various system types (e.g., desktop clients, servers).
  • Registry Settings: Managed via group policy objects (GPOs) in Windows.
  • Least Privilege: Limit registry modification rights.
  • Host-Based Intrusion Detection: Alerts on suspicious registry events.
  • Baseline Deviation Reporting: Ensures configurations match baseline templates.
  • Tools: Microsoft Baseline Security Analyzer (MBSA) replaced by Security Compliance Toolkit.

Important terms

taken from the text above
Practices
Access controls, authentication, secure configurations, application security, patch management, endpoint protection, user training, and monitoring.
Hardening
Balancing security with functionality and usability.
Best Practice Baselines
Guidelines for secure configurations, reducing the attack surface by running only necessary protocols and services.
Interfaces
Disable unused network interfaces.
Services
Disable unused services.
Application Service Ports
Disable or block unnecessary ports.
Persistent Storage
Use disk encryption for data security.
Maintenance Cycle
Regular updates and threat response.
Unique Concerns
Large attack surface due to varied tasks and applications.
Hardening Practices
Remove unnecessary software, limit administrative privileges, manage application installations and updates.
User-Focused Security
Regular training on phishing, strong passwords, responsible Internet use, and handling sensitive data.
Security Configurations
Automatic updates, screen locks, firewalls, endpoint protection, intrusion detection/prevention, logging, encryption, monitoring.
Peripheral Device Security
Secure USB ports with endpoint protection software and device control policies.
Segmentation
Restrict communications to limit malware propagation.
Separate Baselines
Different configurations for various system types (e.g., desktop clients, servers).
Registry Settings
Managed via group policy objects (GPOs) in Windows.
Least Privilege
Limit registry modification rights.
Host-Based Intrusion Detection
Alerts on suspicious registry events.
Baseline Deviation Reporting
Ensures configurations match baseline templates.
MBSA Microsoft Baseline Security Analyzer

Examples & real-world scenarios

Supplementary — not from your PDF
  • Removing preinstalled trial software from new laptops.
  • Blocking USB storage through device control policies.
  • Separate baselines for desktops and servers.

Scenario

Staff all have local admin rights and install whatever they like. Removing admin rights and managing installs centrally cuts malware infections and configuration drift.

Common mistakes

Supplementary — not from your PDF
  • Giving every user local administrator rights.
  • Hardening so hard that users can't work and start finding workarounds.

Practical skills

Supplementary — not from your PDF
  • Draft a workstation hardening baseline.
  • Apply and verify a baseline on your own lab VM.

What I should remember

Key Points PDF p.257
  • Operating System Security
    • Practices: Access controls, secure configurations, patch management.
    • Hardening: Balancing security and usability.
  • Workstations
    • Hardening Practices: Remove unnecessary software, limit privileges.
    • User Training: Phishing, strong passwords, secure behaviors.
    • Security Configurations: Updates, firewalls, encryption.
  • Baseline Configuration
    • Registry Settings: Managed via GPOs.
    • Deviation Reporting: Ensures compliance with baselines.
    • Tools: Security Compliance Toolkit.