Cyberstudy
PDF p.259 In progress

Endpoint Protection

Open PDF at p.259 23 flashcards

Summary

PDF p.259

Endpoint protection involves hardening devices to enhance security by minimizing vulnerabilities. This includes segmentation, device isolation, antivirus and antimalware solutions, disk encryption, and patch management.

In plain words

Supplementary — not from your PDF

Endpoint protection combines segmentation and device isolation (to stop threats spreading), antivirus and antimalware (from simple signatures to broad detection of Trojans, spyware, PUPs and cryptojackers), disk encryption (full disk encryption or self-encrypting drives, with keys protected by a TPM), and patch management (automated, tested, managed across operating systems and third-party apps).

Detailed explanation

PDF p.259
  • Device Hardening: Configuring network and system settings to reduce the attack surface.
  • Segmentation: Divides networks into segments or subnets with distinct security controls, limiting the spread of attacks.
  • Isolation: Segregates individual devices to prevent lateral spread of threats.

Key Components

  • Antivirus and Antimalware
    • Signature-Based Detection: Detects known viruses and malware.
    • Generalized Malware Detection: Includes Trojans, spyware, PUPs, cryptojackers, etc.
  • Disk Encryption
    • Full Disk Encryption (FDE): Encrypts entire drive contents, including system files.
    • Self-Encrypting Drives (SED): Perform cryptographic operations on the drive controller, improving performance.
    • Trusted Platform Module (TPM): Securely stores encryption keys.
  • Patch Management
    • Automated Updates: Ensures systems are up-to-date with security patches.
    • Testing Patches: Crucial for maintaining stability and security.
    • Enterprise Patch Management Suites: Manage updates for multiple OSes and third-party applications.

Segmentation

  • Purpose: Isolates systems to limit the spread of attacks.
  • Implementation: Divides networks into subnets with distinct security controls.

Device Isolation

  • Purpose: Prevents lateral spread of threats.
  • Implementation: Restricts network traffic between devices.

Antivirus and Antimalware

  • First Generation: Signature-based detection of known viruses.
  • Modern Solutions: Detect a wide range of malware, including Trojans and spyware.

Disk Encryption

  • Full Disk Encryption (FDE): Encrypts entire drive contents.
  • Self-Encrypting Drives (SED): Use drive controllers for encryption, improving performance.
  • Trusted Platform Module (TPM): Stores encryption keys securely.

Patch Management

  • Automated Updates: Ensures systems are patched regularly.
  • Testing Patches: Prevents issues from untested patches.
  • Enterprise Solutions: Manage updates for various systems and applications.

Important terms

taken from the text above
Device Hardening
Configuring network and system settings to reduce the attack surface.
Segmentation
Divides networks into segments or subnets with distinct security controls, limiting the spread of attacks.
Isolation
Segregates individual devices to prevent lateral spread of threats.
Signature-Based Detection
Detects known viruses and malware.
Generalized Malware Detection
Includes Trojans, spyware, PUPs, cryptojackers, etc.
Full Disk Encryption (FDE)
Encrypts entire drive contents, including system files.
Self-Encrypting Drives (SED)
Perform cryptographic operations on the drive controller, improving performance.
Trusted Platform Module (TPM)
Securely stores encryption keys.
Automated Updates
Ensures systems are up-to-date with security patches.
Testing Patches
Crucial for maintaining stability and security.
Enterprise Patch Management Suites
Manage updates for multiple OSes and third-party applications.
First Generation
Signature-based detection of known viruses.
Modern Solutions
Detect a wide range of malware, including Trojans and spyware.
Enterprise Solutions
Manage updates for various systems and applications.
FDE Full Disk Encryption SED Self-Encrypting Drives TPM Trusted Platform Module

Examples & real-world scenarios

Supplementary — not from your PDF
  • BitLocker full disk encryption with keys sealed in the TPM.
  • An enterprise patch tool updating browsers and PDF readers as well as the OS.
  • Isolating an infected laptop from the network.

Scenario

A laptop is stolen from a car. Because it had full disk encryption with a TPM-protected key, the data can't be read. The incident becomes a hardware loss, not a data breach.

Common mistakes

Supplementary — not from your PDF
  • Patching only the OS and forgetting third-party applications.
  • Pushing patches to everything without testing them first.

Practical skills

Supplementary — not from your PDF
  • Plan a tested patch rollout in stages.

What I should remember

Key Points PDF p.259
  • Device Hardening: Reduces attack surface.
  • Segmentation: Isolates systems to limit attack spread.
  • Device Isolation: Prevents lateral threat movement.
  • Antivirus and Antimalware: Detects and prevents malware.
  • Disk Encryption: Protects data on drives.
  • Patch Management: Ensures systems are up-to-date and secure.