-: Secure endpoint management.
So when we talk about secure endpoint management
we're really talking about five things here.
We're talking about hardening our system configurations,
doing patch management,
adding compensating controls,
editing our group policies,
and installing endpoint security software.
All these things are the ways we can manage our endpoints
and make them the most secure they can be.
When we talk about endpoints
we're talking about our laptops,
our desktops,
our handheld devices like tablets and phones.
All of those are considered endpoints.
So when I wanna harden my system configuration
I wanna make it as resistant to attack as possible.
Things that can help us do this
is disabling unnecessary services,
closing unnecessary ports,
verifying we have secure configurations in place,
and centrally controlling the device security settings
and taking that away from our users.
For instance,
when we configure the host-based firewall
we wanna lock that down
so only administrators can mess with that
and not your end users because they'll just let things
through the firewall that you don't want let through.
That's the way that we harden our systems.
We wanna make a good baseline and push that out
to all of our workstations.
Now when we talk about patch management
this is making sure
that we are installing our patches properly.
So once a patch is released by the vendor,
like Microsoft or Adobe or somebody like that,
the attackers actually get that patch
and they start reverse engineering it
to find ways to break in.
Because if there's a patch
that means there was a vulnerability
they're trying to patch, right?
And the attackers are then gonna try to exploit that.
So as an organization
we wanna make sure that we are patching our systems
as quickly as possible to prevent attacks.
But to do that we have to have proper patch management.
A good example of something you can use
is the Microsoft System Configuration Manager
or SCCM.
It's a good way to push out patches across your enterprise.
Because if you had to go,
if you have 1,000 machines,
and you had to go install it on each and every one
of those thousand machines by walking over to it
it's gonna take you a long time.
Instead we wanna use things that we can push it
to those thousand machines using things like SCCM
and there's other ones out there
but that's the one that comes from Microsoft
and most (mumble) are running Microsoft networks.
So that's what we're gonna talk about in this course.
Now we talk about compensating controls.
We talked about this a little bit back
when we talked about technical and operational controls
back when we talked about risk.
Compensating controls.
If you can't implement a security control
you can compensate for it.
So, for instance, if a patch doesn't exist
but a vulnerability does
you can put a compensating control
in front of that vulnerability until a patch can be made.
Right?
This is gonna provide you a similar level of security
by using an alternate means.
So for instance,
when WannaCry came out,
which was just a couple of months ago,
the WannaCry outbreak
required you to disable SMB version one.
Which is server message block version one.
But this can break file shares if you have older systems.
So many people can't implement blocking SMBv1
which means they're still vulnerable to WannaCry.
So instead what you can do is you can actually block it
at the firewall port 445 so that the WannaCry virus
couldn't get in and attack you over that port.
That was a compensating control.
Point of sales and embedded systems often can not be updated
without the possibility of breaking them.
The same thing with SCADA systems.
You've gotta be really careful with these things.
And so instead of patching those systems
often we will put compensating controls
in front of those systems
and that's the way to bring the risk
down to an acceptable level.
Now when we talk about group policy objects
or GPO
this is a way that admins have an efficient way
to manage system and security configurations
across many devices in a network.
So, for example,
if I wanna require the use of firewalls
on all of my endpoints,
I can push that out as a group policy object.
If I want to map a share drive on all logins for my users
again, that's a GPO.
If I want to run scripts that log in to verify compliance
that everybody's up to date on their patching,
I can do that through a GPO.
If I have browsers that are getting pre-fetch
and causing issues that way,
I can block that by using a GPO
and pushing that out and saying,
hey, on Internet Explorer don't pre-fetch.
On Google Chrome don't pre-fetch.
Those are all things
that can be controlled by the group policy
and pushing out those settings across all the endpoints
or across it to their registries.
That's the benefit of GPO.
Set it once,
push it out to all 1,000 people.
Very, very helpful from a system administration standpoint.
Now when we talk about endpoint security software,
this is specialized software that enforces
the company's security objectives and policies.
The most common one of these is gonna be something like
anti-malware or anti-virus
so it's your McAfee Suite,
it's your Semantic,
your Norton,
your Windows Defender.
That kind of stuff, right?
But this software can also report
to a central management system
and that allows us as cyber security analysts
to view and analyze that data.
This can be something like our host-based IDS
or IPS,
intrusion detection and intrusion protection systems.
Those can actually feed up to a centralized server
and we can see what they are learning on
and what they're blocking on
and correlate those logs across our enterprise,
which then gives us more data to correlate
and allows us to make better decisions
as we're trying to defend the network.
Now in addition to that you can go the extra mile.
There's a couple of other things you can do.
There's two different types of access controls.
And if you move on into the advanced security practitioner
or the CISSP,
Certified Information Systems Security Professional,
you're gonna talk about MAC and DAC a lot more.
But here I'm just gonna talk about it very briefly.
MAC is mandatory access controls.
This says that all security permissions
are centrally managed
and the users cannot change their permissions locally.
Now when we talk about DAC,
this is discretionary access controls.
It's the opposite.
Anyone who's an owner of a file or resource
can set the permissions on that device.
Now which would you wanna do?
Well, from a security standpoint,
MAC is better.
But from a usability standpoint
and a less headache for the system administrator standpoint,
DAC is better.
So what's actually used more often?
DAC, almost exclusively.
But there are some people who use MAC.
MAC has this great security aspect
but it's an administration nightmare, right?
So it's only used in very secure environments
like SE Linux,
which is Secure Edition Linux,
which was made by the NSA,
the National Security Agency,
and MAC is a centralized control method to make sure
things are at the highest classification and control,
that's when you wanna use MAC.
But most businesses,
we're gonna use DAC because discretionary access control
is just so much easier from an administration standpoint.
And that's the idea here.
When we talk about securing our endpoint
we have to figure out who's gonna control the permissions
and who's gonna set those standards.
Generally we wanna do it centrally
and we wanna do it from the system administrators
based on our company policy.
And that's where these systems
are really gonna be able to be secured,
is based on our security policies and how we implement them.