-: Now let's talk about the endpoints
with layered host security.
We talk about that, we're talking about our systems,
our servers, our desktops, our laptops, our smartphones.
All of these things are hosts on your network,
and we have to protect them.
These are often the most at-risk part of your network
because your users are directly using them,
and users are our biggest vulnerability.
You have to put in common security controls
and start layering these to give yourself good security.
Things like strong passwords and strong authentication.
Maybe that's using multi-factor authentication
using like a smart card token
or two-factor authentication using a texting for a log in.
You also need encryption.
That could be either file or full disk encryption.
You have host firewalls and host IPSs.
You have data loss prevention software.
You can have whitelisting and blacklisting software,
antimalware and antivirus software.
Doing good patch management is also good for your host.
System hardening and setting up those
configuration files really tight to make sure
your system is as strong as it can be.
Configuration management, file integrity monitoring,
and logging the events and issues,
all of these are common security controls
that you need to think about
when you're building your network.
I'm gonna dive into a couple of them in this lecture
that are really important though.
Things like Cryptography.
Cryptography has to do with encryption and hashing.
When you're encrypting your files or the full disk,
this is what's called data at rest.
You want to make sure that if somebody steals
that hard drive or steals those files,
they can't read them.
That's where Cryptography comes into play.
Proper storage of the encryption keys and passphrases
though is critical to your security
because if I use the same password on everything
and somebody gets that one password, it's all opened now.
Right?
If I have a server and everyone knows the password,
there's really no protection there.
You want to make sure that you're using
good strong passwords or passphrases
and storing those keys in an offline manner.
Now, we talk about hashing.
This is the way that we do file integrity checking.
You have to make sure that those files
are getting hash values and those are compared against
a known good database.
There's software that will do this for you.
It just depends on what your company wants to invest in
as they're building out their security architecture.
Logging, monitoring, and validation is another critical area
that you need to be looking at.
We look from the server and the host perspective
and all those logs need to be centrally monitored.
They should be sent off of those devices
into a centralized server.
This centralized server is called a SYS log server
or you'll use a SIEM product
which is Security Information and Event Management.
Things like Tripwire, AlienVault, and Splunk
are great examples of SIEM environments.
You also would want to make sure that those hosts
that you're validating them.
One of the ways to validate
that they're in the proper security posture
is by using Configuration Management.
Microsoft provides a great tool for this
called SCCM, but there's many other ones out there.
This is gonna allow you to validate the system settings,
the software versions across all of your hosts
that are sitting on your domain.
That's part of that validation perspective.
We put all that together.
That starts helping us secure those endpoints,
and we put that together with the layer defense
in depth from our network we talked about
and we start getting into a much more secure network
than we would otherwise.