In this section of the course,
we're going to discuss endpoint and server security.
The endpoint and server security section
of the course focuses on domain 3, security engineering,
specifically objective 3.2,
which states that given a scenario,
you must be able to analyze requirements
to enhance the security of endpoints and servers.
To maintain a secure
and well-functioning enterprise network,
it's important to ensure systems and applications
are properly configured, monitored,
and protected against threats.
This management includes privileges, mobile devices,
and continuously assessing network vulnerabilities
to create a security posture
that safeguards both endpoints and servers.
As we go through this section,
we will cover many topics related to endpoint
and server security,
including configuration and privilege management,
operating system security, threat protection,
application management, monitoring and response,
mobile management, and attack surface management.
First, we'll look at configuration and privilege management.
Configuration and privilege management
are the process and tools used to manage system settings
and user permissions to ensure consistent
and compliant operation
across all enterprise devices and systems.
Configuration and privilege management concepts
include configuration management
and endpoint privilege management.
Configuration management is the control of system settings,
software versions, and updates to maintain security
and operational consistency.
Tools such
as Microsoft's System Center Configuration Manager
or SCCM for Windows are used to automate the deployment
and enforcement of configurations,
ensuring systems are consistently secured and compliant.
Endpoint Privilege Management focuses
on controlling user access levels and permissions
on individual endpoints to prevent unauthorized actions.
For example, Linux's sudo or super user do command,
may be used to control and limit user permissions
on a per-command basis.
This per-command authorization enables users
to execute specific administrative tasks
at the endpoint level
without requiring full administrative rights.
Next, we will explore operating system security.
Operating system security refers to the measures
and mechanisms implemented within an operating system
to protect it from unauthorized access,
malware, and other security threats.
In this section, we will focus on Security-Enhanced Linux
also known as SELinux.
Security-Enhanced Linux is a security module integrated
into the Linux kernel that provides a framework
for supporting access control security policies.
It uses mandatory access control
to enforce predefined security policies
that restrict how processes interact with each other
and with files.
In a server environment,
Security-Enhanced Linux might be configured
to restrict a web server's access
to sensitive files and directories
such as configuration files or databases.
This configuration could ensure
that if an attacker compromises the web server,
they cannot access or modify critical system files.
After that, we will look at threat protection.
Threat protection is the implementation of security measures
to detect, prevent, and respond to threats and attacks.
Threat protection concepts include anti-malware,
host-based firewalls,
host-based intrusion prevention systems,
and host-based intrusion detection systems.
Let's take a minute to discuss these concepts
in further detail.
Anti-malware is designed to detect, prevent,
and remove malicious software,
including viruses, worms, and ransomware.
A host-based firewall is installed
on an individual endpoint to control incoming
and outgoing network traffic based
on preset Access Control Lists.
Host-based intrusion prevention and detection systems
monitor and analyze system activities
for signs of malicious behavior or policy violations.
In application, an anti-malware tool may be used to identify
and quarantine ransomware trying to infect a server
while the host-based firewall
blocks malicious network traffic
attempting to reach the same server.
Simultaneously, host-based intrusion prevention systems
and host-based intrusion detection system devices
may detect abnormal behavior patterns
on the server indicative of a breach attempt.
If a breach is attempted,
host-based intrusion prevention systems
and host-based intrusion detection systems
will trigger alerts and take preventative measures
to address the attack.
Next, we will explore application management.
Application management is overseeing
and controlling applications
to ensure they do not introduce vulnerabilities
into the network or compromise system integrity.
Application management concepts include application control
and browser isolation.
Application control utilizes policies and tools
to restrict what applications can run on a given system.
In this manner, application control prevents unauthorized
or malicious software from executing.
Browser isolation, on the other hand, uses technology
to separate web browsing activities
from the rest of the operating system.
This protects the endpoint from online threats
and prevents malware that has been installed
during browsing activity
from impacting other parts of the system.
For example, an organization might use application control
to restrict the installation of unapproved software
while employing browser isolation
to ensure users safely browse the internet
without exposing the internal network to web-based threats.
Following that, we will look at monitoring and response.
Monitoring and response
is continuously observing system activities
to detect, analyze, and respond to threats.
Monitoring and response concepts
include event logging and monitoring,
as well as endpoint detection and response, or EDR.
Event logging and monitoring is the process of recording
and tracking system and application activities
to identify abnormal behavior.
The identification of abnormal behavior assists
in the early detection of malicious activity
and the follow on forensic analysis.
Endpoint detection and response offers individual endpoints,
real-time visibility,
automated threat detection and remediation to isolate
and quarantine malicious activity as quickly as possible.
Then, we will explore mobile management.
Mobile management includes Mobile Device Management or MDM.
Mobile Device Management is a component
of the Enterprise Mobility Management or EMM.
Enterprise Mobility Management
is a suite of technologies used to manage
and secure mobile devices within an organization.
Mobile Device Management technologies
are used to enforce security policies on mobile devices,
including configuration management, application control,
and data encryption to prevent unauthorized access
and ensure the integrity of mobile environments.
For example, a Mobile Device Management solution
can utilize geofencing to manage device functionalities
based on physical locations.
A geofence is a virtual boundary around a physical area
such as the company's premises,
defined using GPS or RFID technology.
When employees' devices enter
or exit this defined geofence zone,
the Mobile Device Management system
can automatically enforce policies,
such as disabling video and microphone features.
Finally, we will look at Attack Surface Management.
Attack Surface Management is identifying, monitoring
and reducing avenues of attack within the enterprise.
Attack Surface Management concepts
include attack surface monitoring and reduction,
Attack Surface Monitoring is continuously observing
and analyzing all the potential network entry points,
services, and interfaces of a system
to detect vulnerabilities and unauthorized changes.
Attack Service Reduction
minimizes these potential entry points
by removing unnecessary services, closing unused ports,
and implementing security measures to limit exposure.
For example, an organization might use Nmap,
or the network mapper,
to scan for open ports and services on its servers
and then employ firewall rules to close unused ports
and the Center for Internet Security
or CIS benchmarks to disable unnecessary services,
reducing their attack surface.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive into endpoint
and server security in this section of the course.