Endpoint and Host Security
Core ideas
Endpoint protection has evolved from signature-based antivirus to endpoint detection and response (EDR) that watches behavior. Understand host hardening: patching, disabling unused services, removing default accounts, and applying least privilege. Application allowlisting permits only approved software, which blocks many unknown threats.
Controls to know
Host-based firewalls, full-disk encryption, and secure boot protect the endpoint itself. Configuration baselines and hardening guides reduce the attack surface. Patch management is a preventive control; vulnerability scanning is detective. Understand the difference between a vulnerability scan (identifies weaknesses) and a penetration test (exploits them under authorization).
Malware handling
Isolation (network quarantine) is the first step when malware is suspected, preserving evidence while stopping spread. Sandboxing runs untrusted code in a contained environment. Know that signature detection fails against polymorphic malware, which is why behavioral detection matters.
Traps in questions
Questions often ask for the first action when malware is detected. The answer is usually to isolate the host, not to immediately delete files (which destroys evidence). Another trap: confusing patching (fixes known flaws) with hardening (reduces exposure generally). Also watch for allowlisting vs blocklisting: allowlisting is stronger but higher maintenance.
Worked example
A workstation shows abnormal outbound connections. The analyst should first isolate it from the network, then capture volatile data (memory, running processes), then analyze and remediate. Deleting the suspicious file first would erase forensic evidence and may not remove persistence.
Rule of thumb
Prevent where possible (patching, allowlisting, hardening), detect what you cannot prevent (EDR, monitoring), and preserve evidence before remediating.