Endpoint Security (Windows, Linux, Mobile, IoT)
Windows
Core controls are Active Directory and Group Policy (precedence order Local, Site, Domain, OU - LSDOU), AppLocker or WDAC for application control, BitLocker for full-disk encryption, Windows Defender/Defender for Endpoint, LAPS for local admin password rotation, Windows Firewall, patch management (WSUS), and audit policy. Registry, service, and scheduled-task permissions are common privilege-escalation paths, so hardening means removing unnecessary rights, disabling legacy protocols such as SMBv1 and NTLMv1, and restricting local administrators.
Linux
Understand file permissions (rwx triads, octal 755 = owner rwx, group r-x, other r-x), ownership, SUID/SGID bits, umask, and sudo versus su. Passwords live in /etc/shadow (root-readable); /etc/passwd holds account metadata. Mandatory access control via SELinux or AppArmor, host firewalling with iptables/nftables/firewalld, SSH hardening (key auth, no root login, restrict users), PAM, and file integrity monitoring (AIDE, Tripwire) are examinable hardening steps.
Mobile and IoT
Mobile protection relies on MDM/MAM, containerization, encryption, remote wipe, rooting/jailbreak detection, sideloading restrictions, and OS patch level. IoT devices are the weakest link: default credentials, unpatched firmware, no agent support - the answer is almost always segmentation onto an isolated VLAN plus credential change and firmware control.
Traps
BitLocker (volume encryption) versus EFS (file encryption), chmod 777 versus 755, and thinking SUID is a permission on directories. On endpoints, antivirus signature detection is not equivalent to EDR behavioral detection.
Rule of thumb
For any endpoint question, apply the order: identify, harden baseline, patch, restrict privilege, encrypt, monitor.