Endpoint and Cloud Security
Endpoint and Cloud Security
This domain tests protection of endpoints and cloud workloads, including HiSec Endpoint/EDR, host hardening, cloud shared responsibility, VPC segmentation, WAF, Anti-DDoS, KMS, and cloud-native logging.
Core rules
- Endpoint security is layered: patch and baseline, least-privilege accounts, application control, antivirus, EDR telemetry, and isolation capability. An agent that is offline or unlicensed gives false assurance.
- Cloud responsibility is shared. The provider secures the physical infrastructure and managed service availability; the customer secures identities, configurations, data, and workload patching.
- Use security groups and network ACLs for east-west and north-south control. Prefer deny-by-default and explicit allow rules; remember security groups are stateful and ACLs may be stateless.
- Put WAF in front of HTTP/HTTPS services, Anti-DDoS at the edge, KMS around data keys, and host security agents on ECS instances.
- Centralize logs and alerts; cloud audit logs, flow logs, and endpoint telemetry must have consistent time and retention.
Worked example
A public web application runs on ECS behind an ELB. Place Anti-DDoS on the EIP, WAF before the ELB, and restrict the ELB security group to WAF back-to-source addresses. Allow only 443 from users and management only from a bastion. Enable HSS on ECS, encrypt the database with KMS, and ship logs to a central service. Reasoning: each control covers a different layer: volumetric attack, HTTP attack, network access, host compromise, data-at-rest exposure, and investigation.
Traps
Assuming the cloud provider patches guest OSes; using a WAF to protect non-HTTP protocols; opening management ports to 0.0.0.0/0; and treating endpoint alerts as isolated events without cloud or identity context.