Endpoint Security and System Hardening
Domain 3 tests endpoint protection and hardening across Windows, macOS, Linux, and mobile. You should know baseline configuration, patching, endpoint detection and response (EDR), application control, and encryption.
Core rules and concepts
- Hardening reduces attack surface: remove unused services, disable default accounts, change default credentials, restrict administrative rights, and enable host firewalls.
- Patch operating systems and third-party applications on a risk-based cadence; emergency patches for actively exploited flaws.
- EDR collects process, file, network, and behavioral telemetry and can isolate a host. It complements antivirus; it does not replace patching.
- Application allowlisting permits known-good executables; blocklisting is weaker because it misses unknown malware.
- Full-disk encryption protects data at rest if a device is lost; key escrow and recovery must be planned.
- CIS Benchmarks and vendor security baselines provide measurable configuration targets.
Worked example
A Windows laptop handles payroll. Harden it by disabling SMBv1, enabling BitLocker with TPM, enforcing screen lock, removing local admin from the user, enabling Defender and EDR, applying OS and browser patches, and restricting USB mass storage. Reasoning: each control addresses a different loss path: credential theft, data theft from a lost device, malware execution, and lateral movement. Verify with a configuration scan, not just a checklist signature.
Traps that cost marks
Antivirus is not the whole endpoint stack. Patching only the OS leaves browsers and Java exposed. Disabling a firewall 'temporarily' often becomes permanent. Encryption without recovery keys creates availability risk.