Operating System and Endpoint Security
Domain focus
Operating System and Endpoint Security tests hardening and day-to-day protection of Windows, Linux and endpoint devices: patching, accounts, permissions, antivirus/EDR, firewalls, encryption, logging and recovery.
Core rules and concepts
- Least privilege means users and services get only the rights they need; routine work should not use administrator or root accounts.
- Patch operating systems and applications promptly; vulnerabilities in browsers and plugins are common entry points.
- Endpoint protection includes antivirus signatures, behaviour-based EDR, application allowlisting and host firewalls.
- Full-disk encryption protects data at rest if a device is lost; it does not stop malware running after login.
- Backups must be isolated, tested and versioned; secure boot and BIOS/UEFI passwords reduce boot-level tampering.
- Central logging helps detect failed logins, privilege changes and suspicious process execution.
Worked example
A ransomware alert appears on a shared drive. The responder isolates the affected host from the network, disables the compromised account, preserves logs, identifies the encrypted share, restores from an offline tested backup, then patches the exploited service and resets credentials. Reasoning: isolation limits spread; disabling the account blocks reused access; evidence supports investigation; restoration is validated before reconnection.
Traps that cost marks
Do not say antivirus alone secures an endpoint. Do not use an administrator account for daily browsing. Do not assume deleting a malware file removes persistence. Do not call an untested backup a recovery plan. Do not confuse disk encryption with network encryption.