Endpoint and System Security
Domain 4 tests hardening and control of servers, workstations, and mobile endpoints across their lifecycle. Topics include secure baselines, patching, endpoint detection and response, antivirus limitations, application allowlisting, host firewalls, disk encryption, secure boot, logging, and device management.
Core rules
- A hardened baseline removes unnecessary services, accounts, protocols, and default credentials. Deviations need documented exceptions and compensating controls.
- Patch management must cover operating systems, applications, firmware, and dependencies, with risk-based timelines and rollback plans.
- EDR provides behavioral detection and response; antivirus signatures alone miss fileless and novel activity. Application allowlisting blocks unapproved executables.
- Full disk encryption protects data at rest if a device is lost; TPM-backed secure boot helps protect boot integrity. Encryption keys must not be stored with the protected data.
- Endpoint logs should be centralized before an incident, not reconstructed afterward.
Worked example
A laptop containing customer data is stolen. The defensible control set is full disk encryption with keys protected by TPM, strong pre-boot authentication where required, remote wipe, and centralized device inventory. If the disk is removed and mounted elsewhere, encryption still protects confidentiality. The reasoning is to protect the data against physical access and to preserve the ability to respond through management tooling.
Traps
Do not treat antivirus as complete endpoint protection. Do not allow routine local administrator use or disable logging to solve performance complaints. Do not assume a patch exception is permanent.