Endpoint security

Endpoint security

1. Getting Started...

   • Evolving Threat Landscape
     • Ransomware attacks
       • data on an infected machine is encrypted until a cryptocurrency ransom is paid
     • Living-off-the-land attacks
       • Attackers use trusted off-the-shelf and pre-installed system tools to conduct these attacks.
     • Incursion
       • email with a malicious script inside a document or hidden in another host file such as a LNK file.
     • Persistence
       • After the endpoint is compromised, stage two may or may not be fileless with regard to the persistence method
     • Payload
       • The payload of the threat often makes use of dual-use tools
     • Fileless attacks
       • Memory only threats, such as SQL Slammer
       • Fileless persistence, such as VBS load points in the registry
       • Dual-use tools, such as psExec.exe
       • Non-portable-executable (non-PE) file attacks, such as Office documents with macros or scripts
   • Understanding The attack cycle
     • Reconnaissance
       • The attacker explores the attack surface, looking to discover the systems, services, applications, people
     • Delivery
       • The attacker crafts and then delivers an attack
     • Exploitation
       • The attack is initiated, and the network is breached
     • Execution
       • Establishing persistence
         • the attacker will be able to remain in the network
       • Escalating privileges
         • token manipulation, AppInit dynamic link libraries (DLLs), application shimming, DLL injection
       • Setup command and control
         • Command and control traffic is frequently encrypted and tunneled inside HTTP or IRC to avoid detection by the firewall
     • Lateral movement
       • via privilege escalation
     • Exfiltration
   • Security Framework for Next- Generation Endpoint
     • Prevention
       • goes beyond signature blocking to fuse signature-less technologies such as advanced machine learning
     • Application isolation and control
       • Harden the endpoint against cyberattacks with complete visibility into the application attack surface
     • Deception
       • Turn the tables on attackers by deploying baits and decoys at scale to gain insights into attackers
     • Detection and response
       • Perform incident investigations and remediation leveraging a single agent for protection and endpoint detection
     • Mobile threat defense
       • Use a layered mobile threat defense approach to proactively identify and protect devices from malicious apps
     • Endpoint vulnerability and patch management
       • consider providers that can also address endpoint vulnerability and patch management

2. Endpoint Protection Technologies

   • Machine Learning
     • smart enough to detect it for zero-day protection
     • It uses mathematical techniques across huge DB
   • Monitoring behavior
     • monitoring compares the actions of files or network packets to a list of accepted or suspicious actions
   • Examining Intrusion Prevention and Firewalls
     • HIPS detects potentially malicious network traffic that matches preconfigured signatures
     • A personal firewall provides packet filtering and stateful inspection of traffic
   • File Reputation
     • cloud-based threat intelligence to quickly inspect, analyze, and classify files based on numerous criteria: age, download frequency...
   • Emulation
     • oils malware’s attempts to evade detection using polymorphic custom packers by unpacking files ina virtual environment that emulates OS
   • Application & device control
     • enables organizations to explicitly allow or block specific applications from running on endpoints
   • Endpoint protection to cloud workloads
     • security solution that allows them to discover, monitor, and protect all their workloads across their entire hybrid cloud ideally from a single, efficient console
     • DevOps
       • combines modern cloud-native tools, philosophies, and practices toward a common goal

3. Application Insolation & Control

   • Recognizing the Need for Application Isolation
   • Understanding Why Trusted Applications Are the Riskiest
     • Some documents, such as Microsoft Word, Excel, and Adobe PDF files, also allow scripted content
   • Preventing attacks rom all angles
     • Blacklisting
       • follows a default “allow” model
     • Whitelisting
       • follows a default “deny” model
     • Application isolation
       • follows a zero-trust model