Endpoint security

Endpoint security

1. The Art of Deception

   • Fake files
   • Fake credentials
   • Fake network shares
   • Cached items
   • Fake endpoints
   • Seeing the Need for Deception
     • Social components
       • Phishing, dumpster diving...
     • Technology vulnerabilities
     • Endpoint weakness
     • Misconfigurations

2. Detection & Response

   • Suspicious Activity
     • the entire attack sequence needs to be revealed and all potentially impacted systems iden- tified and prioritized.
   • Threat Analytics Using Cloud-Based Threat Intelligence
     • Phase one: Environment assessment
       • Threat events
       • Adversary intelligence
       • Continuous recording
       • User account abuse
       • Persistence mechanisms
       • Memory and dynamic link library (DLL) injection
       • Command line and interactive behavior
       • Perimeter event logs
       • Domain name system (DNS) logs
     • Phase two: Deep analysis and threat behavior verification
       • Active threat hunting
       • Sandboxing and payload detonation
       • Additional indicators
       • Network connections and IP reputation
       • Software usage history
       • Memory artifacts
   • Isolating and Investigating Threats
     • Understand threats in your environment
     • Reduce risk
     • Respond faster

3. Mobile Threat Defense

   • Different resources
   • Different operating systems
   • Different user behavior
   • MDM
   • Containerization
   • VPN tunneling:
     • Disrupted privacy and enablement
     • Lack of seamless continuity
     • Incomplete security
   • Protecting against Network, Device, OS, and Application Vulnerabilities
     • Non-invasive experiences
     • Minimal footprint
     • Ease of use
     • Accurate alerts

4. Good Endpoint Hygiene with Patch Management

   • Full Endpoint Estate Visibility — Inside and Outside the Network

5. Integrating Endpoint Security with the Rest of Your Security Infrastructure

   • Web and Email Gateways
     • To strengthen security across the network, endpoint protection ought to be integrated with secure web gateways (web proxies)
   • Security Information and Event Managers (SIEM)
     • SIEM integration should allow customers to stream or export threat events to a SIEM directly via a connector or app that can replicate event data
   • Security Orchestration, Automation, and Response (SOAR)
     • should allow customers to collect disparate security and threat data from a variety of different sources

6. Ten Tips for Effective Endpoint Security

   • Conduct end-user security awareness training
   • Harden your endpoints with application isolation and control.
   • Be deceptive
   • Use personal firewalls and host-based intrusion preven- tion systems (HIPS).
   • Install a data loss prevention (DLP) solution
   • Enable disk encryption
   • Protect mobile devices
   • Leverage cloud-based threat intelligence
   • Integrate endpoint security with the rest of your security ecosystem
   • Patch vulnerabilities