CoreQ Academy3.2 Given a scenario, analyze requirements to enhance the security of endpoints and servers.
Endpoint and server hardening combines prevention (allow lists, least privilege), detection (EDR, HIDS) and knowledge of the TTPs attackers use on hosts.
Controls
- Application control
- Only approved software can run (allow listing).
- Endpoint detection and response (EDR)
- Behavioural detection, investigation and response on hosts.
- Event logging and monitoring
- Forwarding host logs to central analysis.
- Endpoint privilege management
- Removing local admin rights and elevating specific apps when needed.
- Attack surface monitoring and reduction
- Tracking and disabling unneeded features, ports and services (e.g. attack surface reduction rules).
- Host-based intrusion prevention system (HIPS)/host-based intrusion detection system (HIDS)
- Host software that detects (HIDS) or blocks (HIPS) malicious activity.
- Anti-malware
- Signature and behaviour-based malware protection.
- SELinux
- Mandatory access control confining Linux processes.
- Host-based firewall
- Per-host traffic filtering.
- Browser isolation
- Running web content remotely or in a sandbox so malicious code never reaches the endpoint.
- Configuration management
- Enforcing secure baselines and detecting drift.
- Mobile device management (MDM) technologies
- Policies, compliance checks and remote wipe for mobile devices.
Threat-actor tactics, techniques, and procedures (TTPs)
- Injections
- Code or DLL injection into processes; detected by EDR behaviour rules.
- Privilege escalation
- Gaining higher rights; mitigated by patching and least privilege.
- Credential dumping
- Extracting credentials from memory; mitigated by Credential Guard and LSA protection.
- Unauthorized execution
- Running unapproved code; blocked by application control.
- Lateral movement
- Moving between hosts; limited by host firewalls and admin tiering.
- Defensive evasion
- Disabling or hiding from security tools; detect tampering and protect agents.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 3.2 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.