Please enable JavaScript.

Coggle requires JavaScript to display documents.

System and Endpoint Protection, image, image - Coggle Diagram

- - - - A host-based solution is a software application that runs on a local device (or endpoint) to protect it. The software works with the operating system to help prevent attacks.
        that have hst based firewall
        Host Instruction
        Data Lost Prevention
      - Host Encryption
        
        The Windows Encrypting File System (EFS) feature allows users to encrypt files, folders or an entire hard drive. Full disk encryption (FDE) encrypts the entire contents of a drive (including temporary files and memory). Microsoft Windows uses BitLocker for FDE.
        
        Boot Integrity
        
        Boot integrity ensures that the system can be trusted and has not been altered while the operating system loads.
        Firmware — software instructions about basic computer functions — is stored on a small memory chip on the motherboard. The basic input/output system (BIOS) is the first program that runs when you turn on the computer.
  - - - Computer equipment
      - To physically protect computer equipment:
      - Use cable locks to secure devices
      - Keep telecommunication rooms locked
      - Use security cages (Faraday cages) around equipment to block electromagnetic fields.
- - - - News media commonly cover external network attacks on enterprise networks. These are some examples of such attacks:
      - DoS attacks on an organization’s network to degrade or even halt public access to it
      - Breach of an organization’s web server to deface their web presence
      - Breach of an organization’s data servers and hosts to steal confidential information
    - - New security architectures for the borderless network address security challenges by having endpoints use network scanning elements. These devices provide many more layers of scanning than a single endpoint possibly could. Network-based malware prevention devices are also capable of sharing information among themselves to make better informed decisions.
- - - - The distinction between host-based intrusion detection and intrusion prevention is blurred. In fact, some sources refer to host-based intrusion detection and prevention systems (HIPDS). Because the industry seems to favor the use of the acronym HIDS, we will use it in our discussion here.
      - HIDS Operation
        
        A HIDS can prevent intrusion because it uses signatures to detect known malware and prevent it from infecting a system. However, this strategy is only good against known threats. Signatures are not effective against new, or zero day, threats.
    - - OSSEC uses a central manager server and agents that are installed on individual hosts. Currently, agents are available for Mac, Windows, Linux, and Solaris platforms. The OSSEC server, or Manager, can also receive and analyze alerts from a variety of network devices and firewalls over syslog. OSSEC monitors system logs on hosts and also conducts file integrity checking. OSSEC can detect rootkits and other malware,
- - - - Application blocklists can dictate which user applications are not permitted to run on a computer. Similarly, allow lists can specify which programs are allowed to run, as shown in the figure. In this way, known vulnerable applications can be prevented from creating vulnerabilities on network hosts.
      - System-Based Sandboxing
        
        Sandboxing is a technique that allows suspicious files to be executed and analyzed in a safe environment. Automated malware analysis sandboxes offer tools that analyze malware behavior. These tools observe the effects of running unknown malware so that features of malware behavior can be determined and then used to create defenses against it.