Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 13: Endpoint Security - Coggle Diagram

- - - - Endpoints - Hosts commonly consist of laptops, desktops, servers, and IP phones which are susceptible to malware-related attacks. Endpoints also include video cameras, point-of-sale devices, and devices on the Internet of Things.
        
        The endpoints also used traditional host-based security measures:
        
        Antivirus/Antimalware Software - This is software installed on a host to detect and mitigate viruses and malware. Companies that provide anti-virus software include Norton, TotalAV, McAfee, MalwareBytes and many others.
        
        Host-based IPS - This is software that is installed on the local host to monitor and report on the system configuration and application activity, provide log analysis, event correlation, integrity checking, policy enforcement, rootkit detection, and alerting. Examples include Snort IPS, OSSEC, and Malware Defender, among others.
        
        Host-based firewall - This is software that is installed on a host that restricts incoming and outgoing connections to those initiated by that host only. Some firewall software can also prevent a host from becoming infected and stop infected hosts from spreading malware to other hosts. Included in some operating systems such as Windows, or produced by companies such as NetDefender, Zonealarm, Comodo Firewall, and many others.
      - Network infrastructure - LAN infrastructure devices interconnect endpoints and typically include switches, wireless devices, and IP telephony devices. Most of these devices are susceptible to LAN-related attacks including MAC address table overflow attacks, spoofing attacks, DHCP related attacks, LAN storm attacks, STP manipulation attacks, and VLAN attacks.
  - - - Larger organizations now require protection before, during, and after an attack. IT administrators must be able to answer the following questions:
        
        Where did the attack come from?
        
        What was the exploit method and point of entry?
        
        What systems were affected?
        
        What did the exploit do?
        
        How do we recover from the exploit?
        
        How can we mitigate the vulnerability and root cause?
      - Network-Based Malware Protection
        
        New security architectures for the borderless network address security challenges by having endpoints use network scanning elements. These devices provide many more layers of scanning than a single endpoint possibly could. Network-based malware prevention devices are also capable of sharing information among themselves to make better informed decisions.
        
        The following are examples of devices and techniques that implement host protections at the network level.
        
        Advanced Malware Protection (AMP) - This provides endpoint protection from viruses and malware.
        
        Email Security Appliance (ESA) - This provides filtering of SPAM and potentially malicious emails before they reach the endpoint. An example is the Cisco ESA.
        
        Web Security Appliance (WSA) - This provides filtering and blocking of websites to prevent hosts from reaching dangerous locations on the web. The Cisco WSA provides control over how users access the internet and can enforce acceptable use policies, control access to specific sites and services, and scan for malware.
        
        Network Admission Control (NAC) - This permits only authorized and compliant systems to connect to the network.
        
        Hardware and Software Encryption of Local Data
        
        Operating systems such as MAC OSX natively provide encryption options. The Microsoft Windows 10 operating system also provides encryption natively. Individual files, folders, and drives can be configured to encrypt data. In Windows, BitLocker provides drive encryption, as shown in the figure. Files can also be encrypted, but because applications can create unencrypted back up files, the entire folder that the file is stored in should be encrypted
  - - - NAC systems can have the following capabilities
        
        Profiling and visibility - This recognizes and profiles users and their devices before malicious code can cause damage.
        
        Guest network access - This manages guests through a customizable, self-service portal that includes guest registration, guest authentication, guest sponsoring, and a guest management portal.
        
        Security posture checking - This evaluates security-policy compliance by user type, device type, and operating system.
        
        Incident response - This mitigates network threats by enforcing security policies that block, isolate, and repair noncompliant machines without administrator attention.
      - The goal of NAC systems is to ensure that only hosts that are authenticated and have had their security posture examined and approved are permitted onto the network. For example, company laptops used offsite for a period of time might not have received current security updates or could have become infected from other systems. Those systems cannot connect to the network until they are examined, updated, and approved.
        Network access devices can function as the enforcement layer, as shown in the figure. They force the clients to query a RADIUS server for authentication and authorization. The RADIUS server can query other devices, such as an antivirus server, and reply to the network enforcers.
- - - - The auto keyword must be entered to enable 802.1X authentication. Therefore, to enable 802.1X on the port, use the authentication port-control auto interface configuration command.