Chapter 11 - Endpoint Security Flashcards
What are some of the most common ways in which operating systems can be vulnerable?
- Vulnerabilities in the OS code
- Defaults (default passwords, insecure default settings)
- Configurations (intentional but insecure)
- Misconfigurations (unintentional and insecure)
Firmware
Firmware is the embedded software that allows devices to function. It is tightly connected to the hardware of a device and may or may not be possible to update depending on the design and implementation of the device’s hardware.
End-of-Life/Legacy Hardware
End-of-Life/Legacy Hardware drives will eventually lack support. Once a device or system has reached end-of-life, they typically will also reach the end of their support from the manufacturer. This means that there will no longer be any security fixes/patches.
Endpoint
Endpoints, in a wired/wireless network, are devices such as desktops, smartphones, servers, and a variety of other systems found in organizations.
What are the two common techniques that UEFI firmware can leverage to ensure that a system is booting securely?
- Secure Boot
- Measured Boot
Secure Boot
Secure Boot ensures that the system boots using only software that the original equipment manufacturer (OEM) trusts. To perform a Secure Boot operation, the system must have a signature database listing the secure signatures of trusted software and firmware for the boot process.
Key Management System (KMS)
Key Management Systems are used to store keys and certificates as well as to manage them centrally. A KMS provides a means of managing keys/secrets while a Hardware Security Module (HSM) is used for key generation.
KSM = Key Management/Governance
HSM = Key Generation/Cryptographic Operations
Measured Boot
Measured Boot processes measure each component, starting with the firmware and ending with the boot start drivers. Measured Boot does not validate against a known good list of signatures before booting; instead, it relies on the UEFI firmware to hash the firmware, boot-loader, drivers and anything else that is part of the boot process. This data is stored in the Trusted Platform Module (TPM), and the logs can be validated at a remote server to let security administrators know the boot state of the system. This process allows the remote server to make decisions about the state of the system based on the information it provides, allowing access control and quarantine options.
Trusted Platform Module (TPM)
A Trusted Platform Module is a chip that is built into many computers. TPM chips are frequently used to provide built-in encryption, and they provide three major functions:
- Remote attestation, allowing hardware and software configurations to be verified
- Binding, which encrypts data
- Sealing, which encrypts data and sets requirements for the state of the TPM chip before decryption
Apple Secure Enclave
Apple’s Secure Enclave is a dedicated secure element that is built into Apple’s system-on-chip (SoC) modules. They provide hardware key management, which is isolated from the main CPU, protecting keys throughout their life cycle and usage.
Sandbox
Sandbox, in the context of endpoint security, describes an isolated environment where potentially dangerous or problematic software can run.
Allow List/Whitelist
An Allow List allows you to build a list of software, applications, and other system components that are allowed to exist and run on a system. If they are not on the list, they will be removed, disabled, or not installed in the first place. Allow Lists are more secure than Deny Lists.
Deny List/Block List/Blacklist
Deny Lists are lists of software or applications that cannot be installed or run.
Endpoint Detection and Response (EDR)
Endpoint Detection and Response tools combine monitoring capabilities on endpoint devices and systems using a client or software agent with network monitoring and log analysis capabilities to collect, correlate, and analyze events.
Extended Detection and Response (XDR)
Extended Detection and Response tools consider not only endpoints but the full breadth of an organization’s technology stack, including cloud services, security services and platforms, email, and similar components. XDR tools will use detection algorithms, AI, and machine learning to analyze the data to find issues and help security staff respond to them.
Data Loss Prevention (DLP)
Data Loss Prevention tools may be deployed to endpoints in the form of clients or applications. These tools also commonly have network and server-resident components to ensure that data is managed throughout its life cycle and various handling processes.
The primary goal of DLP is to ensure that data does not leave the organization.
