Skip to content
Lesson 6 of 8

Endpoint Security

8 min read

What an Endpoint Is and Why It Is a Target

An endpoint is any device that connects to a network: laptops, desktops, servers, mobile phones, tablets, and even Internet of Things (IoT) devices. Each one represents a possible entry point for an attacker and, at the same time, an asset we must protect.

With the disappearance of the traditional perimeter —due to remote work, the cloud, and personal devices— endpoints have become the first line of defense. There is no longer a single-walled "castle" to guard: there are dozens of devices scattered across homes, cafés, and offices, each connecting from networks you do not control. A single compromised machine can serve as a beachhead for an attacker to move laterally across the entire network, as we saw in the anatomy of an attack. Protecting the endpoint is therefore a strategic priority, not a technical detail.

Endpoint security is not a single tool, but a combination of layers: malware prevention, vulnerability management, attack surface reduction, encryption, and recovery capability. Let us go through each one, and close with concrete commands to check the state of your own machine.

Antivirus and EDR

Traditional antivirus protects by detecting known malware through signatures: patterns that identify already-cataloged threats. It is like a doorman with an album of wanted criminals' photos; it works very well against those already in the album, but it does not recognize a new attacker or one that disguised itself to change its appearance (its signature). Against new or polymorphic malware, signature detection arrives late.

That is why defense evolved into EDR (Endpoint Detection and Response). Instead of merely comparing signatures, EDR monitors the system's behavior in real time: a Word document that suddenly launches PowerShell, a process that starts encrypting thousands of files in seconds, unusual network connections at odd hours. When it detects anomalous activity, it can isolate the machine from the network, stop processes, and give the security team the visibility to investigate what happened and how far it got. Its evolution, XDR, correlates signals from multiple sources (endpoint, network, email, cloud).

| Approach | What it relies on | Strength | Limit | |---|---|---|---| | Signature antivirus | Comparing against known threats | Fast and effective against the known | Blind to the new | | EDR | Analyzing behavior in real time | Detects new and fileless attacks | Requires management and tuning | | XDR | Correlating signals from several sources | Full view of the incident | Greater complexity and cost |

For individual users, a reputable, up-to-date security solution —including the one built into the operating system itself— is enough; for organizations, centrally managed EDR/XDR allows responding to incidents at scale. In both cases, no single tool replaces the other layers of defense: the best EDR does not repair an unpatched system.

Patch Management

Most successful attacks do not exploit unknown, sophisticated vulnerabilities, but already-known flaws for which a patch exists that the victim did not apply. Patch management —keeping the operating system and all applications up to date— is probably the defensive measure with the best cost-benefit ratio in this whole lesson.

There is a dynamic worth understanding: when a vendor publishes a security update, it also implicitly reveals the vulnerability it fixes. Attackers read those bulletins, work out how to exploit the flaw, and go looking for those who have not patched yet. That is why the window between a patch's release and its application is a period of high risk. WannaCry (lesson 3) is the perfect example: Microsoft had published the patch almost two months before the outbreak; the victims were, overwhelmingly, machines that had not applied it.

Enabling automatic updates on operating systems, browsers, and applications is one of the simplest, highest-impact actions any person can take. Unsupported (end-of-life) software, which no longer receives patches, must be retired or isolated, because its flaws will never be fixed. You can check the state of your updates like this:

# Windows: list the most recent installed patches
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Linux (Debian/Ubuntu): see and install security updates
sudo apt update && sudo apt upgrade

# macOS: check for system updates
softwareupdate --list

Hardening: Reducing the Attack Surface

Hardening consists of configuring a system to minimize its exposure, removing everything unnecessary and restricting the rest. Every unused service, port, or account is a possible attack path that is best closed. The guiding principle, which we already saw in networking, is the same: only what is strictly necessary should be enabled.

Hardening practices include disabling unused services and accounts, closing unnecessary ports, disabling old and insecure protocols, applying secure default configurations, using standard (non-administrator) user accounts for daily work, and enabling the operating system's own firewall. Reference guides such as the CIS Benchmarks offer detailed, vetted checklists for common operating systems and applications, so you do not have to invent the configuration from scratch.

Verifying that the system firewall is active is a good first hardening step:

# Windows: firewall state per network profile
Get-NetFirewallProfile | Select-Object Name, Enabled

# Linux: firewall state (ufw)
sudo ufw status verbose

Disk Encryption: Protecting Data at Rest

Full-disk encryption is also part of hardening and deserves separate mention because it protects a scenario the other layers do not cover: physical theft or loss of the device. Without encryption, whoever has the machine in hand can remove the disk and read all its contents, bypassing the login password entirely. With encryption (BitLocker on Windows, FileVault on macOS, LUKS on Linux), without the key the content is simply unreadable.

Picture a work laptop left behind in a taxi. If the disk is encrypted, it is an annoying financial loss; if it is not, it is a data breach: contracts, emails, saved credentials, and customer spreadsheets in a stranger's hands. Check the encryption status:

# Windows: BitLocker status per volume
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus

# macOS: FileVault status
fdesetup status

Backups: the Last Line of Defense

When all other defenses fail —due to ransomware, a hardware failure, or a simple human error that deletes the wrong folder— backups are what allow recovery without paying ransoms or losing information for good. A good strategy is summed up in the 3-2-1 rule:

  • 3 copies of the data (the original plus two backups).
  • 2 different types of media (for example, an external disk and the cloud).
  • 1 copy off-site, safe from a fire, theft, or flood affecting the main location.

It is crucial that at least one copy be isolated or immutable, so that ransomware infecting the network cannot also encrypt the backups. Copies permanently connected to the system —the external disk always plugged in, the synced network folder— are as vulnerable as the original data: ransomware encrypts them along with everything else. That is why a backup that only lives in a cloud-synced folder is not, on its own, enough protection against ransomware.

Equally important is testing the restore regularly. A backup that has never been verified may be corrupt, incomplete, or misconfigured — and discovering that on the day of the disaster is the worst possible moment. The rule is simple: an untested backup is not a backup, it is a hope.

In Practice: Endpoint Checklist

  • Enable automatic updates for the operating system, the browser, and applications.
  • Make sure you have a reputable security solution active and current (the built-in one is enough for personal use).
  • Turn on the operating system firewall and disable services you do not use.
  • Use a standard user account for daily work and reserve the administrator one for when it is truly needed.
  • Enable disk encryption (BitLocker / FileVault / LUKS) on laptops and mobile devices.
  • Set up 3-2-1 backups, with at least one isolated, and test the restore from time to time.
  • Retire or isolate unsupported software that no longer receives patches.

Common Mistakes

  • Believing antivirus is enough: signature detection is blind to new or fileless threats.
  • Postponing patches: the unpatched window is exactly when attackers exploit the freshly published flaw.
  • Always working as administrator: any malware you run inherits those privileges and does far more damage.
  • Not encrypting laptops: a physical loss becomes an avoidable data breach.
  • Trusting a never-tested or always-connected backup: it may be corrupt, or get encrypted along with the data during a ransomware attack.

Key Takeaways

  • An endpoint is any connected device; with the perimeter gone, it is the first line of defense.
  • Signature antivirus stops the known; EDR/XDR analyzes behavior and detects new and fileless attacks.
  • Patch management is the best cost-benefit defense: enable automatic updates and retire unsupported software.
  • Hardening reduces the attack surface (fewer services, fewer privileges, active firewall) and disk encryption protects data against theft or loss.
  • 3-2-1 backups, with one isolated copy and tested restores, are the last line of defense against ransomware, failures, and human error.

With endpoints protected and backed up, in the next lesson we will go out to browse safely and protect our privacy.