MODULE 5: Endpoint & Device Security

Lesson 1: Antivirus & EDR (Endpoint Detection & Response)

1. What is an Antivirus (AV)?

Antivirus is security software that detects and removes:

• Viruses
• Trojans
• Worms
• Ransomware
• Spyware

Traditional antivirus uses:

• Signatures (known malware fingerprints)
• Heuristics (behavior detection)

2. Limitations of Antivirus

Modern attacks:

• Change code frequently
• Use fileless malware
• Use PowerShell or WMI
• Abuse trusted system processes

Traditional AV cannot handle these advanced threats alone.

3. What is EDR (Endpoint Detection & Response)?

EDR is the modern evolution of antivirus.

EDR provides:

• Real-time monitoring
• Behavioral analytics
• Threat hunting
• Forensic data
• Automatic isolation of infected devices

Examples of EDR:

• CrowdStrike
• Microsoft Defender for Endpoint
• SentinelOne
• Sophos Intercept X
• Bitdefender GravityZone

4. How EDR Protects

EDR can:

• Detect suspicious actions (e.g., PowerShell executing encoded commands)
• Automatically stop attacks
• Quarantine files
• Kill malicious processes
• Alert security teams
• Record every action for investigation

EDR is essential in enterprise security.

Lesson 2: Patch Management

What is Patch Management?

Patching = Updating software to fix:

• Security vulnerabilities
• Bugs
• Performance issues

If a system is unpatched, attackers exploit the known weaknesses.

Why Patch Management Matters

Most hacks happen because:

• Software was outdated
• Known vulnerabilities were unpatched

Examples:

• WannaCry ransomware → exploited unpatched Windows systems
• Equifax breach → unpatched web server vulnerability

Patch Types

• OS patches (Windows Update, Linux packages)
• Application patches (Chrome, Java, Adobe)
• Firmware updates (BIOS, routers, switches)
• Security patches (zero-day fixes)

Patch Management Best Practices

• Schedule regular patch cycles (monthly/weekly)
• Test patches before deploying enterprise-wide
• Prioritize critical security patches
• Keep an inventory of all devices
• Automate updates when possible

Tools used:

• Microsoft WSUS
• SCCM / Intune
• ManageEngine Patch Manager
• PDQ Deploy
• SolarWinds Patch Manager

Lesson 3: Secure Configuration Baselines

1. What is Secure Configuration?

It’s the process of hardening systems by removing unnecessary features and reducing attack surface.

2. Why Default Settings Are Dangerous

Default configurations often:

• Allow unnecessary services
• Have open ports
• Use weak security settings
• Contain default passwords

Attackers know all vendor defaults.

3. Secure Configuration Baseline

A baseline is a standard security setup applied to all devices.

Examples:

• Disable SMBv1
• Disable guest account
• Enable firewall
• Disable autorun
• Disable scripting for non-admin users
• Restrict PowerShell
• Enforce password policy
• Enable BitLocker encryption

4. Tools for Configuration Baselines

• Microsoft Security Baselines
• CIS Benchmarks
• Group Policy (GPO)
• Intune Security Baselines
• Ansible playbooks

Enterprises use these baselines to maintain consistent, secure systems.

Lesson 4: Mobile Device Management (MDM)

Employees use smartphones and tablets for work. These devices must be managed securely.

1. What is MDM?

MDM (Mobile Device Management) controls how mobile devices access company resources.

MDM allows:

• Remote wipe (if device is stolen)
• Enforcing password/biometric lock
• Requiring encryption
• Controlling app installation
• Blocking risky apps
• Managing email access
• VPN enforcement
• Compliance monitoring

2. MDM Tools

• Microsoft Intune
• MobileIron
• VMware Workspace ONE
• IBM MaaS360
• Samsung Knox

3. Mobile Security Risks

• Lost/stolen devices
• Unsecured Wi-Fi
• Jailbroken/rooted devices
• Malicious apps
• Weak passwords
• Personal device mixing with work data

4. MDM Policies Examples

• Device must have screen lock
• Device must be encrypted
• No root/jailbreak
• Only approved apps allowed
• Automatic device wipe after failed password attempts

Lesson 5: Removable Media & USB Security

USBs are a MAJOR security threat.
Attackers use them to:

• Spread malware
• Steal data
• Drop malicious payloads
• Auto-run exploits

This method is known as “USB drop attack.”

1. Risks of USB Devices

• Malware injection
• Data leakage
• Firmware attacks
• Keyloggers inside USB cables
• Unauthorized copying of files

2. USB Security Best Practices

• Disable USB ports for unauthorized users
• Use endpoint protection to block unknown USB devices
• Prohibit USB mass storage without approval
• Encrypt approved USB drives
• Implement Data Loss Prevention (DLP)
• Log all USB device activity
• Auto-scan USB devices on insertion

3. Replace USB with Secure Methods

• Use cloud storage (OneDrive, SharePoint)
• Use secure file transfer tools
• Use internal file servers
• Use encrypted external drives

Module 5 Summary

Students now understand:

• The difference between Antivirus and EDR and why EDR is essential
• Why patching is critical for preventing attacks
• How secure baselines make systems harder to exploit
• How MDM protects mobile devices used by employees
• Why USB devices are high-risk and how to secure them

This module answers the question:
“How do we secure the actual devices employees use every day?”