Endpoint Security

What is an endpoint?

An endpoint is any device at the edge of the network that people or processes use to do work: laptops and desktops, servers (physical and virtual), smartphones and tablets, and increasingly Internet of Things (IoT) devices such as printers, cameras, badge readers and industrial terminals. Endpoints are where users read email and open files, where data is stored and processed, and where attackers want to run their code — which makes them the most common starting point of an attack.

What threatens endpoints

• Malware arriving through email attachments, downloads or malicious websites (see Malware).
• Unpatched software — the operating system, browsers, office suites, PDF readers, virtual private network (VPN) clients.
• Weak configuration: unneeded services running, users with administrator rights, default settings.
• Stolen credentials used to log on remotely.
• Physical loss and theft of laptops and phones, and removable media carrying malware in or data out.

No single product addresses all of these. The rest of this page walks through the layers that, together, protect an endpoint — a practical application of defense in depth.

Antivirus, EDR and XDR

Antivirus software scans files and memory for known malware, mainly by comparing them with signatures (patterns of known malicious code), supplemented by heuristics. It is good at stopping the large volume of known threats, but it misses new or modified malware and attacks that use legitimate tools already on the system. Modern products, often called next-generation antivirus, add behavioral analysis and machine learning. Windows includes Microsoft Defender Antivirus.

Endpoint detection and response (EDR) goes further. An agent continuously records what happens on the device — processes started, files written, registry changes, network connections, logons — and sends that telemetry to a central console. There, behavioral rules spot suspicious chains of activity (an office document starting a script that downloads a file and contacts an unknown server), and analysts can investigate the full timeline. Crucially, EDR can also respond: isolate the device from the network while keeping its connection to the console, stop a process, quarantine a file, or collect evidence.

Extended detection and response (XDR) combines endpoint data with other sources — email, identity, cloud and network — and correlates them, so one attack shows up as one incident instead of alerts in five tools. Organizations without their own round-the-clock team often buy a managed detection and response (MDR) service, in which the provider watches and responds for them.

Hardening and security baselines

System hardening reduces a system's attack surface by removing or locking down everything it does not need. On Linux servers the practical steps are covered in Linux Security; the principles are the same everywhere:

• Uninstall unneeded software and disable unneeded services, ports and protocols (for example old file-sharing versions such as SMBv1).
• Change or disable default accounts and passwords.
• Enable the security features that are present but off: host firewall, logging and auditing, exploit protection, screen lock.
• Apply least privilege: users work with standard accounts (see Users and Permissions).

Security baselines

Deciding hundreds of settings one by one is error-prone, so organizations start from a published security baseline: a documented set of recommended configuration settings that every system of a given type must meet. Well-known sources are the CIS Benchmarks from the Center for Internet Security (consensus guides per operating system and application, with a basic Level 1 and a stricter Level 2) and the Microsoft security baselines for Windows, Edge and Microsoft 365, which can be applied with Group Policy or Intune. The baseline is then adjusted to the organization, deviations are documented, and compliance is checked continuously — a baseline that is applied once and never verified drifts within months.

Removing local admin rights

A user who works as a local administrator gives any malware they run the same power: it can disable protection, install drivers and harvest credentials. Removing everyday admin rights is one of the most effective endpoint controls there is. Users get a standard account; software is installed through a company portal; and support staff use separate admin accounts only when needed. For the built-in local administrator account, Windows LAPS (Local Administrator Password Solution) gives every device a unique, regularly rotated password, so one leaked password does not open every machine.

Patching

Most successful attacks on endpoints use vulnerabilities for which a patch already exists. Keeping operating systems, browsers and applications updated is therefore basic hygiene: how Windows, macOS and Linux deliver updates is explained in Updates and Patches, and how to find, prioritize and track vulnerabilities across the whole estate in Vulnerability Management.

For endpoints in particular: patch third-party applications as well as the operating system, set deadlines after which updates install automatically, report on devices that have not checked in, and replace systems whose operating system is out of support. Firmware (BIOS/UEFI) and drivers need updates too.

Full-disk encryption and boot integrity

Full-disk encryption (FDE) encrypts the entire storage volume, so the data is unreadable without the key — even if someone removes the drive and connects it to another computer. It is the main protection for data on lost or stolen laptops:

• BitLocker on Windows (Pro, Enterprise and Education; many devices running Windows Home have a simplified "device encryption").
• FileVault on macOS (see macOS Essentials).
• LUKS (Linux Unified Key Setup) on Linux.
• Current iPhones and Android phones encrypt storage by default when a passcode is set.

Encryption is only as good as the handling of its keys. Every encrypted device has a recovery key for when the normal unlock fails — after a firmware update, a motherboard replacement or a forgotten PIN. Organizations escrow these keys centrally (in Active Directory, Microsoft Entra ID, or the mobile device management (MDM) platform), so the service desk can help users after verifying who they are. A recovery key printed and kept in the laptop bag defeats the purpose.

Secure Boot and the TPM

Secure Boot lets UEFI firmware start only boot loaders signed by trusted keys, which blocks malware that tries to load before the operating system (bootkits). The Trusted Platform Module (TPM) is a security chip that stores keys and measures the boot process; BitLocker uses it to release the disk key automatically only when the boot chain has not been tampered with. Both are explained in BIOS, UEFI and Boot. Windows 11 requires TPM 2.0 for exactly these reasons.

Application control

There are two ways to decide which programs may run:

• Blocklisting (deny-listing): everything may run except what is known to be bad. This is what antivirus does. It is easy to manage but always one step behind new threats.
• Application allowlisting: only approved software may run; everything else is blocked by default. Rules usually identify software by its publisher's code-signing certificate, by file hash, or by location. It stops most malware outright, including new variants, because they are simply not on the list.

On Windows, allowlisting is done with AppLocker or Windows Defender Application Control (WDAC) — at the time of writing, Microsoft calls the latter App Control for Business. macOS's Gatekeeper enforces a lighter form, checking that apps are signed and notarized (see Gatekeeper). Allowlisting needs upkeep — every new tool and update must fit the rules — so it is often introduced first in audit mode, then enforced on fixed-function systems such as kiosks, point-of-sale terminals and operator workstations in industrial environments, where the set of software rarely changes.

Firewalls, removable media and mobile devices

Host firewalls

A host firewall filters traffic on the device itself, which still protects a laptop on hotel Wi-Fi, and blocks lateral movement between workstations inside the office: a normal workstation has no reason to accept file-sharing or Remote Desktop connections from other workstations. Windows has a built-in firewall managed through Group Policy or MDM; for Linux see host firewalls on Linux. Network firewalls are covered in Network Security Basics.

USB and removable media control

USB drives can bring malware in and carry data out, and a device that looks like a USB stick can pretend to be a keyboard. Endpoint management and EDR tools can block USB mass storage entirely, allow only company-issued encrypted drives, or make removable media read-only, while still allowing keyboards, mice and headsets. AutoRun for removable media should be off.

Mobile device management

Phones and tablets are managed with MDM or a broader unified endpoint management platform: enforcing a passcode and encryption, installing and configuring apps, separating work data from personal data on personally owned devices (bring your own device, BYOD), and locking or wiping a device remotely. The details are in Mobile Operating Systems. Many organizations combine MDM with conditional access: only devices that are managed and compliant may open company email and data.

Checking endpoints against the baseline

Management platforms report, per device, whether it meets the baseline. The logic behind such a report is simple. This script checks a few fake endpoint records against four rules from a fictional baseline: disk encrypted, EDR agent running, patched in the last 30 days, and no extra local administrators:

endpoints = [
    {"host": "LT-0142", "encrypted": True, "edr_running": True,
     "days_since_patch": 9, "local_admins": []},
    {"host": "LT-0157", "encrypted": False, "edr_running": True,
     "days_since_patch": 12, "local_admins": []},
    {"host": "PC-0033", "encrypted": True, "edr_running": False,
     "days_since_patch": 47, "local_admins": ["j.smit"]},
    {"host": "SRV-FILE01", "encrypted": True, "edr_running": True,
     "days_since_patch": 21, "local_admins": []},
]

MAX_PATCH_AGE = 30  # days, from the (fictional) security baseline


def problems(ep):
    found = []
    if not ep["encrypted"]:
        found.append("disk not encrypted")
    if not ep["edr_running"]:
        found.append("EDR agent not running")
    if ep["days_since_patch"] > MAX_PATCH_AGE:
        found.append(f"last patched {ep['days_since_patch']} days ago")
    if ep["local_admins"]:
        found.append("extra local admins: " + ", ".join(ep["local_admins"]))
    return found


compliant = 0
for ep in endpoints:
    found = problems(ep)
    if found:
        print(f"{ep['host']:<11} FAIL  " + "; ".join(found))
    else:
        compliant += 1
        print(f"{ep['host']:<11} ok")

print(f"{compliant} of {len(endpoints)} endpoints compliant "
      f"({compliant / len(endpoints):.0%})")

LT-0142     ok
LT-0157     FAIL  disk not encrypted
PC-0033     FAIL  EDR agent not running; last patched 47 days ago; extra local admins: j.smit
SRV-FILE01  ok
2 of 4 endpoints compliant (50%)

Collecting all problems per device, instead of stopping at the first, gives the person fixing it the full picture. PC-0033 deserves attention first: an EDR agent that stopped, a stale patch level and an unexpected admin together can mean someone has tampered with the device, not just neglect. Treat it as a possible incident until you know otherwise.

When a device is lost or stolen

Losing a laptop or phone happens to everyone eventually. What matters is a fast, calm, practiced procedure:

1. Report immediately to the service desk or security team — at any hour. Make sure users know that reporting quickly is what counts, and that they will not be blamed for it.
2. Lock or wipe remotely through MDM or the endpoint management platform, and mark the device as lost.
3. Cut off access: reset the user's password, revoke active sessions and tokens, and remove the device from trusted devices and MFA registrations.
4. Check the protection: was the disk encrypted, and was the recovery key stored centrally rather than with the device? The management console usually shows the last reported state.
5. Assess the data: if personal data may have been exposed — for instance because the device was not encrypted — involve the privacy officer at once. Under the General Data Protection Regulation (GDPR) (in Dutch: AVG), a personal data breach must normally be reported to the supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people (see Privacy and Data Protection).
6. Record and follow up: a police report for theft, an update to the asset inventory, and a replacement device built from the standard image.

A strong encryption policy turns most of these events from a potential data breach into an inconvenience — which is the best argument for enforcing it on every device.