Cybersecurity Hardening and EDR Capabilities for Endpoint Security

System hardening

The process of applying best practices to an operating system or device to reduce its attack surface and improve security, including patching, password policy, access limits, and encryption

Password policy (hardening)

A set of enforced rules for account passwords, such as minimum length and complexity requirements including uppercase, lowercase, numbers, and special characters

EDR (Endpoint Detection and Response)

Next-generation endpoint security software that goes beyond signature-based detection, using behavioral analysis, machine learning, and process monitoring to identify and autonomously respond to threats

EDR behavioral analysis

An EDR capability that watches user and application activity to identify malicious behavior even when no known signature exists for that threat

EDR machine learning

An EDR capability that uses machine learning models to rapidly identify malware and malicious software patterns

EDR process monitoring

An EDR capability that continuously watches all running processes on a system, flagging newly started or unexpected processes for further scrutiny

EDR root-cause analysis

An EDR capability where, after flagging suspicious activity, the system performs further investigation to determine whether the process is genuinely malicious or legitimate

EDR autonomous response

An EDR capability allowing the system to immediately isolate a device, quarantine a threat, and roll back to a previous configuration without waiting for human intervention, often automated via API

Host-based firewall

A software firewall running on an individual operating system that allows or blocks inbound and outbound traffic, with visibility into data before or after encryption since it runs locally on the device

Host-based Intrusion Prevention System (HIPS)

An intrusion prevention system running on an individual device, often built into EDR or anti-malware software, that watches inbound traffic and system changes such as buffer overflows, registry changes, or modified system files

Port security (hardening)

The practice of closing unnecessary open ports on a server or workstation to reduce the number of potential entry points available to an attacker

Nmap

A tool used to scan a system and identify which network ports are open, useful for auditing a device's exposed attack surface

Default configuration risk

The security risk posed by devices such as routers, switches, and firewalls that ship with default usernames and passwords on their management interfaces, which attackers can easily look up if not changed

MFA/centralized authentication (hardening)

Using multifactor authentication or a centralized, synchronized authentication system across network devices to reduce the risk posed by default or weak credentials on management interfaces

Application removal (hardening)

The practice of deleting unused applications from a system to reduce the number of programs requiring ongoing patching and monitoring, thereby shrinking the attack surface

Scenario: Security software on an endpoint detects a new, never-before-seen malware variant not by matching a known signature but by noticing the process is behaving unusually. What EDR capability does this describe?

EDR behavioral analysis

Scenario: After flagging a suspicious process, security software automatically investigates further, determines it is malicious, isolates the device, quarantines the threat, and rolls back the system configuration, all without a technician's involvement. What EDR capabilities does this describe?

EDR root-cause analysis combined with autonomous response

Scenario: A firewall running directly on a laptop's operating system is able to see data even after it has been decrypted locally, giving it visibility a network firewall would not have. What is this called?

Host-based firewall

Scenario: Software on a workstation detects a modification to a core Windows system file and blocks the responsible process, alerting the administrator. What type of security tool is this?

Host-based Intrusion Prevention System (HIPS)

Scenario: An administrator runs a scanning tool against a server to determine which ports are currently open and potentially exploitable. What tool is commonly used for this?

Nmap

Scenario: A newly installed router still has its factory-default admin username and password, which an attacker could easily look up online. What hardening steps address this risk?

Changing default credentials, and enabling MFA or centralized authentication

Scenario: An IT administrator reviews a workstation and deletes several old applications that are no longer used, reducing the number of programs that need ongoing patch management. What hardening practice is this?

Application removal