3Endpoint Security Concepts

• 3.1Operating system security concepts

  Covers the defenses common to the major operating systems—Windows/macOS/Linux—namely Windows Defender and the host-based firewall, the CLI and PowerShell, file/directory permissions, and the privilege escalation attackers aim for, as the foundation for judging "is this endpoint properly protected?"

• 3.2Endpoint security assessment tools

  Covers three staple tools for examining an endpoint's state—netstat to see connections and listening ports, nslookup to check name resolution, and tcpdump to capture actual packets—as the foundation for telling "which tool confirms this suspicious symptom."

• 3.3Verifying policy and standards compliance

  Covers the operations that keep endpoints "as agreed"—asset management (hardware/software inventory), program distribution, data backup, regulatory compliance (PCI DSS/HIPAA/GDPR), and BYOD for personal devices—as the foundation for judging "does this device meet the standard?"

• 3.4Applying updates, logs, and malware response

  Covers the operations that keep an endpoint healthy and notice anomalies—applying patches via Windows Update and to apps/drivers/firmware, interpreting logs with Event Viewer and syslog to spot anomalies, and the removal procedure when malware is found (scan, check logs, remediate)—as the foundation for judging "are updates applied?" and "what in this log is abnormal?"