Chapter 16 — Endpoint protection
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Endpoint tools"]
N2["16.2 Alerts"]
N3["16.3 Software control"]
N4["16.4 Removable media"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Endpoint tools"]
N2["16.2 Alerts"]
N3["16.3 Software control"]
N4["16.4 Removable media"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 Endpoint tools]
|
v
[16.2 Alerts]
|
v
[16.3 Software control]
|
v
[16.4 Removable media]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) deploy endpoint protection tools; (2) respond to endpoint alerts; (3) control software installation.
16.1 Endpoint tools
Endpoint protection software detects and blocks malware and suspicious behaviour on computers. Riverbend uses one product, but Jamal finds it installed on only most workstations, with several reception computers missing it after a reinstallation. He compares the product's console list with the inventory and installs it on the missing machines. Ms. Grant notes that coverage gaps are common, and that checking coverage against the inventory should be a routine monthly task. He adds a monthly coverage comparison to his checklist and sends the IT manager the list of any missing machines.
16.2 Alerts
Jamal learns to review endpoint alerts. Most are low risk: blocked advertising software or suspicious downloads stopped automatically. One alert shows a script trying to run from a downloaded invoice attachment on a finance computer. The tool blocked it. Jamal checks whether anything else happened, finds nothing, and reports the attempt so the IT manager can warn staff. He learns to treat blocked attacks as signs that someone is targeting the organisation. The IT manager sends a short warning to finance staff describing the invoice email.
16.3 Software control
Staff sometimes install free tools, some of which carry unwanted software. Jamal recommends that only IT can install software, with a simple request form and a list of approved applications. He also recommends allowing only approved applications to run on till computers, which do one job. Ms. Grant explains that allow-listing is very effective on single-purpose machines, though harder on general office computers. The IT manager approves the request form and the approved list. On the tills, allow-listing is trialled at one centre and then rolled out to all nine without problems reported by staff.
16.4 Removable media
Malware can spread through memory sticks. Jamal configures endpoint protection to scan removable media automatically and blocks automatic running of programs from them. Combined with the earlier decision to issue encrypted Riverbend memory sticks, this reduces risk while keeping work possible. He documents the settings so they are applied to new computers. He tests the settings with a harmless test file on a memory stick in the laboratory and confirms that automatic running is blocked and the scan runs. The IT manager approves applying the settings to all Riverbend computers through the device management system, and Jamal checks a sample of computers a week later to confirm the settings arrived.
Worked example
Jamal fixes endpoint coverage gaps, investigates a blocked invoice script, restricts software installation, allow-lists till applications and scans removable media.
Synthetic case. Alerts are synthetic.
Errors and limits
Endpoint protection protects only the machines it is installed on.
Exercises
- EX046 — Coverage gap. Where was endpoint protection missing? Rubric: 3 = reception computers after reinstallation;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX047 — Finance alert. What did the finance alert show? Rubric: 3 = a script from an invoice attachment;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX048 — Allow-listing. Where is allow-listing most effective? Rubric: 3 = single-purpose machines like tills;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 16 (chapter 16 of 30)
← Chapter 15 · Course chapter index · Chapter 17 →
Continue to the next authored lesson.