Chapter 1 — What endpoint security covers
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 How endpoints get weakened"]
N3["1.3 What started the placement"]
N4["1.4 The shape of the course"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 How endpoints get weakened"]
N3["1.3 What started the placement"]
N4["1.4 The shape of the course"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 How endpoints get weakened]
|
v
[1.3 What started the placement]
|
v
[1.4 The shape of the course]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) describe the endpoints a small organisation runs; (2) explain the main ways they are weakened; (3) introduce the course case.
1.1 The case
Tomás Herrera studies on the three-year technologist programme at the fictional Granite Coast College, guided by his instructor Renée Okafor. His work placement is with the fictional Linden Schools Trust, which runs two primary schools. The trust has about ninety staff laptops, a set of classroom devices managed by the schools, and six servers: two directory servers, a file server, a print server, a small web server for the trust's intranet and a server running the management information system that stores pupil records. One part-time IT technician, Dev Malik, looks after all of it with help from an outside company for big projects.
1.2 How endpoints get weakened
Most problems on endpoints come from a few ordinary causes rather than clever attacks. Software is left without updates. Settings are weaker than they should be, often because a default was never changed. Accounts stay active after people leave. Too many people have administrator rights. Backups are assumed rather than checked. CIS Controls v8 is built around exactly these basics: know your assets, configure them securely, manage accounts and access, patch, and be able to recover.
At Linden the supply teacher's account was the second cause made visible, and Tomás expects the other four causes to be present somewhere among ninety laptops and six servers.
1.3 What started the placement
Shortly before Tomás arrived, Dev noticed that a supply teacher who had left months earlier could still sign in to the trust's systems. Nothing bad had happened, but it raised a question nobody could answer quickly: how many other accounts, settings and backups were not as everyone assumed? The trust asked the college for a student who could help find out, carefully and without disrupting teaching.
Dev could not say how many laptops were encrypted or when mis01 last had a good backup, because nobody had ever looked across all the devices at once. The placement agreement therefore asked Tomás to measure first and change only what Dev and the business manager approved.
1.4 The shape of the course
The first part of this book builds foundations: hardware, operating systems, Linux and Windows administration, networks, accounts and scripting. The middle part applies them to hardening, patching, account hygiene, backups, logging and monitoring at the trust. The final part is Tomás's placement project, in which he measures the starting point, makes agreed improvements and reports the result.
Each chapter follows the same pattern: a few short teaching parts, one worked example from the trust, the errors and limits, and three exercises with rubrics. Three chapters contain small Python labs on synthetic exports, and their numbers return later when Tomás measures the trust at the start and end of his placement.
Worked example
Tomás lists the trust's endpoints on one page: 90 laptops, the classroom devices, six named servers, and the outside company's remote access. Beside each he writes who looks after it. This simple list already shows that nobody owns the classroom devices clearly.
Synthetic case. Linden Schools Trust, Granite Coast College and all people and figures in this book are fictional; data are synthetic.
Errors and limits
It is tempting to start with advanced tools. For a small organisation, the basics in CIS Controls v8 implementation group 1 prevent far more harm.
Exercises
- EX001 — Ordinary causes. List four ordinary ways endpoints become weak. Rubric: 3 = four distinct causes with an example each;; 2 = four causes;; 1 = fewer than four;; 0 = none.
- EX002 — Ownership gaps. Why does the one-page list of endpoints and owners matter? Rubric: 3 = links ownership to responsibility and finds the classroom gap;; 2 = says it is useful;; 1 = no reason;; 0 = none.
- EX003 — Starting point. A manager asks why the trust should not buy an advanced detection tool first. Answer in two sentences. Rubric: 3 = explains basics prevent more harm and reference to CIS IG1;; 2 = mentions basics;; 1 = no answer;; 0 = none.
Synthesis
Endpoint security in a small organisation is mostly about doing ordinary things reliably: knowing, configuring, updating, controlling access and recovering.