Chapter 19 — Endpoint protection
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 What it does"]
N2["19.2 Coverage"]
N3["19.3 Responding to alerts"]
N4["19.4 Attack surface rules"]
N5["Linux integrity checks"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 What it does"]
N2["19.2 Coverage"]
N3["19.3 Responding to alerts"]
N4["19.4 Attack surface rules"]
N5["Linux integrity checks"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 What it does]
|
v
[19.2 Coverage]
|
v
[19.3 Responding to alerts]
|
v
[19.4 Attack surface rules]
|
v
[Linux integrity checks]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) describe endpoint protection features; (2) check coverage; (3) respond to alerts.
19.1 What it does
Endpoint protection software scans files, watches behaviour and blocks known malicious programs. Microsoft Defender Antivirus is built into Windows; the trust also uses its cloud console to see alerts across laptops. On Linux servers, the main protections are minimal services, updates and file integrity checks rather than antivirus.
For the trust, the console's value is seeing ninety laptops in one place rather than learning about a problem when a teacher phones. The Linux servers rely on fewer, more predictable programs, so a change to one of their files is a clearer signal than any antivirus alert would be.
19.2 Coverage
Protection only helps where it is running. Tomás compares the endpoint console's device list with the inventory and finds three laptops not reporting: two were rebuilt and never onboarded, and one has protection turned off by a teacher who thought it slowed their laptop. All three are fixed, and tamper protection is enabled so staff cannot turn it off.
The comparison only works because the inventory had been reconciled first; against the old directory list, the twelve stale entries would have hidden the missing laptops. Tamper protection also stops malware that gains administrator rights from simply switching protection off.
19.3 Responding to alerts
Most alerts are routine: a blocked download or an unwanted toolbar. Dev handles them through the console. For alerts suggesting more, such as protection being disabled or a suspicious script, he isolates the laptop from the network through the console and contacts the outside company.
Isolation through the console cuts the laptop off from everything except the console itself, so the outside company can still examine it remotely without anyone travelling to the school. Dev records each isolation with the time and reason, and releases the laptop only after the cause is understood.
19.4 Attack surface rules
Defender includes attack surface reduction rules that block risky behaviours, such as office documents launching other programs. Dev turns them on in audit mode first, reviews what would be blocked for two weeks, then enforces the rules that cause no problems.
Two weeks covers a full timetable cycle, so lessons that happen only once a fortnight still appear in the audit results. Rules with no hits are enforced first, and rules with hits are examined one at a time, which leads to the signed macro decision in the worked example.
Linux integrity checks
On Linux servers the main protections are minimal services, updates and noticing unexpected change. The package manager can verify installed files against the checksums recorded in its packages, which shows when a system binary or configuration file has been altered. Dev runs this verification weekly as a read-only check. Most differences are explained by deliberate configuration edits already recorded in the change log; anything not explained is investigated. Tomás learns to read the output: a changed configuration file is usually expected, while a changed program file is unusual and worth a closer look. This gives the servers a simple integrity check without new tools.
Worked example
Audit mode shows one rule would block a teachers' assessment macro; the macro is signed by the provider, so Dev allows signed macros and enforces the rest.
Synthetic case. Events are synthetic.
Errors and limits
Turning on blocking rules without audit can stop legitimate teaching tools.
Exercises
- EX055 — Coverage gap. Why compare the protection console with the inventory? Rubric: 3 = find devices without protection;; 2 = coverage;; 1 = vague;; 0 = none.
- EX056 — Tamper protection. What does tamper protection prevent? Rubric: 3 = users or malware turning off protection;; 2 = disabling;; 1 = vague;; 0 = none.
- EX057 — Audit before enforce. Explain why rules start in audit mode. Rubric: 3 = see impact before blocking;; 2 = safer;; 1 = vague;; 0 = none.
Synthesis
Endpoint protection must be present everywhere, tamper-resistant and tuned through audit.
Continue studying — chapter 19 of 30
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →