Skip to content
academia.sh
tr
Log in

Course Intermediate

Endpoint and System Hardening

Published Updated

By the end of this course

Start course

01

Hardening

Counting the items that run automatically on the endpoint: the foothold point a default install leaves behind, the point that removing an unnecessary item closes, the window a patch leaves open, the benchmark items that cannot be applied, the legitimate work an application allowlist blocks, the decision to run in a sandbox, and the item full disk encryption protects under physical access.

  1. 01 Hardening Principles The course sets its unit of measure: the 84 foothold points a default install leaves across four machine classes are counted, clearing unnecessary items closes 40 of them, 44 are only written to a baseline, and the legitimate-work cost of closing them comes out to 41 manual steps.
  2. 02 Patch Management The patch's measure is taken as the window: the days between announcement and application for 12 announcements across a fleet of 102 machines, the point-day equivalent of the 1038 foothold points left open in that window, the 939 unplanned outages the emergency path produces by skipping 36 of 48 test items, and the 12 points that never close under any regime.
  3. 03 Configuration Benchmarks The benchmark guide's 26 items are applied to four machine classes' baseline: 11 of 104 decisions are inapplicable in this environment, 42 are noncompliant, the compliance ratio gives two different numbers with two different denominators, and applying every item narrows the write authority of 588 points while dropping 48 legitimate tasks to a manual step.
  4. 04 Application Allowlists The allowlist is evaluated against a 25-item run set: the path-based and signature-based rule miss the same number but different items, the combination form raises the wrong block from 1 to 7 items, and 972 of the fleet's 1038 foothold points become unable to run unapproved code while 66 stay open.
  5. 05 Sandbox Usage The sandbox is measured as a run decision: 15 of 18 suspicious items can run in isolation, four configurations raise observed behavior from 23 to 33, 5 items cannot be decided in any configuration, wrong allow and wrong block never change in any configuration, and closed foothold points are zero on every row.
  6. 06 Disk Encryption The item readable via physical access is compared on an unencrypted and an encrypted disk: 15 of 18 items are protected while the machine is off, encryption's contribution is zero in the other three states, 936 of the fleet's 1038 point definitions close against the offline write path, and the cost is 204 key copies plus 14,112 minutes a year of manual intervention.

02

Endpoint Protection

How many foothold points the protection layers close once code has run on the endpoint, and how many they only make visible: the spread and persistence behavior of malware types, the false positive and miss balance of signature and behavior-based detection over the same event set, the conflict between the visibility scope and the retention window of endpoint detection and response telemetry, how end-to-end traffic the perimeter rule never sees is closed by host-based filtering, how abuse of built-in and signed binaries lowers signature-based detection, and the split of the persistence mechanism inventory between what each audit closes and what it only logs.

  1. 01 Malware Types Ten types are classified by spread mode and the foothold point each uses: the number of points per type, the two types that never establish persistence, the number of types using each point type alongside the legitimate item count at that same point, and the number of types that stop fully, stop partially, or stay unaffected when point types are closed cheapest first.
  2. 02 Anti-Malware Software Twenty execution items are evaluated in the same set with two detection types: the items signature-based detection catches, misses, and falsely flags; the threshold scan of the behavior score derived from six indicators; how the missed count falls and the false positive count rises as the threshold drops; and the foothold point closed in block mode together with the legitimate work it cuts, versus the same point only made visible in alert mode.
  3. 03 Endpoint Detection and Response Seven telemetry sources are measured against eight foothold point types: which point appears in which source, the two point types that appear in no source, the two sources that see no point type, how the visible point count stalls at six as sources are added in order of point gain per volume, how the daily volume shrinks the retention window from 6,657 days to 19.5 days, and the detections that do not fit inside the window.
  4. 04 Host-Based Firewall and Prevention In a 432-endpoint model, 729,252 connection paths are counted and the 290,772 intra-zone paths the zone-boundary rule never sees at all are separated out: the paths a twelve-item host-based allowlist closes, the peer-to-peer traffic it has to leave open, the two legitimate flows it cuts because they were never written into the list, the way a denied path lands in the record, and the number of endpoints reachable in a single hop from a compromised endpoint.
  5. 05 Living Off the Land The overlap of fourteen built-in, signed tools across seven capability classes is counted: an average of 3.4 tools carrying the same capability, three signature rules flagging zero of twenty-four runs, and three context dimensions — parent process, command pattern, timing — evaluated singly, combined, and intersected; five of six suspicious runs are separated out, one is identical in four dimensions to a legitimate run.
  6. 06 Persistence Mechanisms Ten persistence point types are counted as an inventory and six controls run across four endpoint classes: how many types each control closes, how many it only makes visible, which control cannot be applied in which endpoint class; the number of types closed in all four classes is zero, the number of types no control touches is one, and the cost of closing is 36 blocked legitimate items plus 52 manual-review items.

03

System Logs

Which foothold point each endpoint log source sees, the events a threshold choice misses and the ones it raises needlessly in failed login patterns, the process tree extracted from process creation logs, and detecting a chain break in a tampered log set.

  1. 01 Event Logs In a fictional endpoint fleet, twelve foothold point types are measured against seven log sources: under the default configuration, 932 of 3,078 (machine, type) pairs are visible by name and 1,092 are in no source at all; once every source is opened, the visible-by-name count rises to 2,356, 250 pairs stay blind, and the cost is 10.2 million extra records a day plus 5 configuration items per role profile.
  2. 02 Authentication Logs A one-day, 1,168-line fictional authentication log set is parsed and six failure clusters are measured against threshold rules: the per-account threshold misses 206 of 216 campaign events, produces 5 false positives, and blocks 9 legitimate logins; opening the window to 24 hours catches both campaigns but locks out 70 accounts and cuts off 49 legitimate logins. Because the spray never makes more than 2 attempts per account, it is invisible at any threshold; a rule that counts along the zone axis separates it out, because the largest legitimate bulk failure stays at 62 accounts.
  3. 03 Command-Line Auditing In a 5,110-record process creation sample, a rule that looks only at the child process name flags 1,702 records; parent-process context brings the same set down to 40 records and 9 pairs, and a new-and-sparse criterion separates out all five suspicious items along with one legitimate addition. Three of the five items have no trace in any other source. Across the fleet the record runs to 10.18 million lines and 4.55 GiB a day; keeping only non-baseline pairs divides the volume by 128 but leaves three of four investigation questions unanswered.
  4. 04 Log Integrity A 1,200-record log chain is tested against four tampering forms: deletion is caught at sequence 744 with an 11-sequence gap, a digest-refreshed change is caught at sequence 839, only the sequence gap remains once the chain is recomputed, and local verification says clean once the sequence is reissued too. The central copy shows 0 of 13 tampered records with daily transfer, 11 with hourly transfer, and 13 with five-second transfer; across the fleet the window never closes at any interval, because 130 machines stay offline.

Final exam

Endpoint and System Hardening — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close