Endpoint and Operating System Security

Overview

Endpoints are where most attacks land: a phishing click, a malicious document, a stolen laptop. Endpoint and operating system security is about making each device hard to compromise and quick to detect when it is.

The work spans hardening (safe configuration, patching, removing what is not needed), protection (anti-malware, EDR, application control) and the built-in security of Windows, Linux and macOS. Done well, it stops whole classes of attack before any detection is needed.

Why it matters

A single weak laptop can be the start of a company-wide breach. Endpoint skills are needed in every organisation, and they are the foundation that detection and response build on.

Typical job roles

• EntryEndpoint administrator Deploys and maintains endpoint protection and patches.
• Mid-levelEndpoint security engineer Hardens systems, tunes EDR and builds secure baselines.
• Mid-levelPlatform security engineer Owns the secure configuration of Windows, Linux or macOS fleets.
• SeniorSenior endpoint security engineer Designs endpoint defence across the organisation.
• LeadHead of endpoint security Sets endpoint strategy, standards and tooling.

Prerequisites

• Comfortable administering Windows and Linux.
• Networking basics.
• Command line and some scripting (PowerShell, Bash).
• A basic idea of how malware and attacks work.

Foundations of computer science Cybersecurity

Tools and technologies

• Microsoft Defender for Endpoint Commercial Widely used EDR with a strong free documentation set.
• Wazuh Open source Open-source HIDS, EDR and compliance monitoring.
• osquery Open source Query endpoint state with SQL.
• CIS-CAT Pro Commercial Checks systems against CIS Benchmarks (a free Lite edition exists).
• Velociraptor Open source Endpoint visibility and collection.
• Lynis Open source Security auditing and hardening checks for Linux.

Certifications

Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.

1. Entry Security+ CompTIAA common baseline.Cost and exam details
2. Intermediate Security Operations Analyst Associate (SC-200) MicrosoftOperations with Microsoft Defender for Endpoint.Cost and exam details
3. Intermediate GIAC Certified Windows Security Administrator (GCWN) GIACWindows and Active Directory hardening.

Resources

• CIS Benchmarks DocsFreeCenter for Internet Security
• Windows security documentation DocsFreeMicrosoft
• Apple Platform Security DocsFreeApple
• Lynis ToolFreeCISOfy
• NIST SP 800-40 Rev. 4 DocsFreeNIST
• ANSSI hardening guides DocsFreeANSSI (France)

Frameworks and standards

• CIS Benchmarks Free, consensus hardening guides for operating systems, cloud accounts, network devices and software.
• CIS Critical Security Controls A prioritised list of 18 practical defences, grouped so smaller organisations know what to do first.
• NIST Cybersecurity Framework (CSF) 2.0 A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
• MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
• NIST SP 800-207 Zero Trust Architecture Defines zero trust: never trust a request because of where it comes from, check identity and context every time.

All frameworks and standards

Career path

A common progression. Titles vary between companies.

1. IT support or system administrator0–2 years
2. Endpoint administrator1–3 years
3. Endpoint security engineer3–6 years
4. Senior endpoint security engineer6–9 years
5. Head of endpoint security10+ years

Related domains to move into

• Security Operations (SecOps) Endpoint telemetry feeds the SOC.
• Detection Engineering Hardening and detection work together.
• Digital Forensics and Incident Response (DFIR) Endpoints are where most investigations happen.
• Infrastructure Hardening and Configuration The same ideas applied to servers and infrastructure.