Cybersecurity Practice #2: Endpoint Protection Systems (medium/large)

Endpoints are the assets the workforce uses to interface with an organization’s digital ecosystem. Endpoints include desktops, laptops, workstations, and mobile devices. Current cyberattacks target endpoints as frequently as networks. Implementing baseline security measures on these assets provides a critical layer of threat management. As the modern workforce becomes increasingly mobile, it is essential for these assets to interface and function securely.

The endpoints of which our computing environments largely consist are no longer static devices that exist in the health care organization’s main network. Organizations commonly leverage virtual teams, mobility, and other remote access methods to complete work. In some cases, endpoints rarely make it to the corporate network. It is important to build cybersecurity hygiene practices with these characteristics in mind.⁸

Sub-Practices for Medium-Sized Organizations

Table 2 describes basic endpoint controls with practices to implement and maintain them.

Table 2. Basic Endpoint Controls to Mitigate Risk at Endpoints

Organizations should reference Cybersecurity Practice #5: IT Asset Management to determine whether their endpoints meet IT asset management (ITAM) requirements. Examples include maintaining a proper inventory of endpoints, reimaging endpoints as they are redeployed, and securely removing endpoints from circulation when decommissioned.

Lastly, ensure that you train your workforce on the need to report any lost or stolen endpoints to your cybersecurity department. Reporting should occur promptly so cybersecurity departments can execute the proper incident response procedures, outlined in Cybersecurity Practice #8: Security Operations Center and Incident Response.

Sub-Practices for Large Organizations

It is challenging to manage thousands of endpoints consistently, especially when endpoint provisioning processes are manually executed. Most organizations do not have the necessary resources to run such an operation.

Value-added resellers (VARs) that sell endpoints through your supply chain can preconfigure endpoints before delivering them to your enterprise. To implement preconfiguring, the organization must build a “gold image,” with a series of checklists and configuration procedures, and provide it to the V!R/ This approach helps to ensure a consistent and resilient deployment of endpoints.

In some cases, vendors provide the ability for an organization to provision devices centrally. For example, Apple provides this service for its devices through its Device Enrollment Program (DEP). The DEP enables an organization to simplify enrollment and endpoint security management. The organization enters the serial number or order number of the new device in the DEP, initiating a series of device configuration tasks that are specific to your organization’s requirements. Further information is available in !ppl e’s DEP Guide.¹⁰

Mobile devices, such as smartphones and tablets, present their own management challenges. Multiple security configuration options exist for these devices, and organizations should configure the devices consistently to comply with organizational security policies.¹¹

Mobile device management (MDM) technologies manage the configuration of devices connected to the MDM system. In addition to configuration management, they may offer application management and containerization. All three are important to consider, especially for organizations that allow the use of personal devices in business operations.

Because most mobile devices travel on and off the organization’s network, it is important to consider cloud-based MDM systems to enable consistent check-in. If cloud-based systems are not available, then the onsite MDM systems must be accessible over the internet through virtual private network (VPN) connectivity or in the organization’s demilitarized zone (DMZ). The following paragraphs further describe the capabilities of MDM systems.

• Configuration management: At minimum, ensure that passcodes are in place and encryption is enabled. Ensure that each device locks automatically after a predefined duration (perhaps 1 minute). Implement device wipe functions after a series of unsuccessful logins (consider 10 unsuccessful logins). Limit the amount of time that an e-mail can reside on the mobile device (consider 30 days maximum). Consider leveraging an “Always on VPN” to protect the device when users connect to unsecured wireless networks. Consider prohibiting the installation of unsigned applications.
• Application management: Malicious applications reside in app stores and may appear to be legitimate, such as PDF readers or Netflix apps, when they really contain malicious code that provides access to data elsewhere on the mobile device. MDM solutions use whitelisting or blacklisting techniques to limit the installation of these malicious applications. Consider both, especially for devices that run on the Android platform, which is an open platform that accepts a wide range of applications.
• Containerization: Organizations with BYOD policies should consider containerization technologies. These technologies segment and process business data on a mobile device separately from personal data. Containerized business applications exist only in a hardened container on the mobile device. Examples of such business applications include e-mail, calendaring, and data repositories. Containerization allows the organization to wipe the container and clear business data from the device when the workforce member leaves or changes position in the organization. It also limits the risk that personally downloaded malicious applications will access business data.

Host-based intrusion detection systems (HIDS) and host-based prevention systems (HIPS) use an intrusion protection method like that used by network-based intrusion detection and prevention systems. Deploy these technologies on endpoints to detect patterns of attacks launched against those endpoints. These attacks can originate at the endpoint’s network, or through client-side attacks that occur when using e-mail or browsing the web.

HIDS and HIPS technologies are usually deployed and managed through central endpoint management systems used to manage endpoint software and patching. Configure them to auto-update against their command servers. The command servers should be configured to regularly download fresh signatures of attack indicators.

Endpoint detection and response (EDR) technologies bridge the gap between execution and processing that occurs in an organization’s fleet of endpoints. These agent-based technologies allow cybersecurity departments to query large fleets of endpoints for suspicious running processes, file actions, and other irregular activities.

EDR enables large-scale response to malware outbreaks. If malware is installed in the organization’s environment, cybersecurity professionals can “reach in and remove” the malware from thousands of devices using a single action. Finally, EDR technologies provide cybersecurity departments with forensic capabilities that supplement incident response (IR) processes.

Application whitelisting technologies permit only applications that are known and authorized to run, rather than identifying applications that not permitted to run. They are based on the assumption that it is impossible to identify and blacklist, or block, every malicious application.

Organizations should maintain a current inventory of all software on endpoints to facilitate complete and consistent maintenance and patching to protect against client-side attacks.¹²

Configuration of application whitelisting is complex and outside of the scope of this guide. Interested organizations should read NIST Special Publication 800-167: Guide to Application Whitelisting.¹³

Technologies called micro-virtualization or micro-segmentation assume that the endpoint will function in a hostile environment. These technologies work by preventing malicious code from operating outside of its own operating environment. The concept is that every task executed on an endpoint (e.g., click on a URL, open a file) can run in its own sandboxed environment, thus prohibiting the task from interoperating between multiple sandboxed environments.

Since most malware is installed by launching incremental processes after gaining an initial foothold, this strategy can be effective at eliminating that second launch. Additionally, once the malicious task has completed, the microenvironment is torn down and reset. Further configuration advice is specific to the microenvironment technology deployed.

Threats Mitigated

1. Ransomware attacks
2. Loss or theft of equipment or data

Suggested Metrics