Endpoint Policy, Inventory, Backups, Compliance and BYOD

What it is

Checking that endpoints meet policy means proving that every device is known, configured correctly and protected.

A security policy is a written set of rules for how devices and data must be handled. A standard describes the exact settings that meet the policy.

You cannot protect what you do not know about, so this work starts with inventory and continues with deployment, backups, regulations and personal devices.

How it works

Each activity closes a gap that attackers or auditors would otherwise find.

Hardware and software inventory

Hardware inventory, also called asset management, is a list of every device the organisation owns. Each entry records items such as the owner, location, model, serial number and operating system version.

Software inventory is a list of the programs installed on each device, with their versions and licences.

Inventory matters because:

• an unknown device cannot be patched or monitored
• old or unauthorised software is a common source of vulnerabilities
• lost or stolen devices can be identified quickly
• audits ask for proof of what is in use

Tools can scan the network and build the lists automatically, which is better than a spreadsheet kept by hand.

Program deployment and configuration

Program deployment means installing and updating software on many devices in a controlled way, using a management tool instead of leaving each user to do it. This keeps versions the same and removes unapproved software.

Configuration management keeps devices set up to an approved standard. A common approach uses a baseline configuration, which is a known good set of settings. Tools then check each device against the baseline and report any drift.

Data backups

A backup is a copy of data kept so that it can be restored after loss, damage or an attack such as ransomware.

A popular guide is the 3-2-1 rule. Keep three copies of the data, on two different kinds of media, with one copy stored away from the main site.

Backups must be tested by restoring them, because an untested backup may fail when needed. They should also be encrypted and protected from attackers.

Regulatory compliance

Some laws and standards set rules for how certain data must be protected. Breaking them can lead to fines.

PCI DSS is an industry standard set by the payment card companies, while HIPAA and GDPR are laws. Compliance usually needs access control, encryption, logging, regular updates and proof of all of these. Inventory helps because you must know where the regulated data lives.

BYOD

BYOD (bring your own device) lets staff use personal phones, tablets or laptops for work. It is convenient and cheaper, but it brings less controlled devices onto the network.

Common controls are:

• device management, often through mobile device management (MDM) software, to enrol devices, enforce a passcode and wipe company data if the device is lost
• data encryption, so company data stays unreadable if the device is stolen
• app distribution, which provides approved company apps from a managed source
• configuration management, to require settings such as screen lock and an up to date operating system

A clear BYOD policy explains what the company can see and wipe, and what users must do. Many designs keep work data in a separate protected area on the device, apart from personal data.