Security Engineering · Topic 2 of 8
Endpoint and Server Hardening
Harden endpoints and servers with baselines, patching, least functionality, EDR, host firewalls, allow listing, disk encryption, SELinux and MDM.
- 5 min
- A baseline is the approved secure configuration, and drift is any unapproved change from it.
- Least functionality removes unneeded services, ports and software.
- EDR gives behavior detection, investigation and remote containment, XDR correlates more sources.
What it is
Hardening reduces the attack surface of a computer by removing what is not needed and tightening what remains. Endpoints (laptops, phones, workstations) and servers are the places where attackers run code and steal data, so they need layered controls.
The exam asks which control best fits a requirement, and what trade off it brings in usability, cost or operations.
How it works
Baselines and least functionality
A baseline is an approved secure configuration. Sources include vendor guidance, the Center for Internet Security (CIS) benchmarks, and the Defense Information Systems Agency Security Technical Implementation Guides (DISA STIGs). Build systems from a hardened image, then enforce settings centrally using configuration management and group policy, and watch for drift.
Least functionality means turning off unneeded services, ports, protocols, accounts and software. Change default credentials, remove sample content and disable legacy protocols. Each removed feature is one less thing to patch and exploit.
Patch and vulnerability management
Keep an inventory, scan regularly, and prioritize by severity, exposure and evidence of exploitation. Test patches on a pilot group and keep a rollback plan. Where a patch cannot be applied, use compensating controls such as isolation or virtual patching.
Endpoint protection
| Control | What it does |
|---|---|
| Antivirus (signature based) | Detects known malware; weak against new variants |
| Endpoint detection and response (EDR) | Records host activity, detects suspicious behavior, and lets analysts investigate and contain, for example isolating a host |
| Extended detection and response (XDR) | Correlates data from endpoints, network, email and cloud |
| Host based firewall | Filters traffic to and from one machine, limiting lateral movement |
| Host intrusion detection or prevention (HIDS or HIPS) | Watches for suspicious host activity, and HIPS can block it |
| Data loss prevention (DLP) agent | Controls copying and sending of sensitive data |
EDR is the standard answer when a scenario needs visibility into process behavior and the ability to respond remotely. It does not replace prevention, so combine it with the other layers.
Application control
Allow listing permits only approved software to run, which blocks unknown malware, and it is stronger than deny listing, which blocks only known bad items. It needs maintenance as software changes, and is best suited to fixed function systems such as servers and kiosks. Restrict scripting tools and remove local administrator rights from daily accounts.
Browser isolation
Browser isolation runs web content away from the endpoint so that malicious pages cannot reach the device. In remote isolation the page is opened in a disposable environment in the cloud or a data center, and the user receives only a safe rendering. In local isolation the browser runs in a sandbox or virtual machine on the endpoint.
It limits drive by downloads, malicious scripts and payloads from phishing links, even if the user clicks. It does not stop a user typing a password into a fake page unless the product also restricts input on untrusted sites.
Choose it for high risk users, uncategorized or untrusted sites, administrators and devices that are hard to patch. The costs are licensing, some latency and compatibility problems with certain web applications.
Encryption and boot protection
Full disk encryption protects data if a device is lost or stolen. Keys are best protected by hardware such as a Trusted Platform Module (TPM), covered on the hardware page. Secure boot checks that the boot software is trusted before the operating system loads.
Operating system access controls
On Linux, mandatory access control systems such as Security Enhanced Linux (SELinux) or AppArmor confine processes to defined rights even if they are compromised. Run services as dedicated, low privilege accounts. On Windows, use group policy to enforce settings and restrict credentials from being exposed to attackers.
Restrict remote administration to a hardened path, such as a jump server with multi factor authentication, and log all administrative sessions.
Mobile and unmanaged devices
Mobile device management (MDM) and unified endpoint management (UEM) enforce encryption, screen locks, patch levels and remote wipe, and can separate corporate from personal data. Bring your own device (BYOD) gives the user more control and the organization less, so use containerized work profiles or app level management. Devices that fail posture checks should be denied or quarantined.
Server specifics
Servers should run only their role, sit in the right network zone, use separate admin accounts, forward logs to a central point and have tested backups. Use immutable images for scalable fleets, replacing a host instead of repairing it.
What to remember for the exam
- A baseline is the approved secure configuration, and drift is any unapproved change from it.
- Least functionality removes unneeded services, ports and software.
- EDR gives behavior detection, investigation and remote containment, XDR correlates more sources.
- Allow listing is stronger than deny listing but needs upkeep.
- A host firewall limits lateral movement between machines.
- Full disk encryption protects lost devices, and TPM backed keys protect the keys.
- SELinux and AppArmor confine processes even if they are compromised.
- MDM or UEM enforce policy, encryption and remote wipe on mobile devices.
When a scenario describes a fixed function system, such as a kiosk or a database server, allow listing is usually the best application control.
Common mistakes
Relying on antivirus alone. Signatures miss new or fileless threats, so add behavior based detection.
Hardening once. Without drift detection and patching, systems return to a weak state.
Disabling security tools to fix performance. Tune exclusions instead of turning off protection.
Giving daily accounts admin rights. Malware then inherits those rights.
Deploying a patch fleet wide without a pilot can cause an outage, so test first and keep a rollback path.
Check yourself
Work through these three questions.
Why is allow listing stronger than deny listing?
It blocks everything not explicitly approved, including unknown malware, whereas deny listing blocks only known bad items.
What does EDR provide that signature antivirus does not?
Behavior based detection, investigation data and remote response such as isolating a compromised host.
What does least functionality mean?
Removing or disabling services, ports, protocols, accounts and software that the system's role does not need.
Topic 2 of 8 in Security Engineering
Test yourself on Security Engineering
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.