Endpoint Protection: Antivirus, EDR & Application Control¶

Endpoints (laptops, servers, phones) are where users — and attackers — operate. Modern endpoint defense goes far beyond classic antivirus.

The Evolution¶

Antivirus / NGAV¶

• Signature-based: matches known-bad. Fast but blind to new malware.
• Heuristic/behavioral: flags suspicious actions (e.g., a Word doc spawning PowerShell).
• Keep definitions and the engine updated.

EDR — Endpoint Detection & Response¶

EDR continuously records endpoint activity (processes, network, file, registry) and enables:

• Detection of suspicious behavior chains.
• Investigation — analysts can trace exactly what happened.
• Response — isolate a host, kill a process, roll back changes remotely.

EDR is the backbone of modern incident response. Examples: Microsoft Defender for Endpoint, CrowdStrike, SentinelOne.

Application Control / Allow-Listing¶

Instead of blocking known-bad, only allow known-good software to run.

• AppLocker / WDAC (Windows), fapolicyd (Linux).
• Extremely effective against unknown malware and "living off the land."
• Harder to maintain — requires cataloging legitimate apps.

Living Off the Land (LOLBins)¶

Attackers increasingly use built-in, trusted tools — PowerShell, certutil, wmic, mshta — to avoid dropping detectable malware. Defenses:

• Constrained-language mode and script-block logging for PowerShell.
• Behavioral detection (why is certutil downloading a file?).
• Application control to restrict abused binaries.

Patch & Configuration Management¶

Most breaches exploit known vulnerabilities with available patches:

• Maintain an asset inventory — you can't protect what you don't know exists.
• Vulnerability scanning (Nessus, OpenVAS, Qualys) on a schedule.
• Prioritize by exploitability and exposure, not just CVSS score.
• Test patches, then deploy promptly — especially internet-facing systems.

Defense-in-Depth on the Endpoint¶

Patched OS + least privilege + host firewall + NGAV/EDR + application allow-listing + full-disk encryption + centralized logging

No single control is sufficient; together they make compromise expensive and noisy.