15.3 Implement and Operate Endpoint Device Security

Implement and operate endpoint device security

Knowledge area 7.2 is Implement and operate endpoint device security. Domain 7 as a whole is 15% of the SSCP. If 7.1 is how you recognize malware and malicious activity, 7.2 is the host tooling you actually run: host-based intrusion prevention system (HIPS), host-based intrusion detection system (HIDS), host-based firewalls, application white listing, endpoint encryption (full disk encryption), Trusted Platform Module (TPM) (hardware security module management), secure browsing (digital certificates), and endpoint detection and response (EDR).

These are technical controls on the host. Network intrusion prevention, border firewalls, and content delivery networks are Domain 6. Do not answer "put a better border firewall" when the stem is a laptop that left the building.

Detection versus prevention on the host

HIDS versus HIPS. Detection without prevention is HIDS: you learn that a system driver hash changed. Prevention is HIPS: the agent stops the untrusted driver from loading. A pure file-integrity HIDS that cannot block is still valuable on a golden server image. It is not a substitute for HIPS or allowlisting when the exam asks how to stop unexpected PowerShell.

Host-based firewalls are per-endpoint network policy. They still apply when the laptop is on home Wi-Fi or a hotel network, unlike a data-center firewall the device has left behind. They are not application white listing: allowing outbound HTTPS still lets malware phone home over port 443. Combine them: the firewall for ports and directions, allowlisting for which program may use the stack.

Application white listing is the outline's phrase; operations language is allowlisting. Default deny. The payroll server runs the vendor binary, signed updaters, and nothing else — not a word-processor child launching PowerShell. Allowlisting fails if every user is local admin and can install anything, or if you allowlist all per-user application data directories. Exam trap: treating signature antivirus as white listing. Antivirus is default allow plus a block list. White listing is default deny plus an allow list.

Endpoint encryption and TPM (HSM management)

Full disk encryption (FDE) protects data at rest when a device is lost or the drive is removed. Windows BitLocker, Apple FileVault, and Linux LUKS are the usual implementations. FDE does not protect a logged-on session: once the volume is unlocked, malware and a malicious insider see plaintext. Combine FDE with screen lock, EDR, and DLP.

The outline pairs Trusted Platform Module (TPM) with hardware security module (HSM) management. Distinguish them:

BitLocker and TPM scenario. Finance laptops use BitLocker with the TPM as a protector. A laptop is stolen from a car.

• If the thief removes the drive and mounts it in another chassis, FDE holds: the TPM-sealed key is not on that other board, so the volume stays ciphertext.
• If BitLocker is TPM-only (no PIN or startup key), the thief who boots the original laptop can reach the Windows logon because the TPM unseals the key when PCRs match the expected boot path. A Windows password is still required, but you have not required a pre-boot factor. Some evil-maid and direct-memory attacks target this mode.
• TPM plus PIN (or TPM plus a USB startup key) requires a secret before the OS loader obtains the volume master key. That is the operational recommendation for laptops that leave the building.
• The recovery key is break-glass. Store it in a vault or directory escrow, not in a text file on the same disk and not on a sticky note on the docking station.
• A TPM does not remote-wipe a stolen device by itself. Remote wipe is mobile device management (knowledge area 7.3) or a management/EDR agent that can still phone home. A data-center HSM does not magically wipe a laptop TPM either.

Do not tell the exam that TPM means passwords can be disabled. Do not confuse a data-center HSM that signs the company's code with the laptop TPM that seals BitLocker.

Secure browsing and digital certificates

Secure browsing on the outline is exemplified by digital certificates. Practically:

• Browsers and operating-system HTTP stacks validate Transport Layer Security (TLS) server certificates: chain to a trusted certificate authority (CA), name match, validity window, revocation checking.
• Users who click through certificate warnings, install extra CAs from random USB sticks, or live with unmanaged inspection, train themselves to ignore the control.
• Phishing sites now often present valid public-CA certificates. HTTPS is not proof of the identity you intended. Combine certificates with allowlisted bookmarks for high-value sites, DNS filtering, and isolation (browser in a virtual desktop) where the risk justifies it.
• Certificate pinning and enterprise trusted-CA policy belong on high-value applications.

If the stem is a lookalike bank site with a padlock, the answer is user training plus blocking, not "certificates are broken so disable HTTPS checking."

EDR: beyond antivirus, isolate versus reimage

Endpoint detection and response (EDR) continuously records endpoint telemetry (process creation, script blocks, credential-dumping APIs, file-rename storms, network connections), lets analysts hunt, and takes response actions: kill process, quarantine file, isolate the host from the network, disable a local account. Traditional antivirus asks whether a file is known-bad. EDR asks what this process tree did. That is why fileless PowerShell is an EDR problem more than a weekly scanner problem.

EDR isolate versus reimage is a decision, not a slogan.

Scenario. EDR on a finance laptop alerts: the local security authority process is accessed from a non-Microsoft binary, then encoded PowerShell runs. Legal has not issued a hold. The CFO has a board packet due in twenty minutes and wants the laptop cleaned.

1. Isolate first. EDR network containment keeps the implant from talking to command and control or the domain while you still have memory and a live agent. Leaving the device on production wireless so the user can finish a spreadsheet is how credential dumping becomes a tenant-wide incident.
2. Capture what you need. If forensic knowledge area 4.2 might apply, collect memory and telemetry before you destroy the volume. Isolation is compatible with collection; a panic reimage is not.
3. Then decide rebuild versus clean. Rootkit, ransomware, or unknown persistence means rebuild from a gold image (or issue a loaner) and rotate credentials. A single blocked dropper with intact integrity monitoring and no credential access might be remediated in place after analysis. Reimaging as the first action, before isolate, can kick the attacker off this disk and leave their stolen refresh token in the cloud.
4. Isolation is not recovery. The user works on a loaner. The original is untrusted until eradication criteria are met.

Exam traps. Treating HIDS as blocking. Treating antivirus signatures as allowlisting. Claiming BitLocker with a TPM-only protector makes a stolen, still-bootable laptop harmless. Disabling the host firewall temporarily for a vendor and forgetting it. Using EDR isolate as a reason to skip credential rotation. Reimaging a host that is under legal hold — that is knowledge area 4.2, and it is still wrong in 7.2 operations.

When a CAT item names a 7.2 control, answer with that control's actual capability: HIDS alerts, HIPS blocks, a host firewall filters ports, white listing default-denies binaries, full-disk encryption protects data at rest, the TPM seals keys to hardware, certificates authenticate servers (not user intent), and EDR isolates and responds with telemetry traditional antivirus never had.