Tips for Better Endpoint Protection

Endpoints are the primary points of potential vulnerability within a network. They of make up much of a company’s network and IT infrastructure. This is a collection of computers, mobile devices, servers, and smart gadgets as well as other IoT devices that all connect to the company network. Check with your internal IT Support or outsource Managed Services Provider (MSP). If the endpoints are not protected, then you have a problem – with your IT services.

Naturally, the number of endpoints a company has will vary by business size. According to LogMeIn, companies with less than 50 employees have about 22 endpoints. Small businesses with 50-100 employees have roughly 114. Organizations with 1,000+ employees average 1,920 endpoints.

Every company device offers a chance for a hacker to penetrate your defenses by planting malware or gaining access to sensitive company data. An endpoint security strategy addresses endpoint risk and puts focused tactics in place.

64% of organizations have experienced one or more compromising endpoint attacks.

The following tips provide straightforward solutions focused on protection for endpoint devices.

Remove Password Vulnerabilities

One of the biggest vulnerabilities when it comes to endpoints are passwords. The news reports large data breaches all the time related to leaked passwords. For example, there was the ‘RockYou2021’ breach in 2009 that exposed the largest number of passwords ever – 3.2 billion.

Poor passwords and password security make breaches involving credential theft one of the most prevalent threats to Cybersecurity.

Effective ways to close off password vulnerabilities in your endpoints:

Train employees on proper (and strong) password creation and handling

Look for solutions that replace passwords, like biometrics

Install Multi-Factor Authentication (MFA) on all accounts (a foundation of good security)

Stop Malware Infection Before OS Boot

USB drives (AKA flash or thumb drives) are a popular giveaway item at trade shows. However, an innocent-looking USB can actually cause a breach. One trick that hackers use to gain access to a computer is to boot it from a USB device containing malicious code.

There are precautions you can take to prevent this from happening. One of these is ensuring you’re using firmware protection that covers two areas: Trusted Platform Module (TPM) and Unified Extensible Firmware Interface (UEFI) Security.

TPM is engineered to be resistant to tampering, both physical and via malware. It looks at whether the boot process is occurring properly. It also monitors for the presence of anomalous behavior. Additionally, there are devices and security solutions that allow you to disable USB boots.

Update, Update, Update!

Just as with all aspects of your network, you should regularly update your endpoint security solutions. Set up the software updates to be performed automatically wherever possible so they aren’t left to chance, and nobody can forget to do them.

When it comes to firmware, updates are often forgotten about. They don’t usually pop up the same types of warnings as software updates. But they are just as important for ensuring your devices remain secure and protected.

It’s best to have an IT services professional manage all your endpoint updates. They'll make sure updates happen in a timely fashion. They will also ensure that devices and software update smoothly.

Use Modern Device & User Authentication

How are you authenticating users to access your network, business apps, and data? If you are using only a username and password, then your company is at high risk of a breach.

Use two modern methods for authentication:

Contextual authentication

Zero Trust approach

Contextual authentication takes MFA a step further. It looks at context-based cues for authentication and security policies and works as a factor of Conditional Access. These include several things. Such as, what time of day someone is logging in, their geographic location, and the device they are using.

Zero Trust continuously monitors your network, ensuring that every entity in a network belongs there. Safelisting of devices is an example of this approach. You approve all devices for access to your network and block all others by default. If an employee tries logging in from an unknown device. Conditional Access rules will apply to determine if the attempted entry is legitimate.

Apply Security Policies Throughout the Device Lifecycle

From the time a device is first purchased to the time you retire it, security protocols in place need to be in place. Tools like Microsoft AutoPilot and SEMM allow for the automation that keeps security protocols up to date. They deploy healthy security practices across each lifecycle phase. This ensures a company doesn't miss any critical steps.

Device lifecycle security begins when a device is first issued to a new user. Privileges that are unnecessary for the new user need to be removed. When device moves from one user to another, it needs to be properly cleaned of old data and reconfigured for the new user. When you retire a device, it should be properly scrubbed by deleting all information and disconnecting it from any accounts.

Anticipate Device Loss or Theft

Mobile devices and laptops get lost or stolen. When that happens, you should have a written plan for the sequence of events that should take place immediately, such as remotely wiping it clean and disconnecting any network access. This prevents risking company data and exposing business accounts.

Prepare in advance for potential device loss through backup solutions. As mentioned above, endpoint security should allow for remote locking, wiping, and blocking network access for devices.

Reduce Your Endpoint Risk Today!

Get help putting robust endpoint security in place, step by step. We can help! Contact IT Support LA today for a free consultation.