System & Endpoint Security Flashcards

What is the purpose of endpoint security software?

Answer: To prevent unauthorized access to devices

Endpoint security software is designed to protect individual computing devices, such as laptops, desktops, and mobile phones, from cyber threats. Its primary purpose is to prevent unauthorized access, malware infections, and data breaches on these endpoints. It achieves this through various features like antivirus, anti-malware, firewall, and intrusion prevention systems.

Why is regular patching important in system security?

Answer: It fixes known vulnerabilities

Regular patching is a fundamental cybersecurity practice that involves applying updates and fixes to software and operating systems. These patches often address known security vulnerabilities that attackers could exploit to gain unauthorized access or disrupt systems. By promptly applying patches, organizations significantly reduce their attack surface and strengthen their overall security posture.

What does EDR stand for in cybersecurity?

Answer: Endpoint Detection and Response

EDR stands for Endpoint Detection and Response, which is a cybersecurity solution that continuously monitors endpoint devices for malicious activity. EDR systems collect and analyze data from endpoints, providing visibility into potential threats and enabling rapid detection, investigation, and response to security incidents. This advanced capability goes beyond traditional antivirus to offer deeper threat analysis.

Why is disk encryption used on endpoint devices?

Answer: To protect stored data

Disk encryption is a security measure that scrambles all data on a hard drive, rendering it unreadable to unauthorized individuals. Its primary purpose on endpoint devices is to protect sensitive information stored on the device, especially in cases of loss or theft. Even if a device falls into the wrong hands, the encrypted data remains secure without the correct decryption key.

What is application whitelisting?

Answer: Permitting only trusted apps to run

Application whitelisting is a security control that allows only explicitly approved applications to execute on a system, while all other applications are blocked by default. This proactive approach significantly enhances security by preventing the execution of unauthorized or malicious software, including unknown malware and ransomware. It provides a strong defense against various types of attacks.

What is a common sign of an endpoint infection?

Answer: Frequent pop-ups and slowdowns

Frequent pop-ups, unexpected advertisements, and a noticeable slowdown in system performance are common indicators of an endpoint infection, often by adware or other forms of malware. These symptoms suggest that malicious software is running in the background, consuming resources, and potentially compromising the device's security and usability. Other signs might include crashes or unusual network activity.

What type of malware records keystrokes to steal credentials?

Answer: Keylogger

A keylogger is a type of malicious software or hardware that records every keystroke made on a compromised device. Its primary purpose is to steal sensitive information such as usernames, passwords, credit card numbers, and other confidential data. Attackers then retrieve these logs to gain unauthorized access to accounts and systems.

Which setting helps reduce insider threats on endpoints?

Answer: Least privilege access

Implementing the principle of least privilege access is crucial for reducing insider threats on endpoints. This security practice ensures that users are granted only the minimum necessary permissions to perform their job functions, and no more. By limiting administrative rights and access to sensitive data, it significantly reduces the potential damage an insider, whether malicious or accidental, can cause.

Why is multi-factor authentication (MFA) recommended for endpoint devices?

Answer: It enhances security with additional verification

Multi-factor authentication (MFA) significantly strengthens security for endpoint devices by requiring users to provide two or more verification factors to gain access. Instead of relying solely on a password, MFA adds layers like a fingerprint, a code from a mobile app, or a physical token. This makes it much harder for unauthorized individuals to access accounts, even if they manage to steal a password.