Endpoint Security

Endpoints are physical devices that connect to and exchange information with a computer network, such as mobile devices, desktop computers, virtual machines, embedded devices, Internet of Things devices, and servers. Software safeguards that protect these machines against attack are grouped in an endpoint protection platform (EPP), which includes antivirus, antispyware, personal firewalls, and host-based intrusion detection and prevention. NSA zero trust guidance also lists encryption, access control, auditing, and incident response among the controls to document for endpoint security.

Endpoint detection and response (EDR) is a core element of an EPP. EDR tooling monitors, detects, and remediates malicious activity on endpoints and aims to catch advanced threats that a traditional antivirus program cannot detect. NSA zero trust guidance shares endpoint data such as device health, operating system version, patch level, and antivirus status with comply-to-connect (C2C) systems, and reassesses access when a device's posture changes.

Antivirus software tries to detect, quarantine, or block malware on a device, and works together with network defenses, device configuration, and app store scanning. Traditional antivirus scanned every file for known signatures, and advances in malware and changes in platforms have limited the effectiveness of that approach. NCSC guidance notes that many risks antivirus once covered are now mitigated by correct operating system settings, that antivirus offers very limited value on devices that cannot run known malware, and that running more than one antivirus product on a device adds little and can cause conflicts.