2020-12-20T19:45:25Z

== Summary ==

This article describes the importance of endpoint protection and the types of threats an endpoint can be a victim to. It also gives insights on data leakage and offers possible solutions for protecting an endpoint.

== The Importance of Endpoint Protection ==

Data leakage is a common event in many companies, that don’t spend their time and budget on
developing proper cyber security systems for the sake of secure data transmissions,
storage and in the era of third party cloud services, it is often a difficult challenge
to keep confidential information inside the organization. For the purpose of solving
this problem, companies have created several software products, that help preserving
integrity and confidentiality in the work environment and preventing unexpected data
leakage. In this study we will discuss different methods of endpoint protection, how
they work and the types of threats, that are important to look for, when setting up a
company environment or developing such a software ourselves.

== Data Leakage ==

Trusting third party companies (agents) with handling confidential data has several
advantages: partner companies may gain access to customer data, that can be done
by using the same service as the distributor (data owner). This way not only reading,
but also updating and altering data in any way can be more efficient, but can also
lead to worse data quality, due to peturbation. One of the main goals of the agents
is to keep the data quality as high as possible while also preventing data leakage via
endpoints. This means the protection of computer networks, that are remotely bridged
to client devices, such as mobile phones, laptops or tablets. Many companies are trying
to ensure endpoint security by using a single, multi-purpose software solution, that
enables administrators to setup a centrally managed security system, but there are
also several specialized products on the market. 53% of the companies, that took part
in the 2018 Insider Threat report have been victims of insider attacks more than once
a year, which highly emphasises the importance of the usage of proper cyber security
systems.

== Endpoint Protection Platform ==

One of the best solutions to achieve endpoint protection is to use an Endpoint Protection Platform (EPP), which consists of several tools, that can protect our systems
from unwanted intrusion, such as firewalls, antivirus systems and data encryption.

Endpoint protection platforms are software using signatures to ensure negative endpoint protection. They also have access to an own database, which stores signatures
of collected threats and use it to match them with other signatures, which helps them
detecting possible threats. An EPP also uses different services to monitor processes
running in networks for the sake of malfunction, virus detection.
Even though most attacks can be stopped by monitoring and signature matching, some
viruses are still able to get in the system and that’s where the so-called Host-based
Intrusion Prevention System (HIPS) takes action. It does not only wipe out malicious
activities, but is also capable of deep behavioral inspection. The annihilation of threats,
that already got into the system needs to be done as fast as possible, since the virus
can spread really fast and take over the whole system.

== References ==

* http://www.fastandeasyhacking.com/manual
* https://www.redteamsecure.com/
* https://www.offensive-security.com/metasploit-unleashed/
* http://www.proftpd.org/docs/

[[Category:Documentation]]