Endpoint defenses cheat sheet
Antivirus
Catches known malware by matching files against a database of signatures.
EDR
Endpoint Detection and Response. Watches behavior on the device and can stop new threats based on what they do.
Patch management
The process of regularly applying software updates that fix security flaws.
Least privilege
Day-to-day users do not have admin rights. Installing software or making system changes requires a higher account.
App allowlist
Only listed applications can run. Stronger but harder to maintain.
App blocklist
Listed applications cannot run. Anything else is allowed. Easier but weaker.
Sandboxing
Run untrusted code in an isolated environment so it can't affect the rest of the system.
Disk encryption
Full-disk encryption protects the data on a device when it is off or stolen.
TPM
Trusted Platform Module. A chip on the motherboard that stores encryption keys and verifies the boot process.
Secure Boot
The firmware refuses to load operating-system code that is not signed by a trusted vendor.
BIOS / UEFI
The firmware that starts the computer before the OS loads. UEFI is the modern replacement for legacy BIOS.
MDM
Mobile Device Management. Centrally enforces policy, controls apps, and can lock or wipe a mobile device.