
What is Endpoint Security?
I consider an endpoint to be an Operating System Instance on a network. Providing Endpoint Security is the next level of defense in depth after Network Security. There are some protections provided by the network for endpoints and some protections provided by endpoints for the network. But most endpoint security is focused on the protection of the endpoint.
Who is Roy “Mac” Kincaid?
I have been involved with Endpoint Security since the first McAfee STIGs were written about 11 or more years ago. For old timers like me that was US Cybercom directive FRAGO 13 (as in 2013). That was when we did ECV audits rather than CCRIs. I have known, learn from, or taught all HBSS/ESS STIG writers from the first to almost the last. However, I have not had a chance to meet the current ESS STIG writer. I was also asked to update the US CYBERCOM directive evaluation spreadsheet to reflect OPORD 16-0080 for DISA. So, you can blame me. Thanks to SecureStrux, Jen Cottle and I have been providing customers with ESS inspections and more importantly, providing implementation assistance for organizations to increase their inspection scores and yes, even increase their security posture. Most of my technical experience has been with McAfee Enterprise Policy Orchestrator (ePO) which is now Trellix Threat Detection and Response.
What is the future of EndPoint Security within the DoD?
Per CCRI 3.0 and the ESS working Group guidance the Technologies used for Endpoint Security will consist of Trellix/Microsoft Defender Endpoint, Tanium, Nessus/ACAS, and either CISCO ISE or Forescout. The end of the DoD license for Trellix will be the end of this calendar year, 2024; To be replaced with Microsoft Defender Endpoint. Currently, CCRI guidance places emphasis on rolling up data from the endpoint technologies to the Continuous Monitoring Risk Scoring (CMRS) database which will become the Big Data Platform (BDP) database sometime soon. Because this data is rolled up from local organizations to CMRS/BDP, the Labelling of Data (known as OA TAGGING) must be done in order for the data to have context and be of value.
What impact will cloud computing have on Endpoint Security?
Most products have cloud services available. As organizations evolve from on-prem to IaaS to PaaS, and then finally to SaaS, more responsibility for all functionality, to include security, moves from the user to the provider of services in the cloud. If there is an Operating System Instance on a network, Endpoint Security for that OS should be provided by the user. I assume that once an organization evolves to Software as a Service (SaaS), the cloud provider will provide Endpoint Security for the OS in the background and report to the user the Security Posture of the OS as appropriate.
Now for the Pitch!
Having the great fortune of working with talented people in this field, I have learned a lot of technical information regarding the implementation of Endpoint Security to meet DoD regulations. I have also had positive feedback from our customers regarding my “ePO Whisperers” email distribution list. I know it’s old-fashioned, but for the most part, it is a way for me to distribute lessons learned in the field. If you would like to be added to my distribution list, email me at mac.kincaid@securestrux.com. Here is a list of past lessons learned:
Email Subject |
Topic Covered |
Date Sent |
---|---|---|
ePO Whisperers’: CCRI 3.0 Alert – cheat sheet attached. | Endpoint Security Requirements in plain english | February 2024 |
Standing up a new DoD ESS image | Regarding DB License for DoD image | February 2024 |
ePO Whisperers’: CCRI 3.0 Alert – authorization boundary tag | OA Tagging Hints | February 2024 |
ePO Whisperers’: CCRI 3.0 Alert – AppLocker alone may no longer be sufficient to meet CCRI 3.0 AWL requirements | Application Whitelisting | December 2023 |
ePO Whisperers’ CCRI 3.0 Alert: Install DATT sensor on all managed clients | CCRI 3.0 Hint for windows managed clients | December 2023 |
ePO Whisperers’ who whisper LINUX: OAS Setting | ON/OFF OAS hint for Linux. | December 2023 |
ePO Whisperers’ – ALERT new ENS check V-258460 | Operational impact of STIG change | November 2023 |
Update: ePO Whisperers’: Review, Software Catalog | Alternative to Patches | October 2023 |
UPDATE: ePO Whisperers’ -> set up SPLUNK to manage ESS Event data, 3RD SOP | Update on how to push ESS Event data to SPLUNK. | September 2023 |
ePO Whisperers’ – AHA Config and new baseline image | Heads up on unannounced DoD changes to configuration guidance | September 2023 |
ePO Whisperers’ who whisper Linux, 2nd Update: McAfee/Tellix products are NOT signed when installed and may not function properly if not signed | Linux Hints regarding product installation | September 2023 |
ePO Whisperers’ – Windows Event ID 4625 (FIMCLI.EXE) fills up security log | Management of security logs | August 2023 |
The latest in Cybersecurity
Enter your email to get the latest news, updates,
and content on cybersecurity.
"*" indicates required fields