Mastering Endpoint Security: A Fireside Chat

What is Endpoint Security?

I consider an endpoint to be an Operating System Instance on a network. Providing Endpoint Security is the next level of defense in depth after Network Security. There are some protections provided by the network for endpoints and some protections provided by endpoints for the network. But most endpoint security is focused on protection of the endpoint.

Who is Roy “Mac” Kincaid?

I have been involved with Endpoint Security since the first McAfee STIGs were written about 11 or more years ago. For old timers like me that was US Cybercom directive FRAGO 13 (as in 2013). That was when we did ECV audits rather than CCRIs. I have known, learn from, or taught all HBSS/ESS STIG writers from the first to almost the last. However, I have not had a chance to meet the current ESS STIG writer. I was also asked to update the US CYBERCOM directive evaluation spreadsheet to reflect OPORD 16-0080 for DISA. So, you can blame me. Thanks to SecureStrux, Jen Cottle and I have been providing customers with ESS inspections and more importantly, provided implementation assistance for organizations to increase their inspection scores and yes, even increase their security posture. Most of my technical experience has been with McAfee Enterprise Policy Orchestrator (ePO) which is now Trellix Threat Detection and Response.

What is the future of EndPoint Security within the DoD?

Per CCRI 3.0 and the ESS working Group guidance the Technologies used for Endpoint Security will consists of Trellix/Microsoft Defender Endpoint, Tanium, Nessus/ACAS and either CISCO ISE or Forescout. The end of DoD license for Trellix will be the end of this calendar year, 2024; To be replaced with Microsoft Defender Endpoint. Currently, CCRI guidance places emphasis on rolling up data from the endpoint technologies to Constant Monitoring Risk Scoring (CMRS) data base which will become Big Data Platform (BDP) data base sometime soon. Because this data is rolled up from local organizations to CMRS/BDP, Labelling of Data (known as OA TAGGING) must be done in order for the data to have context and be of value.

What impact will cloud computing have on Endpoint Security?

Most products have cloud services available. As organizations evolve from on-prem to IaaS to PaaS, and then finally SaaS, more responsibility for all functionality, to include security moves from the user to the provider of services in the cloud. If there is an Operating System Instance on a network, Endpoint Security for that OS should be provided by the user. I assume that once an organization evolve to Software as a Service (SaaS), the cloud provider will provide Endpoint Security for the OS in the background and report to the user Security Posture of the OS as appropriate.

Now for the Pitch!

Having the great fortune of working with talented people in this field, I have learned a lot of technical information regarding the implementation of Endpoint Security to meet DoD regulations. I have also had positive feedback from our customers regarding my “ePO Whisperers’” email distribution list. I know it’s old fashioned, but for the most part it is a way for me to distribute lessons learned out in the field. If you would like to be added to my distribution list, email me at mac.kincaid@securestrux.com. Here is a list of past lesson’s learned: