NC Sep-Oct 2022

OPINION: ENDPOINT SECURITY
WHY EMPLOYEE WORKSTATION SECURITY CAN'T BE FORGOTTEN
DAVID HIGGINS, SENIOR DIRECTOR, FIELD TECHNOLOGY OFFICE AT CYBERARK GIVES US SIX
ENDPOINT SECURITY RULES TO ISOLATE ATTACKER ACTIVITY, REDUCE THE IMPACT OF A BREACH
AND ALLOW ORGANISATIONS TO REGAIN CONTROL OF THEIR ENVIRONMENTS
Arecent Accenture study found that 63%
of high-growth companies have
already adopted 'productivity
anywhere'. It's a switch which, two years later,
is still causing issues for businesses -
specifically their security teams. This is mainly
as a result of employee workstations now
being put at the edge. Far beyond the 'walls'
of the traditional corporate network, they're
an easy route in for attackers looking to
compromise identities, launch ransomware
attacks, exploit privileged credentials and
infiltrate sensitive corporate networks.
PROTECTING THE ENDPOINT
Having these workstations - or endpoints - in
such an unsecure situation is leaving
organisations at an unnecessary and increased
risk of an endpoint attack. This is especially
worrying as we know that, during these types of
attack, by the time incident response specialists
are called in the environment has already
become overrun by threat actors.
It is vital to an organisation's overall security
posture that they don't neglect endpoints -
especially workstations. Doing so will inevitably
end in a cyber assault. While this might sound
like a big task, there are actually only six steps
which security teams need to adhere to in order
to protect them. These are fundamental identity
security rules and safeguards:
1. Remove local admin rights: Administrator
accounts are vital. Not only are they used to
install and update workstation software and set
up system preferences, but they are critical to
the smooth running and management of user
accounts. The security issues arise however, as
admin accounts are privileged, making them
more valuable to attackers and more
susceptible targets for those looking to run
ransomware and other malicious software,
disable antivirus, and block disaster recovery
tools. Moving local admin powers away from
normal users and into a secure digital vault with
credential rotation is the quickest and most
straightforward way to secure employee
workstations. Doing so reduces the ability of
attackers to move through networks, while
lessening the impact of employee mistakes.
2. Implement least privilege: Employees
frequently need to carry out an action which
requires administrative privileges. While these
are usually legitimate and necessary tasks, justin-time
privileged access enables teams to
safely carry out work both in accordance with
policy, and appropriately.
3. Policies for application control: The endpoint
must be able to defend against attacks, as well
as allow or deny known applications. To do
this, and lessen the risk of threats such as
ransomware, organisations must be able to
"greylist" apps and implement advanced control
policies, ensuring workers use only secure,
trusted applications.
4. Don't forget cached credentials: Credential
theft is one of the greatest risks to
organisations. These can be saved in memory
by many common business apps, and web
browsers and password managers store
application and website credentials
locally. The fact threat
actors can easily and
frequently get cached
credentials without
requiring admin
capabilities, makes
having an
endpoint security
layer even more
essential to overall security.
5. Leave and set traps: It may sound left-field,
but endpoint protection technologies that
support privilege deception functionality, such
as the capability to generate phoney "honeypot"
privileged accounts, can help identify potential
attackers in real-time.
6. Monitor privileged activities: Attackers are
sneaky and often go unnoticed when testing a
network's defences. By proactively monitoring
privileged workstation activity, organisations
can automatically identify and stop adversaries
before they move laterally, elevate privileges, or
do significant harm.
FINAL THOUGHTS
Endpoint security has been something
organisations have been battling against for
years, and the added challenges they face
thanks to the proliferation of hybrid working are
cause for concern. With inadequately protected
employee workstations posing as the perfect
vulnerability for attackers to exploit, it's
imperative for organisations to act swiftly to
protect endpoints. NC
12 NETWORKcomputing AUGUST/SEPTEMBER 2022 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK