Unit 4: Network, Endpoint, and Application Security Capabilities

Modern system security layers controls across the network, the endpoint, and the application so that the failure of any single control does not expose the whole system. This unit assumes the defense-in-depth model and uses it to organise concrete controls at each layer.

I. Orientation: The Layered Security Model

Security capabilities exist to preserve the CIA triad across every point data touches, from the wire to the running process.

• Defense in depth: multiple independent controls (perimeter, segmentation, host, app) so no single bypass is fatal.
• CIA triad: Confidentiality (encryption, access control), Integrity (hashing, signing), Availability (redundancy, DoS resistance).
• Attack surface: the sum of exposed interfaces, ports, services and inputs; hardening = reducing it.
• Baseline: a documented, approved minimum secure configuration against which drift is measured.
• Least privilege and zero trust: grant the minimum access needed; never trust a packet, host or user implicitly by location.
• Control types: preventive (firewall), detective (IDS), corrective (quarantine).

II. Network Security Capability Enhancement

Adding active controls that inspect, filter and segment traffic.

Enhancing network capability means layering filtering, inspection and isolation onto the basic routed network.

A. Firewalls and filtering

• Stateless packet filter: matches on IP/port/protocol only, no connection memory; fast but blind to session context.
• Stateful inspection: tracks the connection table so return traffic for an established flow is allowed automatically.
• Next-generation firewall (NGFW): adds application awareness, user identity and integrated IPS to Layer-7 decisions.
• Rule hygiene: default-deny inbound, explicit allow-lists, and an implicit deny-all at the end of every ACL.

B. Intrusion detection and prevention

• IDS: passive, mirrors traffic (SPAN/TAP) and alerts; cannot block.
• IPS: inline, drops matching packets in real time.
• Detection methods: signature-based catches known patterns; anomaly-based flags deviation from a learned normal.

C. Segmentation and isolation

• VLANs: separate broadcast domains logically on shared switches.
• DMZ: a buffer subnet for internet-facing hosts, isolating them from the internal LAN.
• Microsegmentation: per-workload policy enforcement so east-west lateral movement is blocked.
• NAC: authenticates and posture-checks a device (via 802.1X) before granting network access.

D. Secure remote access

• VPN tunnels: IPsec for site-to-site at Layer 3; SSL/TLS VPN for clientless user access.
• Encryption guarantee: confidentiality and integrity of traffic traversing untrusted links.

III. Network Security Baselines

Defining and holding the approved secure network configuration.

A baseline turns ad-hoc hardening into a repeatable, auditable standard.

A. Establishing the baseline

• Hardening guides: adopt CIS Benchmarks or vendor STIGs as the reference configuration.
• Disable unused services: close unneeded ports and protocols to shrink attack surface.
• Secure management plane: replace Telnet with SSH, HTTP with HTTPS, and change default credentials.

B. Secure protocols and ports

• Protocol upgrades: SNMPv3 (auth + encryption) over SNMPv1/2c; SFTP/FTPS over plain FTP.
• Port discipline: document every open port and its owning service.

Insecure  → Secure
Telnet 23 → SSH 22
HTTP 80   → HTTPS 443
FTP 21    → SFTP 22 / FTPS 990

C. Monitoring and drift management

• Configuration drift: unauthorised change away from baseline, detected by automated config comparison.
• Logging: forward device logs to a central SIEM with synchronised NTP time for correlation.
• Change control: every deviation passes through documented approval before deployment.

IV. Implement Endpoint Security

Protecting the hosts where users and data actually meet.

The endpoint is the last line of defense and the most common initial compromise point.

A. Host-based protective software

• Antivirus/anti-malware: signature + heuristic scanning of files on access.
• EDR: continuously records endpoint behaviour, detects anomalies, and enables remote investigation and isolation.
• Host firewall: per-machine inbound/outbound filtering independent of the network perimeter.
• HIDS: monitors file integrity and system calls on the host itself.

B. System hardening

• Patch management: apply OS and application updates promptly to close known CVEs.
• Application allow-listing: only approved executables may run; default-deny for binaries.
• Service reduction: uninstall or disable unneeded roles and features.
• Account control: enforce least privilege; remove local admin from standard users.

C. Data and boot protection

1. Full-disk encryption: BitLocker/LUNS/FileVault protects data at rest if the device is lost or stolen.
2. Secure boot and TPM: the TPM verifies the boot chain's integrity and anchors encryption keys in hardware, blocking tampered bootloaders.

D. Significance and limitations

• Strength: control close to the data even off the corporate network.
• Limit: depends on endpoint being managed; unmanaged or BYOD hosts weaken coverage.

V. Mobile Device Hardening

Extending endpoint discipline to phones and tablets.

Mobile devices combine high mobility with sensitive data, demanding management that survives leaving the perimeter.

A. Centralised management

• MDM/UEM: push policy, enforce encryption, and inventory devices from a console.
• Remote wipe and lock: erase data on a lost device.
• Containerisation: separate a managed work profile from personal data on the same device.

B. Access and deployment control

• Screen lock: PIN, biometric, or strong passcode with auto-lock timeout.
• Deployment models: COPE (company-owned, personally enabled) gives full control; BYOD trades control for convenience and raises data-leakage risk.

C. Reducing mobile attack surface

• No jailbreak/root: rooting removes the OS sandbox and must be detected and blocked.
• App vetting: install only from trusted stores; restrict sideloading.
• Transport security: force VPN for corporate traffic; disable auto-join to open Wi-Fi.
• Patch currency: retire devices that no longer receive vendor security updates.

VI. Application Protocol Security Baselines

Securing the protocols applications speak to each other.

Application-layer protocols must carry authentication, encryption and integrity rather than relying on the network alone.

A. Transport encryption with TLS

• TLS handshake: negotiates cipher, authenticates the server via its certificate, and derives a shared session key.
• Version discipline: enforce TLS 1.2+ and disable SSLv3/early TLS and weak ciphers.
• Certificate validation: check chain of trust, expiry and hostname; use trusted CAs.

B. Secure email protocols

• Transport: SMTP over STARTTLS, and IMAPS/POP3S for retrieval.
• Authenticity controls: SPF authorises sending hosts, DKIM signs messages, DMARC sets policy on failures.

C. Secure name and address services

• DNSSEC: signs DNS records so resolvers can verify authenticity and resist cache-poisoning.
• DNS over HTTPS/TLS: encrypts queries against eavesdropping.

D. Secure directory and file transfer

• LDAPS: LDAP over TLS to protect directory credentials in transit.
• File transfer: SFTP (over SSH) and FTPS (over TLS) replace cleartext FTP.

HTTPS  = HTTP + TLS
SMTPS  = SMTP + TLS
LDAPS  = LDAP + TLS

VII. Cloud and Web Application Security Concepts

Securing applications and data in shared, internet-facing environments.

Cloud and web applications shift some responsibility to the provider while exposing the application directly to the internet.

A. Shared responsibility model

• Provider secures: physical facilities, host hypervisor, and underlying network.
• Customer secures: data, identity, access configuration, and OS/app depending on service tier.
• Tier gradient: control shifts from customer to provider across IaaS → PaaS → SaaS.

B. Cloud-native controls

• IAM: least-privilege roles and policies; enforce MFA on privileged accounts.
• Security groups / NSGs: virtual firewalls scoping traffic to each instance.
• CASB: policy enforcement and visibility between users and cloud services.
• Encryption and key management: encrypt data at rest and in transit; govern keys via a KMS.
• Misconfiguration risk: publicly exposed storage buckets are a leading cause of cloud breaches.

C. Web application vulnerabilities

• Injection: untrusted input executed as a command, e.g. SQL injection; mitigated by parameterised queries.
• XSS: attacker script runs in a victim's browser; mitigated by output encoding and CSP.
• CSRF: forces an authenticated user's browser to submit an unwanted request; mitigated by anti-CSRF tokens.
• Broken access control: failure to enforce authorisation, allowing privilege escalation.

D. Web protective controls

• WAF: inspects HTTP(S) and blocks injection, XSS and other Layer-7 attacks.
• Input validation: allow-list sanitisation at the server boundary.
• Secure headers: HSTS forces HTTPS; CSP restricts script sources.
• SDLC integration: static (SAST) and dynamic (DAST) testing catch flaws before release.

E. Significance and limitations

• Strength: controls scale elastically and centralise policy for distributed users.
• Limit: security depends on correct configuration — the provider secures the platform, not the customer's mistakes.