The Complete Cyber Security Course : End Point Protection!

Explore current and future endpoint protection technologies, from disk encryption and antivirus suites to endpoint detection and response, and master email and messenger security for defense in depth.

Protect disk encryption by understanding physical attacks that reveal keys through memory, DMA, bootloader compromise, or evil maid scenarios; secure boot, TPM, pre-boot authentication, and device control mitigate these risks.

Compare whole disk encryption with encrypted containers, volumes, and partitions, highlighting how partial encryption enlarges the attack surface and leaves unencrypted system files, history, and temp data at risk.

Evaluate Windows disk encryption with BitLocker, TPM protections, and multiple authentication options. Assess benefits and privacy concerns, edition availability, and recovery key risks.

Compare windows disk encryption tools such as CipherShed, DiskCryptor, Symantec's drive encryption, and BestCrypt, highlighting twofish/serpent cascades, authentication, and boot options, with notes on containers and audits.

Enable file vault 2 on macOS by guiding entropy seeding, choosing recovery options, and using firmware password and sleep settings to harden disk encryption for endpoint protection.

Explore Linux whole disk encryption with dm-crypt and LUKS, including on-the-fly encryption during install on Debian, and flexible options like multi-key and plausible deniability.

Set up dm-crypt and LUKS on Linux during install with Debian, Kali, and Ubuntu. Use cryptsetup to create, access, and manage encrypted devices, benchmark crypto options, and manage key slots.

defense against disk decryption attacks balances usability and security, prioritizes preventing physical access, implements whole disk encryption with multifactor authentication, and disables memory dumps and hibernation.

Learn to encrypt files, archives, partitions, and disks across Windows, Linux, and BSD using PS Zip, 7-zip, and GPG, with two-factor authentication via password and key file.

Stack multiple layers of encryption and obfuscation across software and hardware to protect volumes and system partitions with distinct passwords and two-factor authentication, limiting exposure.

Evaluate endpoint protection software with features beyond antivirus and learn how independent labs test real-world protection, heuristics, and performance across vendors.

Explore how next generation antivirus and endpoint protection deliver defense in depth through prevention, detection and response and recovery technologies. Learn how these technologies synergize, avoid conflicts, and manage overhead.

Explore how application and execution controls, including ACLs, application whitelists and software restriction policies, prevent malware and unauthorized software as a layer of defense in endpoint protection.

Discover Windows user account control (uac), which runs as a standard user and prompts for admin tasks, with configurable notification levels to deter malware and attackers.

Learn how Emet blocks memory exploitation on Windows using dep, aslr, and seh overwrite protection. Apply protections to apps and understand its limitations and future integration.

Explore Windows 10 device guard, a virtualization based security feature that uses a hypervisor, hardware isolation, configurable code integrity, and digital signatures to enforce trusted apps and block malware.

Explore Linux security frameworks and implement strict access controls with AppArmor, a Linux kernel security module using per-program profiles to restrict capabilities and isolate applications like Apache.

Learn how SELinux enforces mandatory access control in Linux through kernel modules and policies, enabling granular file, network, and IPC controls and Debian deployment with virtualization options.

Learn to monitor and detect active threats with host and network intrusion detection systems, file integrity monitors, system information and event management software, honeypots and other deceptions, using Linux distributions.

Discover deception through honeypots for threat detection. Distinguish research honeypots from threat detection honeypots, and learn about high quality alerts and low false positives.

Security Union is a Linux distro for intrusion detection, network security monitoring, and log management, bundling tools like snort and network miner for deployment, with a setup wizard for sensors.

Centralize logs from devices, scanners, and monitors into a siem for analysis, correlation, and real-time alerts, turning data into actionable insight that reduces risk.

Learn to detect and remove malware and active adversaries using online and offline methods, live CD forensic techniques, and hybrid cloning with a virtual machine.

Explore automated malware removal tools, including Kaspersky, Malwarebytes, and Hitman Pro, plus online and offline scanning, safe mode, and live CD methods to identify and remove malware.

Boot a live operating system from USB or CD to mount the infected system's file system and run malware-removal tools across Windows, Mac, and Linux using rescue disks.

Use process explorer to identify suspicious auto start locations and dlls. Inspect strings and memory for odd urls and endpoints, then suspend or kill processes to remove persistence.

Learn to use Windows process and service tools, compare process explorer with native command line options, export details to csv, and query the registry to track executables for malware analysis.

Identify active threats by monitoring bandwidth and network activity using tools like Wireshark and networks, which offers usage reports and a netstat-like interface across Windows, Mac, and Linux.

Learn how Linux servers stay secure by using rkhunter to detect rootkits and malware, update signatures, set baselines, run scans, and whitelist warnings.

Explore Linux anti-malware tools like chkrootkit, Linux malware detect, Tiger, ClamAV, and volatility to scan, identify, and mitigate Linux malware and rootkits.

Identify Linux persistence techniques by examining startup scripts, rc.d and boot directories, kernel modules, and modprobe.d; review user profiles and home directory scripts to detect malware and maintain persistence.

Explore what firmware is and how firmware rootkits compromise devices from BIOS to hard drives, surviving OS reinstallations and patching, with supply chain and IoT implications.

Develop a robust end-point protection recovery and remediation strategy that contains threats and avoids slow manual removal. Use cloning and snapshots to quickly restore systems to known good states.

Protect data with on-premise backups that include redundancy such as raid and local storage. Evaluate encrypted cloud storage and self-hosted options with client-side encryption to keep offsite backups private.

Audit your system baseline with vulnerability scanners to reveal configuration gaps and harden defenses. Authenticated scans simulate administrator checks, uncover kernel updates, password weaknesses, and file integrity status.

Explore Windows hardening sources such as open scrap baselines, Defense Information System Agency templates, and security templates, with scripts to automate Windows seven to ten and guidance on UAC.

Explore how Windows security baselines and the security compliance manager streamline hardening, auditing, and customizing policies via group policy, local group policy, and GPO exports.

This lecture covers linux hardening across distributions, kernel redesign, and the Google kernel self protection project, stressing integration of geo security, pax, SELinux and app armor into the kernel.

Learn how to detect and prevent security drift by monitoring changes that move systems away from the hardened baseline, using Osquery file integrity tools, custom scripts, and automated restoration.

Explain why secure deletion on solid state drives differs from mechanical drives due to trim command, wear leveling, and spare area, and emphasize encryption as the only reliable unrecoverable guarantee.

Understand anti-forensics and how to minimize evidence by avoiding data creation and enabling encryption. Learn layered defenses, from whole disk encryption to encrypted removable media and secure containers.

Search and remove metadata across Windows, Mac, and Linux using tools like exiftool, batch purifier light, and batch purify to understand and manage exif data in files.

Disable geotagging across iPhone, Android, and cameras. Avoid uploading files unless necessary; scrub metadata with document inspectors, watch for tracked edits, and separate aliases and environments to improve anonymization.

Camera fingerprinting uses sensor noise to uniquely identify a camera and link photos or videos to it, threatening anonymity; it notes Google's patent and countermeasures like aliases and privacy tools.