Endpoint security in layers: patching, hardening, EDR and encryption for a 50-person company

In almost every incident I have handled at a small or mid-size company, the first foothold was an endpoint: a laptop that opened a malicious attachment, a developer machine with a stolen browser session, or a server running an outdated service. Firewalls and cloud controls matter, but attackers go where the people and the credentials are.

This post describes the endpoint programme I recommend for a company of about fifty people with mixed macOS and Windows laptops, a few Linux servers and no dedicated security team. It is built in layers, because no single control holds on its own, and it is ordered so that the first steps give the most protection.

What an endpoint is, and why layers

An endpoint is any device that connects to your systems and processes your data: laptops, desktops, servers, phones, tablets and increasingly IoT devices such as meeting room screens. Each runs software that can be vulnerable, is used by people who can be tricked, and stores credentials that open other doors.

Defence in depth means that when one layer fails, the next limits the damage. A phishing email gets through the mail filter; the user does not have admin rights, so the malware cannot install a driver; EDR flags the unusual process; disk encryption protects the data when the laptop is later stolen.

Layer 0: know what you have

You cannot protect devices you do not know about. Start with an inventory that answers: which devices exist, who uses each one, what operating system and version it runs, and whether it is managed.

The practical way to get and keep this inventory is a mobile device management (MDM) or unified endpoint management tool. Enrol every company laptop and phone. For personally owned phones used for work email, use the lighter "work profile" enrolment that manages only company apps and data.

Target: 100% of company devices enrolled and reporting within the last seven days. Anything not reporting is either lost, retired or unmanaged, and each case needs an answer.

Layer 1: patch quickly and automatically

Most exploited vulnerabilities on endpoints have had a patch available for weeks or months. Patching is the highest-value control on this list.

• Turn on automatic operating system updates through MDM, with a deadline after which the device restarts to install them. Seven days for normal updates and 48 hours for actively exploited vulnerabilities are reasonable targets.
• Keep browsers on automatic updates; they are the most attacked software on a laptop.
• Patch third-party applications too, especially PDF readers, office suites, VPN clients and developer tools.
• On Linux servers, enable unattended security updates or a scheduled patch pipeline, and reboot when kernel updates require it.

# Debian / Ubuntu servers: automatic security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Measure the patch level weekly from the MDM: the share of devices on a supported OS version and with updates installed within your deadline.

Layer 2: harden the configuration

A default operating system install favours convenience. A hardening baseline changes the settings that matter most:

• No local administrator rights for daily use. Give admin rights temporarily through a request process or a privilege management tool. This one change blocks a large class of malware.
• Screen lock after a few minutes of inactivity, with a password or biometric unlock.
• Firewall on for every device.
• Disable or remove unused services and legacy protocols, such as SMBv1 on Windows.
• Browser policies: block installation of unapproved extensions, which are a common way to steal sessions.
• Secure boot enabled, so the boot chain cannot be tampered with easily.

You do not have to invent the settings. The CIS Benchmarks publish detailed, versioned baselines for each operating system, and most MDM tools can apply a subset as policy. Start with the most important items rather than all of them, and expand over time.

Layer 3: encrypt the disks

Lost and stolen laptops are routine. With full-disk encryption, a lost device is an inconvenience; without it, it may be a reportable data breach.

• FileVault on macOS and BitLocker on Windows, enforced by MDM.
• Escrow recovery keys in the MDM, so IT can help users who forget their password and you can prove encryption was on if a device is lost.
• On servers, use encrypted volumes; in the cloud, encryption of block storage is usually a single setting.

Layer 4: detect and respond with EDR

Antivirus that matches known file signatures catches a shrinking share of real attacks. Endpoint detection and response (EDR) tools record process, file, network and login activity, detect suspicious behaviour such as a document spawning a script interpreter, and let you isolate a device remotely.

What matters when you deploy EDR:

• Coverage. Every laptop and server, checked against the inventory.
• Someone watches the alerts. For a company without a security team, a managed detection and response (MDR) service that triages alerts around the clock is often the right choice.
• Response actions are tested. Practise isolating a test machine so you know the steps before you need them.
• Tamper protection is on, so malware or a user cannot disable the agent.

Layer 5: control what runs

Application control lets only approved software run. On general-purpose laptops this is hard to do strictly, but there are useful middle grounds:

• Block execution from user download folders and temporary directories.
• Allow only signed and notarised applications on macOS, which is the default with Gatekeeper.
• On Windows, attack surface reduction rules block common abuse such as Office applications creating child processes.
• On servers, where the software set is known, strict allow-listing is realistic and very effective.

Layer 6: protect identities on the device

Endpoints hold the keys to everything else. Protect them:

• Phishing-resistant MFA, such as passkeys or security keys, for email, single sign-on and cloud consoles.
• Short session lifetimes for high-value systems, and conditional access that requires a managed, compliant device.
• Developer secrets (cloud keys, SSH keys, tokens) kept in an agent or vault rather than plain files, with short-lived credentials where possible.

When a device is lost or compromised

Write the procedure before it happens. A one-page runbook is enough:

1. The user reports the loss or suspicious behaviour immediately, through a channel that works without the device.
2. IT locks or wipes the device through MDM, and the EDR isolates it if it is online.
3. Revoke the user's sessions and tokens in single sign-on, email and source control, and rotate any secrets that were on the device.
4. Check the MDM record for encryption status, which decides whether the loss is a reportable incident.
5. Review EDR and login logs for activity after the reported time.

A realistic rollout plan

Key takeaways

• Endpoints are where most attacks land, because people and credentials live there.
• Start with an inventory and fast automatic patching; they give the most protection per hour.
• Remove daily admin rights, encrypt disks and apply a hardening baseline.
• EDR only helps if every device has it and someone responds to alerts.
• Write and practise the lost or compromised device procedure in advance.

References

• CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks
• NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise: https://csrc.nist.gov/pubs/sp/800/124/r2/final
• Microsoft, Attack surface reduction rules: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction
• Apple Platform Security guide: https://support.apple.com/guide/security/welcome/web
• Debian wiki, UnattendedUpgrades: https://wiki.debian.org/UnattendedUpgrades