Endpoint security is the ongoing discipline of configuring, updating, restricting, and monitoring laptops, phones, and servers.
It is broader than a blocking product and broader than host telemetry, because it includes how the device is built and who may change it.
How it works
A sound device starts from a known configuration, receives updates, runs with limited privileges, and reports when that baseline drifts.
Phones and laptops leave the building, so loss, shared use, and untrusted networks are part of the same discipline as the server in a rack.
Buying a protection suite or a detection tool does not finish the work if administrators share unlimited rights or if old devices never receive updates.
Owners need an inventory, a standard build, and a decision for what happens when a device cannot meet the standard.
Concrete examples
- A company image disables unused services and gives users an account that cannot install system wide software.
- A lost phone can be locked and wiped because the inventory knew who carried it and which data it held.
- A server missing two months of updates is blocked from handling customer traffic until it matches the baseline.
Protective measures
- Keep an inventory of laptops, phones, and servers, including the owner and the data each one may hold.
- Apply updates on a schedule and isolate devices that fall too far behind to be trusted.
- Give people ordinary accounts for daily work and separate, logged rights for administration.
- Decide in advance what you will do with a lost device, a silent agent, or a system you cannot update.
Related articles
The preventive software that blocks unwanted programs on the device is explained in What is endpoint protection?.
Telemetry and containment after something has already happened on the host are covered in What is endpoint detection and response?.
How device standards are coordinated across a large organization is part of What is enterprise cybersecurity?.