The Hardened Stack — Ep. 4: Endpoint Hardening
From Holding the Line: Practical IT Security · 00:55:37
Show by SECURITIES
Welcome to Episode 4 of the podcast series covering The Hardened Stack: A Field Guide to Securing Identity, Endpoints, Cloud, and Everything Your IT Team Runs by Sho Shimoda.In a modern organisation, the true security perimeter is not the firewall at head office—it is every scattered keyboard on home Wi-Fi, in airport lounges, and on factory floors. When a user clicks a malicious link or opens a phished attachment, code runs directly on the endpoint inside your network. In Chapter 4: Endpoint Hardening, we explore how to build self-defending endpoints using layered security controls. We walk through patch management for third-party software, Endpoint Detection and Response (EDR), removing local admin rights, deploying LAPS, enforcing BitLocker disk encryption, and securing BYOD mobile devices.What You’ll Learn in This EpisodeThe Endpoint as the Front Line: Why traditional network perimeters fail when threats arrive inside the wall, and how defense-in-depth keeps endpoints self-defending anywhere in the world.Decisive Patch Management: Going beyond OS updates to cover third-party applications (browsers, PDF readers) and firmware—and why measuring patching based on reboots rather than downloads is critical.EDR vs. Traditional Antivirus: Why signature-matching antivirus misses "living-off-the-land" attacks, how EDR flags suspicious behavioral sequences, and the power of remote network isolation.Eliminating Standing Local Admin Rights: Why user local admin rights are one of the most damaging defaults in IT, and how providing software portals and logged elevation paths removes friction.Stopping Lateral Movement with LAPS: Deploying Windows Local Administrator Password Solution (LAPS) so every machine holds a unique, rotating local admin password stored securely in Entra ID or Active Directory.Application Control & Allow-Listing: Using AppLocker or WDAC starting in audit mode to learn environment baselines before flipping rules to enforce.Disk Encryption & Key Escrow: Enforcing TPM-backed BitLocker full-disk encryption and centrally escrowing recovery keys so a lost laptop is merely lost hardware, not a reportable data breach.Securing Mobile & BYOD: Using Mobile Application Management (MAM) in Intune to containerize and wipe corporate data on personal phones without seizing or wiping personal photos.At Meridian Foods: How service desk lead Lucy Fernández and senior sysadmin Hana Sato remediated a travelling finance laptop that was eleven updates behind, lacked disk encryption, and held standing local admin privileges.About the Source BookThe Hardened Stack (Book 2 of the Security Book Series by Sho Shimoda, published by ReceiptRoller Inc.) is a practical, blue-team field guide designed for IT generalists, systems engineers, and DevOps administrators. Across 16 chapters, it provides over 80 real-world configuration scripts, PowerShell commands, and hardening checklists to secure Microsoft 365, endpoints, cloud accounts, and local networks on a realistic budget.
More episodes of Holding the Line: Practical IT Security
More episodes
- The Hardened Stack — Ep. 9: Secure Development and DevSecOps
- The Hardened Stack — Ep. 10: Secrets and Key Management
- The Hardened Stack — Ep. 8: Email Security
- The Hardened Stack — Ep. 6: Securing the Cloud (Azure and AWS)
- The Hardened Stack — Ep. 7: Microsoft 365 and Entra ID Security
- The Hardened Stack — Ep. 5: Network Security and Zero Trust
- The Hardened Stack — Ep. 3: Identity and Access Management
- The Boardroom Firewall (Ep. 12) — Ransomware: The Decisions You Will Face
- The Boardroom Firewall (Ep. 13) — Incident Response and Crisis Communications
- The Boardroom Firewall (Ep. 14) — Cyber Insurance — What It Does and Doesn't Cover
PodSearch is a free, independent podcast search engine. Read about PodSearch, the privacy policy or contact us.