Device Hardening and Malware Detection

You’ll be able to

Identify common endpoint vulnerabilities
Choose appropriate device-hardening controls
Use event clues to classify suspicious device behavior

Hardening removes easy paths

Device security starts by reducing unnecessary risk: patch known vulnerabilities, remove unused software, require strong authentication, encrypt storage, restrict administrator privileges, and run anti-malware or endpoint detection tools.

Worked example

A laptop suddenly launches an unknown process at startup, contacts a suspicious domain, and disables security updates.

1.The behavior suggests malware persistence and command-and-control activity.
2.Immediate containment could include isolating the device from the network.
3.Evidence includes process names, startup entries, DNS requests, and update logs.
4.Recovery may require malware removal, patching, credential reset, or reimaging.

Answer: This is not just a performance problem. It is a likely compromise because multiple indicators point to persistence, evasion, and external communication.

Checkpoint

Which mitigation most directly reduces damage from a stolen laptop?

Checkpoint

Signature-based antivirus reports nothing, but a workstation shows a new scheduled task making outbound connections at 3 a.m. What is the best conclusion?

Answer the 2 checkpoints as you read.