Endpoint management is an IT and cybersecurity process that consists of two main tasks: evaluating, assigning and overseeing the access rights of all endpoints; and applying security policies and tools that will reduce the risk of an attack or prevent such events.

Endpoint management is typically overseen by a cross-functional team of network administrators and information security (infosec) professionals. A comprehensive, effective endpoint management solution:

• Ensure that only authenticated and approved devices are able to connect to the network
• Deploys cybersecurity tools and enforces related security policies for all approved devices through a lightweight software app or agent
• Establishes a centralized dashboard or console for the infsosec team to oversee all devices and manage activity

What Is an Endpoint?

An endpoint is any device that connects to the corporate network from either within or outside its firewall. Examples of endpoint devices include:

• Laptops
• Tablets
• Mobile devices
• Internet of things (IoT) devices
• Point-of-sale (POS) systems
• Switches
• Digital printers
• Other devices that communicate with the central network

Which Endpoints Need to Be Managed?

To ensure the security of the network and all associated assets, such as corporate data, customer information, intellectual property (IP) and other sensitive information, all devices need to be formally screened, authenticated and monitored through an endpoint management tool.

In particular, personal devices that either access the network remotely or connect to the local network on premise — which most often includes laptops, smartphones and tablets — may be at greater risk for compromise as compared to endpoints that are owned and managed by the organization. This is due to potentially insecure or insufficiently secure tooling on the device itself, as well as inconsistent enforcement of connection procedures and protocols.

Endpoint management is of even greater importance to organizations given that COVID-19 has accelerated remote work capabilities and the use of personal networks and devices within a business setting.

What Is Unified Endpoint Management (UEM)?

Unified endpoint management (UEM) refers to the ability of the infosec team to secure and control all endpoints via a centralized console or dashboard.

Through the UEM dashboard, network administrators can:

• Push operating system (OS) and application updates and patches to all affected devices
• Apply and enforce security policies to registered devices
• Access the device remotely and perform certain tasks, such as resetting the password or wiping the device in the event it was lost or stolen
• Establish a process and procedure for employees to register personal devices that they wish to connect to the network

Benefits of UEM

By managing all endpoints and associated activity through a UEM solution, the organization can generate many important benefits, such as:

• Faster detection of security threats
• Improved response and mitigation times in the event of a breach
• Fast and efficient deployment of the latest OS/software updates and security patches
• Lower total cost of ownership through efficiencies of scale

UEM, Mobile Device Management (MDM) and Enterprise Mobility Management (EMM)

Sometimes used interchangeably, these three terms have distinct meanings within the infosec community.

Mobile Device Management (MDM): Refers to management and monitoring tools that apply exclusively to mobile devices.

Enterprise Mobility Management (EMM): Refers to management and monitoring tools that apply to mobile devices and mobile infrastructure components such as wireless networks and routers, as well as IoT devices.

UEM: Refers to endpoint management software and associated tools that authenticate and control all endpoints, as well as a centralized console to oversee all associated activity.

What Is Endpoint Security

Endpoint security, or endpoint protection, is the cybersecurity approach to defending endpoints from a variety of external and internal digital threats in both a traditional on-prem network and a cloud environment.

How Are Endpoint Security and Endpoint Management Related?

Endpoint security and endpoint management are two core components within a comprehensive cybersecurity strategy. These functions are both interrelated and interdependent — meaning that the effectiveness of each individual component is inextricably linked to and dependent upon the other.

Any time an endpoint is being used while connected to the network, data is created and exchanged. This activity, no matter how benign or common, can serve as an attack vector for cybercriminals.

Endpoint security relates to any tool, technology, process, procedure or policy that is used to protect the endpoint. These measures typically leverage advanced analytics to gather and monitor all network activity across all endpoints for indicators of compromise (IOCs). Endpoint security also includes remediation of attacks and removal of threats.

Endpoint management, on the other hand, is the overarching capability that ensures only authenticated and approved devices can connect to the network and that they do so only at the appropriate access level. Endpoint management will also ensure that endpoint security policies and tools are consistently applied and enforced across all devices.

Components of Endpoint Management

Endpoint Management Tools

Device Management and Support. The primary objective of any endpoint management system is to oversee the activity of each device. This may include:

• Sending the device configurations, commands and queries
• Managing OS and application updates
• Defining WiFi and VPN configurations
• Changing passwords
• Assuming control of the device via remote access

As discussed above, device management may include MDM, EMM or UEM systems.

Endpoint Management Console. Given the potentially millions of endpoints that an organization must manage and oversee, it is important for the cybersecurity team to have a centralized view of all registered endpoints.

The UEM console acts as an endpoint manager, granting the organization visibility into all devices, as well as their current status and past activity. This dashboard will also provide reporting and alerting capabilities, helping the organization take a holistic view of all activity and prioritize actions.

Endpoint Management Policies

In addition to device management and support, endpoint management incorporates several policies that dictate device authentication and network access. These may include but are not limited to:

Bring Your Own Device (BYOD). In recent years, many organizations have shifted to a “BYOD” model, which allows employees to use a variety of personal devices, including mobile devices, to conduct official business.

On one hand, organizations must secure these devices and ensure they do not pose any undue risk to the organization. On the other, these devices belong to the employee and therefore cannot be subject to wide-reaching security measures or restrictions.

It is the responsibility of the endpoint management team to create a clear and effective BYOD policy that outlines how the organization will access the device and which apps and data are subject to monitoring and analysis. The endpoint management team must also consider how this policy will be enforced.

Privileged Access Management (PAM)

Privileged access management (PAM) uses the Principle of Least Privilege (POLP) define and control privileged users and administrative accounts in order to minimize identity-based malware attacks and prevent unauthorized access of the network or associated assets.

Zero Trust

Zero Trust is a security framework that requires all users, whether in or outside the organization’s network, to be authenticated, authorized and continuously validated for security configuration and posture before being granted or keeping access to applications and data.

Importance of Endpoint Management Today

Endpoint security starts with endpoint management.

As organizations face mounting risk from a variety of attacks and an increasingly sophisticated network of cybercriminals, it is important to ensure that every endpoint is properly secured. This includes authenticating the device prior to allowing its connection to the network, defining its access level and monitoring activity for any signs of risk.

Organizations should engage a trusted cybersecurity partner to help maintain visibility and control of all endpoints. This will help ensure the organization is prepared to face critical threats, including those within a cloud environment.

Finally, an endpoint management solution will help automate many aspects of the prevention agenda. For example, UEM software and centralized console will allow the cybersecurity team to oversee patch management and system upgrades. This functionality significantly reduces the likelihood of an attack through an OS or software flaw — commonly known as a zero-day attack.

It is important to remember that endpoint management is just one component within a broader cybersecurity strategy. To ensure sufficient protection, organizations must incorporate principles related to Cybersecurity, Network Security, Application Security, Container Security, and IoT Security in addition to their endpoint security strategy and endpoint management tools.