All news with #endpoint security tag

🖼️ Many vendor and lab reports — from Gartner and Forrester market quadrants to specialist tests like AV‑Comparatives, SE Labs and MITRE Engenuity’s ATT&CK Evaluations — offer distinct, valuable perspectives on endpoint security. Security teams should selectively combine these assessments to triangulate performance, match operational requirements, and validate vendor claims before procurement decisions.

🛡️ Zero-day attacks exploit software vulnerabilities that are unknown to the vendor, enabling attackers to compromise systems before patches are available. They target high-value platforms such as operating systems, web browsers, enterprise applications, and IoT devices, often using spear-phishing or zero-click techniques. Because signature-based tools frequently miss novel exploits, effective defense requires rapid patching, behavior-based detection (EDR, NDR, XDR), network segmentation, and investigative analysis of packet-level data to detect, contain, and learn from incidents.

🔒 Kaspersky has released a major update to Kaspersky Embedded Systems Security, targeting the unique risks of legacy and resource-constrained devices. The Windows edition introduces a behavioral analysis engine plus Automatic Exploit Prevention, Anti-Cryptor, a Remediation Engine, BadUSB protection, a firewall, and a security status indicator. The Linux edition adds certificate-based allowlisting and Web Threat Protection to simplify safe updates and guard web-enabled embedded devices. Planned Q1 2026 improvements include MDR integration, BadUSB for Linux, and ARM support.

🔒 This article identifies seven security practices that have become obsolete in modern, cloud-first and hybrid workplaces. Contributors including Amit Basu, George Gerchow and others warn against relying on perimeter defenses, legacy VPNs, SMS-based 2FA and on-premises SIEMs, and caution about overreliance on EDR or compliance-only programs. It recommends shifting to Zero Trust, SASE, continuous monitoring and active security awareness to close visibility gaps and reduce risk.

⚡Microsoft will introduce a new Teams call handler, ms-teams_modulehost.exe, that runs as a child process to manage the calling stack separately from the main ms-teams.exe application, improving startup times and in-meeting performance. The change is transparent to end users and requires no retraining. Administrators should allowlist the new process in security and endpoint protection systems and notify helpdesk staff to avoid false positives during the rollout.

🔒 Ringfencing, or granular application containment, enforces least privilege for authorized software by restricting file, registry, network, and interprocess access. It complements allowlisting by preventing misuse of trusted tools that attackers commonly weaponize, such as scripting engines and archivers. Effective rollout uses a monitoring agent, simulated denies, and phased enforcement to minimize operational disruption. Properly applied, containment reduces lateral movement, blocks mass exfiltration and ransomware encryption while preserving business workflows.

🛡️ Microsoft will integrate Sysmon natively into Windows 11 and Windows Server 2025, removing the need to deploy the standalone Sysinternals tool. The built-in functionality will preserve Sysmon’s capabilities, including support for custom configuration files and advanced event filtering, and logs events to the Windows Event Log. Administrators can enable it via Optional Features or run sysmon -i (or sysmon -i <config>) to load a custom configuration, and updates will be delivered through Windows Update to simplify management and improve coverage in large environments.

🔒 Palo Alto Networks found that 26% of Linux systems and 8% of Windows systems are running outdated versions across telemetry from 27 million devices spanning 1,800 companies. The analysis also shows 39% of devices lack active endpoint protection and roughly one-third of devices operate outside IT control. Poor segmentation and unmanaged edge devices increase the risk of undetected compromise.

🔒 Small and medium-size businesses face rising, measurable cyber risk as ransomware incidents increase and attacks spike during the holiday season. Resource constraints and end-of-life Windows 10 devices magnify exposure, while firmware-level and endpoint gaps can defeat traditional defenses. A layered, defense-in-depth approach across silicon, the operating system, and endpoints reduces attack surfaces. Business-grade devices such as the ASUS Expert Series integrate these protections to turn necessary upgrades into strategic security investments.

🔔 The Windows 11 Start menu has received its first major redesign since 2021 and is rolling out with the November 11 Patch Tuesday update. The new Start is scrollable and places the All apps list on the main screen, offering a categorized view (groups built locally from a JSON file) and a classic A‑to‑Z grid. The UI adapts column counts to screen size, lets you hide the Recommended feed via Settings > Personalization > Start, and is included in Build 26200.7019 and 26100.7019 or newer though it may not enable immediately after updating.

🔒 Samsung Knox is a built-in security platform for Samsung Galaxy devices that combines hardware- and software-level protections to safeguard enterprise data and provide IT teams with centralized control. It layers defenses — including AI-powered malware detection, curated app controls, Message Guard for zero-click image scanning, and DEFEX exploit detection — while integrating with EMMs and offering granular update management via Knox E-FOTA. The platform emphasizes visibility, policy enforcement, and predictable lifecycle management to reduce risk and operational disruption.

🛡️ Kaspersky has introduced Kaspersky for Linux, extending its award-winning home security lineup to 64-bit Linux desktops and laptops. The product adapts the vendor's enterprise-grade Linux solution for home users and combines real-time monitoring, behavior-based detection, removable-media scanning, anti-phishing, online payment protection, and anti-cryptojacking. Distributed as DEB and RPM packages, installation requires a My Kaspersky account and a 30-day trial is available; subscription tier does not change Linux feature availability while GDPR readiness is pending.

🔒 ThreatLocker has released DAC for macOS in Beta, extending its configuration-scanning capability to Apple endpoints. Using the existing ThreatLocker agent, the feature can scan Macs up to four times daily and surface risky settings—FileVault, firewall, sharing/remote access, admin accounts, Gatekeeper, update policies—directly in the same console used for Windows. Findings are grouped by endpoint and category and include step-by-step remediation plus mappings to frameworks such as CIS, NIST, ISO 27001, and HIPAA. The aim is to make misconfigurations visible and remediable before they become security incidents.

🛡️ In SE Labs’ September 2025 Enterprise Endpoint Security evaluation, CrowdStrike Falcon earned the AAA EPS certification and recorded 100% Protection Accuracy, 100% Legitimate Accuracy and 100% Total Accuracy with zero false positives. SE Labs tested 75 targeted and 25 general attacks across full kill chains; Falcon detected and blocked or neutralized every attempt. The platform also won three SE Labs awards, including Enterprise Endpoint (Windows), Enterprise Ransomware, and Falcon Go for Small Business New Endpoint.

🔒 CrowdStrike has enhanced Falcon Insight for ChromeOS with automated device response actions and GovCloud availability. The update enables instant device disabling and placement into restricted organizational units to block further activity and reduce lateral movement. Response actions can be executed manually from the Falcon console via a prebuilt Falcon Foundry app or automated through Falcon Fusion SOAR workflows. These capabilities ingest native ChromeOS telemetry without extra agents to simplify detection and containment.

🖱️ A recent episode of the Smashing Security podcast examines how commonplace devices and online behaviour can create unexpected security risks. Hosts discuss academic work that turns a standard computer mouse into an acoustic eavesdropping sensor, showing how a malicious webpage could exploit peripheral hardware. They also consider a ransomware crew’s reputation problems, and round out the episode with lighter items such as a quirky baked potato hack and a literary detour to Paraguay.

🎥 Amazon Connect now supports agent screen recording for ChromeOS devices, enabling supervisors and quality teams to capture agents' on-screen activity while handling voice calls, chats, and tasks. The capability complements audio recordings and chat transcripts to surface coaching opportunities and identify process non‑compliance. Screen recording is available in all AWS Regions where Amazon Connect operates. Refer to documentation and the pricing page for technical and billing details.

🔒 Many small and mid-sized businesses adopted EDR to address growing threats, but alert overload and limited context can overwhelm security teams. Kaspersky Next XDR Optimum groups related alerts, enables bulk responses, and lets operators block compromised users in Active Directory directly from alert cards. It also integrates a cloud sandbox for file analysis and embeds targeted security awareness training assignable from the alert. For teams struggling with volume or lacking context, migrating from EDR to XDR can improve containment and reduce response time without major redeployment.

🚀 JS Bank migrated its distributed IT estate to a unified Google ecosystem—deploying 1,500 Chromebooks and Chromeboxes while adopting Google Workspace and Chrome Enterprise Premium. The change delivered nearly 90% endpoint standardization, cut device management time by 40%, and halved daily support tickets. Built-in ChromeOS protections simplified security and reduced reliance on multiple third-party antivirus and anti-malware tools.

🔒 A new proof-of-concept named EDR-Freeze shows that Windows Error Reporting can be abused from user mode to suspend antivirus and EDR processes. The method leverages WerFaultSecure and the MiniDumpWriteDump API so the dumper pauses a target process and then the dumper itself is frozen, leaving the security agent inoperative without a kernel driver. Researcher TwoSevenOneThree validated the technique on Windows 11 24H2, describing it as a design weakness rather than a classic vulnerability, and defenders can monitor WER invocations or harden reporting components to mitigate the risk.