7: The End Point

The end point must have elemental security, automated control management, and isolation between layers to prevent or minimize attacks in a manner that scales to transform security management.

The end point is of increasing importance as the 5 trends in this book enjoy higher levels of adoption. With an inability to monitor on the network beyond a 2, 3, or 5-tuple in packets headers, methods to perform security, operational, and network management shift to the end point. Detection must shift to prevention as detecting exploits as they execute is too late. Although it should be noted, that in the kill chain TM model (Lockheed Martin, 2019), there is still the opportunity to reduce the impact of an exploit if detected early in the kill chain, although often there is little time to react. A requirement for protection pushed the responsibility to the originating source of software instead of to add on products that may intercept and detect prior to code executing. This responsibility shift will be expanded upon later in this chapter. Inherently secure systems are not only desired, but required in this model. Fine grain control, management, monitoring, as well as the ability to attest to the expected state of a system are also critical. Interestingly, this shift presents an opportunity to manage networks and systems with a fewer number of resources, even combining methods of management and monitoring for end points (servers, clients, devices, etc.).