Cyber Wiki Learning Path
Windows Endpoint Defense
Protect Windows startup, credentials, privilege, local configuration, storage, firewalling, remote administration, and endpoint evidence.
Recommended Sequence
16 connected entries
Antivirus, EDR, and XDR
Antivirus, EDR, and XDR is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Systems security concept · IntermediateBIOS and UEFI Security
BIOS and UEFI Security concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Endpoint data-protection control · IntermediateBitLocker Drive Encryption
BitLocker is a Windows full-volume encryption capability that protects data at rest by binding volume keys to trusted startup conditions, recovery methods, and optional user authentication.
Endpoint monitoring concept · AdvancedEndpoint Detection and Response Telemetry
EDR telemetry records endpoint behavior such as process execution, modules, files, registry, users, network connections, scripts, drivers, security events, and response actions so analysts can detect and investigate activity in context.
Windows credential-protection concept · AdvancedLSASS and Credential Protection
The Local Security Authority Subsystem Service enforces local security policy, validates certain logons, creates access tokens, and handles credential material; protecting LSASS is central to limiting credential theft from Windows endpoints.
Systems security concept · IntermediateOperating System Fundamentals
Operating System Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Remote administration security concept · AdvancedRemote Desktop Security
Remote Desktop security protects Windows interactive administrative sessions by controlling who can connect, how endpoints authenticate, where credentials are exposed, which channels are redirected, and how activity is monitored and contained.
Systems security concept · IntermediateSecure Boot
Secure Boot concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Embedded platform-security control · AdvancedSecure Boot for Embedded Devices
Secure boot for embedded devices creates a chain of verified software from an initial trusted component through bootloader, operating system, firmware, and application so unauthorized code is not executed during startup.
Systems security concept · IntermediateSystem Hardening
System Hardening concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Windows privilege-boundary control · IntermediateUser Account Control
User Account Control limits routine use of administrative privileges by giving administrators a filtered standard token and requiring an elevation decision before a process receives the full administrative token.
Authentication architecture concept · IntermediateWindows Authentication
Windows authentication is the collection of local and domain mechanisms Windows uses to verify identities, establish logon sessions, obtain network credentials, and authorize access to operating-system and enterprise resources.
Windows platform-security control · AdvancedWindows Credential Guard
Windows Credential Guard uses virtualization-based security to isolate selected domain credentials from the normal operating system so that compromise of the host is less likely to expose reusable NTLM hashes and Kerberos ticket-granting tickets.
Host firewall control · IntermediateWindows Defender Firewall
Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.
Privileged account management control · IntermediateWindows Local Administrator Password Solution
Windows Local Administrator Password Solution automatically generates, rotates, stores, and controls retrieval of unique local administrator passwords so a compromised password on one device cannot be reused across an entire fleet.
Windows configuration-security concept · IntermediateWindows Registry Security
The Windows Registry is a hierarchical configuration database whose keys and values influence operating-system, service, application, security, persistence, and user behavior; protecting it requires permission control, change monitoring, and recovery discipline.