{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/endpoint","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/endpoint/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/endpoint/"},"term":{"en":"Endpoint","da":"Endpoint"},"aka":{"en":["end-user device","endpoint device"],"da":["slutbrugerenhed"]},"domain":["security","cs"],"cluster":"controls","layer":"host","status":"current","summary":{"en":"Any device that connects to the network at its edge and is used directly - a PC, phone, printer or similar.","da":"Enhver enhed, der kobles på netværket i dets yderkant og bruges direkte - fx en pc, mobil eller printer."},"body":{"formal":{"en":"A device at the end of a network connection that people or machines use directly, such as a laptop, phone, tablet, printer or smart sensor, as opposed to equipment that only passes traffic along.","da":"En enhed for enden af en netværksforbindelse, som mennesker eller maskiner bruger direkte, fx en bærbar, mobil, tablet, printer eller smart sensor, i modsætning til udstyr, der blot sender trafikken videre."},"plain":{"en":"Like the houses along a road system - the places the roads actually lead to, where people live and work, rather than the junctions in between.","da":"Som husene langs et vejnet - de steder, vejene faktisk fører hen, og hvor folk bor og arbejder, i modsætning til vejkrydsene imellem."},"inPractice":{"en":"At a school, a teacher's laptop that travels between home, classroom and staff room is one endpoint; the screen in the classroom and the printer in the office are two more the school's IT lead must track.","da":"På en skole er en lærers bærbare, der flytter mellem hjemmet, klasselokalet og lærerværelset, ét endpoint; skærmen i klassen og printeren på kontoret er to mere, som skolens IT-ansvarlige skal holde styr på."},"whyItMatters":{"en":"Endpoints are where people click, plug in and log in, so they are where most attacks start - and every one needs to be known, updated and watched.","da":"Endpoints er dér, folk klikker, sætter ting i og logger ind, så det er dér, de fleste angreb begynder - og hvert eneste skal kendes, opdateres og overvåges."}},"deepDive":{"en":"In security usage an endpoint is a host that terminates network communication and runs workloads or serves users, as opposed to intermediate infrastructure such as routers, switches, firewalls and load balancers. The category is broad: managed laptops and desktops, servers and virtual machines, mobile devices, and a long tail of embedded devices - printers, IP phones, cameras, badge readers, medical devices, building-management controllers, PLCs. The distinction that matters operationally is not device type but manageability: whether the device can run an agent (EDR, MDM/UEM client, patch agent), whether the organisation controls its configuration, and whether its firmware is still supported. Headless and embedded endpoints often cannot take an agent at all and must be protected by network segmentation, NAC and passive monitoring instead.\n\nNote that the word has a second, unrelated meaning in software engineering, where an API endpoint is a URL or route that accepts requests. Endpoint security is about the device, API security about the interface; the two are occasionally conflated in procurement documents.\n\nEndpoint security is a layered stack: hardened baseline configuration (CIS Benchmarks, Microsoft security baselines), full-disk encryption (BitLocker, FileVault, LUKS) with keys escrowed centrally, host firewall, application control, patching of OS, applications and firmware, local administrator rights removed or managed (for example with Windows LAPS), EPP/EDR, and device management that can wipe a lost device. Modern designs add device health attestation - TPM-backed measured boot and secure boot state reported to the identity provider - so that conditional access in a Zero Trust architecture can refuse a request from a device that is unmanaged, out of date or tampered with. BYOD complicates this: the organisation typically manages an app container or work profile rather than the whole device, which limits both control and visibility and has data-protection implications for monitoring employees' private devices.\n\nISO/IEC 27002:2022 control 8.1 (user endpoint devices) covers registration, protection and acceptable use, and CIS Controls v8 treats end-user devices, servers and mobile devices as enterprise assets under Control 1 (inventory), Control 4 (secure configuration) and Control 10 (malware defenses). Endpoints matter disproportionately because initial access - phishing attachments, drive-by downloads, malicious USB media, stolen session tokens in browsers - lands there, and because credentials cached on an endpoint are the raw material for lateral movement.","da":"I sikkerhedssammenhæng er et endpoint en vært, der afslutter netværkskommunikation og kører workloads eller betjener brugere, i modsætning til mellemliggende infrastruktur som routere, switche, firewalls og load balancere. Kategorien er bred: administrerede bærbare og stationære pc'er, servere og virtuelle maskiner, mobile enheder og en lang hale af indlejrede enheder - printere, IP-telefoner, kameraer, kortlæsere, medicoudstyr, bygningsautomatik og PLC'er. Den skelnen, der betyder noget i driften, er ikke enhedstypen, men om enheden kan administreres: om den kan køre en agent (EDR, MDM/UEM-klient, patchagent), om organisationen styrer dens konfiguration, og om dens firmware stadig understøttes. Enheder uden skærm og indlejrede enheder kan ofte slet ikke få en agent og må i stedet beskyttes med netværkssegmentering, NAC og passiv overvågning.\n\nOrdet har også en anden, urelateret betydning i softwareudvikling, hvor et API-endpoint er en URL eller route, der modtager forespørgsler. Endpoint-sikkerhed handler om enheden, API-sikkerhed om grænsefladen; de to bliver af og til blandet sammen i udbudsmateriale.\n\nEndpoint-sikkerhed er en lagdelt stak: hærdet basiskonfiguration (CIS Benchmarks, Microsofts security baselines), fuld diskkryptering (BitLocker, FileVault, LUKS) med nøgler deponeret centralt, værtsbaseret firewall, applikationskontrol, patching af styresystem, applikationer og firmware, lokale administratorrettigheder fjernet eller styret (fx med Windows LAPS), EPP/EDR og enhedsstyring, der kan slette en mistet enhed. Moderne design tilføjer attestering af enhedens tilstand - TPM-baseret measured boot og status for secure boot rapporteret til identitetsudbyderen - så betinget adgang i en Zero Trust-arkitektur kan afvise en anmodning fra en enhed, der er uadministreret, forældet eller manipuleret. BYOD komplicerer billedet: organisationen styrer typisk kun en app-container eller en arbejdsprofil frem for hele enheden, hvilket begrænser både kontrol og indsigt og har databeskyttelsesmæssige konsekvenser, når man overvåger medarbejderes private enheder.\n\nISO/IEC 27002:2022 kontrol 8.1 (brugerendepunktsudstyr) dækker registrering, beskyttelse og acceptabel brug, og CIS Controls v8 behandler slutbrugerenheder, servere og mobile enheder som virksomhedsaktiver under Control 1 (fortegnelse), Control 4 (sikker konfiguration) og Control 10 (malwareforsvar). Endpoints vejer uforholdsmæssigt tungt, fordi den indledende adgang - vedhæftede filer i phishingmails, drive-by-downloads, ondsindede USB-medier, stjålne sessionstokens i browseren - lander dér, og fordi legitimationsoplysninger gemt på et endpoint er råmaterialet til lateral bevægelse."},"edges":[{"type":"requires","to":"cs/operating-system","confidence":"high","strength":"normal"},{"type":"part-of","to":"cs/network","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/patch-management","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"CIS Critical Security Controls v8 - Control 1","tier":"standard","publisher":"Center for Internet Security"}],"draft":true}