Free and open-source endpoint security solutions

Instead of relying on your favorite EDR or antivirus vendor for endpoint security, here is what your security team can and should implement for endpoint security.

Endpoint security is not about products, solutions, or vendors. As with everything else in the world of cybersecurity, we believe it is about solid implementation of sound architecture principles, taking care of various risks.

You could use commercial or free and open-source tools. As we do not advertise any security vendor, this article focuses only on free and open-source solutions.

1. Endpoint Defense

1.1. Anti Malware

• For Linux, use ClamAV: an open-source antivirus engine for detecting trojans, viruses, and other malicious software. Alternatively, you could use the free version of Sophos for Linux.
• For Windows, use Windows Defender: a built-in antivirus solution that provides real-time protection against malware.
• Steps (ClamAV):
  1. Download ClamAV: https://www.clamav.net/
  2. Install and configure ClamAV following the documentation: https://docs.clamav.net/
  3. Schedule regular scans and signature updates.
• Steps (Windows Defender):
  1. Open Windows Security app.
  2. Click on “Virus & threat protection” and make sure real-time protection is enabled.
  3. Schedule regular scans and signature updates.

It could take anyone with the skills to use Google an average of 15 minutes to an hour to bypass most antivirus solutions, which is why you should not rely on them alone for your defense strategy. If a hacker somehow gets to execute malicious code on your endpoints, you must have the capability to detect it via other means, some of which are described further in this article. One key point to detect: the execution of PowerShell scripts or VB scripts, or unknown, new binaries, on any of your endpoints.

1.2. Host Firewall

The objective of a firewall is to prevent others on the same network accessing the endpoint in an unauthorized manner. This is especially important when you are on the move, such as being in an airport, in a coffee shop or other public places where anyone could be with you on the same unprotected network.

• Implement a host-based firewall using iptables on Linux or Windows Firewall on Windows systems.
• Steps (Linux):
  1. Install iptables: sudo apt-get install iptables
  2. Configure iptables rules: https://help.ubuntu.com/community/IptablesHowTo/
  3. Save and reload rules: sudo netfilter-persistent save
• Steps (Windows):
  1. Open Windows Firewall settings.
  2. Configure inbound and outbound rules: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule

1.3. HIPS (Host-based Intrusion Prevention System)

• 1. Use OSSEC, an open-source HIPS that provides intrusion detection, log analysis, and more.
  2. As a closed-source alternative, you can use Comodo Advanced Endpoint Protection (free for personal use).
  3. Steps (OSSEC):
     1. Download OSSEC: https://www.ossec.net/
     2. Install and configure following the documentation: https://documentation.wazuh.com/
  4. Steps (Comodo AEP):
     1. Download Comodo AEP: https://www.comodo.com/endpoint-protection/advanced-endpoint-protection.php
     2. Install and configure following the documentation: https://help.comodo.com/topic-399-1-783-10136-Introduction-to-Comodo-Advanced-Endpoint-Protection.html

1.4. Application Whitelisting

Application whitelisting is one of the most effective methods to prevent the execution of malicious code once a hacker can bypass your AV. As we mentioned earlier, bypassing any AV solution takes little time and resources. 

• 1. Implement an application whitelisting solution using AppArmor on Linux or Windows AppLocker on Windows.
  2. Steps (Linux):
     1. Install AppArmor: sudo apt-get install apparmor
     2. Configure profiles for allowed applications: https://wiki.ubuntu.com/AppArmor/
  3. Steps (Windows):
     1. Open Group Policy Management Console.
     2. Configure AppLocker rules: https://docs.microsoft.com/en-us/windows/security/threat-protection/applocker/applocker-overview

2. Disk Encryption

• For Linux, use LUKS to encrypt the disk.
• For Windows, use BitLocker, a built-in disk encryption feature available in Windows 10 Pro and Enterprise editions, or VeraCrypt as a free alternative for other Windows editions.
• Steps (Linux):
  1. Install LUKS: sudo apt-get install cryptsetup
  2. Encrypt disk using the guide: https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system/
• Steps (Windows, BitLocker):
  1. Ensure that you have Windows 10 Pro or Enterprise edition.
  2. Open “BitLocker Drive Encryption” settings.
  3. Follow the guide to enable BitLocker: https://support.microsoft.com/en-us/windows/turn-on-device-encryption-0c453637-bc88-5f74-5105-741561aae838
• Steps (Windows, VeraCrypt):
  1. Download VeraCrypt: https://www.veracrypt.fr/en/Downloads.html
  2. Install and configure VeraCrypt following the documentation: https://www.veracrypt.fr/en/Beginner%27s%20Tutorial.html

By using LUKS for Linux and BitLocker or VeraCrypt for Windows, you can ensure that your data is encrypted and protected from unauthorized access.

3. Network Access Control

• Use PacketFence for Network Access Control and device compliance.
• Steps:
  1. Download PacketFence: https://packetfence.org/
  2. Install and configure following the documentation: https://packetfence.org/documentation.html/

4. BYOD Security – Unified Endpoint Management

• Use WSO2 IoT Server for unified endpoint management.
• Steps:
  1. Download WSO2 IoT Server: https://wso2.com/iot/
  2. Install and configure following the documentation: https://docs.wso2.com/display/IoTS320/

5. Remote Access/VPN

• Implement OpenVPN for secure remote access.
• Steps:
  1. Download OpenVPN: https://openvpn.net/
  2. Install and configure following the documentation: https://openvpn.net/community-resources/how-to/

6. Secure Configuration Baselines (Security Hardening)

• For general configuration baselines, use CIS Benchmarks.
• For systems that require compliance with United States Department of Defense (DoD) standards, use Security Technical Implementation Guides (STIGs).

CIS Benchmarks provide a comprehensive set of security best practices and configuration guidelines for various operating systems, software, and hardware. They are developed by the Center for Internet Security (CIS) and are widely used across industries.

STIGs, on the other hand, are developed by the Defense Information Systems Agency (DISA) for the DoD. They provide security hardening guidelines for DoD systems and are tailored specifically to meet the security requirements of the US military and other government organizations. STIGs are stricter and may include additional security measures not found in the CIS Benchmarks.

• Steps (CIS Benchmarks):
  1. Download CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks/
  2. Follow guidelines for your specific OS: https://workbench.cisecurity.org/
• Steps (STIGs):
  1. Access DISA STIGs: https://public.cyber.mil/stigs/
  2. Download the appropriate STIG for your system or application.
  3. Follow the STIG guidelines to configure and harden your system.

7. Build Compliance Checking

• Use OpenSCAP for automated compliance checking.
• Steps:
  1. Download OpenSCAP: https://www.open-scap.org/
  2. Install and configure following the documentation: https://www.open-scap.org/documentation/

8. Logging and Monitoring

• Implement ELK Stack (Elasticsearch, Logstash, Kibana) for centralized logging and monitoring.
• Steps:
  1. Download ELK Stack: https://www.elastic.co/downloads/
  2. Install and configure following the documentation: https://www.elastic.co/guide/index.html/

9. Process Protection

• 1. Use Linux Security Modules (LSM) like SELinux or AppArmor on Linux and Microsoft’s Data Execution Prevention (DEP) on Windows for protecting process memory from malicious actions of other programs.
  2. Steps (Linux, SELinux):
     1. Install SELinux: sudo apt-get install selinux
     2. Configure SELinux policies: https://wiki.debian.org/SELinux/Setup
  3. Steps (Windows, DEP):
     1. Open System Properties.
     2. Enable DEP for essential Windows programs and services: https://docs.microsoft.com/en-us/windows/win32/memory/data-execution-prevention

10. Sandboxing

• Implement Firejail for sandboxing applications on Linux.
• Steps:
  1. Download Firejail: https://firejail.wordpress.com/
  2. Install and configure following the documentation: https://firejail.wordpress.com/documentation-2/
• For Windows:

Sandboxie

Sandboxie is a popular sandboxing solution for Windows that allows you to run applications in a secure and isolated environment. This can prevent malware, security threats, and unwanted changes to your system.

• Steps (Sandboxie):
  1. Download Sandboxie: https://www.sandboxie.com/
  2. Install Sandboxie following the installation guide: https://www.sandboxie.com/InstallHelp
  3. Run applications within Sandboxie by right-clicking the application and selecting “Run Sandboxed” or by using the Sandboxie Control interface.

Windows Sandbox

Windows Sandbox is an integrated feature available in Windows 10 Pro and Enterprise editions. It provides a lightweight virtual environment to safely run untrusted applications without affecting the host system.

• Steps (Windows Sandbox):
  1. Ensure that you have Windows 10 Pro or Enterprise edition.
  2. Enable Windows Sandbox by following the guide: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview
  3. Launch Windows Sandbox from the Start menu and run applications within the isolated environment.

These application sandboxing solutions for Windows provide an additional layer of security by isolating potentially unsafe programs from your main system.

11. Memory Protection

• Use PaX/Grsecurity for advanced memory protection on Linux.
• Steps:
  1. Download PaX/Grsecurity: https://grsecurity.net/
  2. Follow the guide to apply patches and configure: https://en.wikibooks.org/wiki/Grsecurity/

12. Security Monitoring: Detecting Malicious or Anomalous Behavior

• Implement Wazuh for security monitoring and intrusion detection.
• Steps:
  1. Download Wazuh: https://wazuh.com/
  2. Install and configure following the documentation: https://documentation.wazuh.com/

13. Threat Hunting

Threat hunting is a proactive approach to identifying and mitigating cyber threats in your environment. It involves the use of various tools, techniques, and intelligence to search for signs of compromise or malicious activity that may have evaded traditional security measures.

Velociraptor is an open-source, endpoint visibility tool designed for threat hunting, digital forensics, and incident response. It allows security teams to collect and analyze endpoint data, quickly identify threats, and remediate them.

• Steps (Velociraptor):
  1. Download Velociraptor: https://www.velocidex.com/
  2. Install and configure Velociraptor following the documentation: https://docs.velociraptor.app/
  3. Deploy Velociraptor agents to endpoints.
  4. Use the Velociraptor web interface or API to query endpoint data, create custom hunts, and analyze results.

In addition to Velociraptor, there are other threat hunting tools and platforms that can be used to enhance your security posture:

TheHive

TheHive is an open-source Security Incident Response Platform (SIRP) designed to facilitate threat hunting, incident management, and collaboration among security teams.

• Steps (TheHive):
  1. Download TheHive: https://github.com/TheHive-Project/TheHive
  2. Install and configure TheHive following the documentation: https://github.com/TheHive-Project/TheHiveDocs
  3. Integrate TheHive with your existing security tools and platforms.
  4. Use TheHive’s web interface to manage incidents, analyze data, and collaborate with your team.

YARA

YARA is an open-source tool used to create custom rules for identifying and classifying malware based on textual or binary patterns. It is a versatile and powerful tool for threat hunting and malware analysis.

• Steps (YARA):
  1. Download YARA: https://github.com/VirusTotal/yara
  2. Install and configure YARA following the documentation: https://yara.readthedocs.io/en/stable/
  3. Create custom YARA rules for identifying threats specific to your environment.
  4. Use YARA to scan files, memory, or network traffic for matches to your custom rules.

You could use these step-by-step instructions and by utilizing the provided open-source tools, create a comprehensive endpoint security strategy.

Remember to keep all software up-to-date and continuously monitor your environment for threats to ensure the highest level of protection.

If you require the assistance of an expert team, Kloudwerk is here to help!

And, if you have a LOT of time on your hands, you can explore what CISA collected as free security tools here.