Endpoint security: protecting your distributed workforce

The office perimeter used to be the security boundary. Firewalls guarded the entrance, and everything inside was considered relatively trusted. That model was already fraying before COVID-19. The shift to distributed work shattered it completely.

Today, your employees access company data from home offices, coffee shops, airport lounges, and client sites - on laptops, tablets, and phones that may or may not be company-owned. Each of those devices is an endpoint, and each endpoint is a potential entry point for attackers.

For South African businesses, where hybrid and remote work have become standard practice, endpoint security is no longer a nice-to-have. It’s a fundamental requirement.

The endpoint problem

The challenge is straightforward: you need to protect devices that you don’t physically control, operating on networks you don’t manage, used by people who aren’t security experts.

Consider the attack surface of a single remote worker’s laptop:

It connects to home Wi-Fi (which may use a default router password)
It might be shared with family members
It connects to public Wi-Fi when the employee travels
It stores cached credentials, downloaded files, and possibly sensitive data
It runs a mix of business and personal applications
Updates may be deferred if the employee doesn’t restart regularly

Multiply that by every employee in your organisation, and the scale of the endpoint security challenge becomes clear.

EDR vs traditional antivirus

Traditional antivirus relies primarily on signature-based detection - matching files against a database of known malware. This approach catches known threats but is largely blind to novel attacks, fileless malware, and living-off-the-land techniques where attackers use legitimate system tools for malicious purposes.

Endpoint Detection and Response (EDR) represents a fundamental shift in approach:

Behavioural analysis - EDR monitors what processes actually do, not just what they look like. A legitimate application suddenly encrypting thousands of files triggers an alert regardless of whether the executable matches a known signature.
Continuous monitoring - EDR agents record endpoint activity continuously, creating a detailed timeline that’s invaluable for incident investigation.
Automated response - modern EDR platforms can isolate compromised endpoints from the network automatically, containing threats before they spread.
Threat hunting - the data collected enables proactive searching for indicators of compromise across your entire fleet.

For any organisation with more than a handful of endpoints, EDR is the minimum standard. Traditional antivirus alone is no longer sufficient against current threat levels.

Your cybersecurity and security operations strategy should include EDR as a foundational layer, integrated with broader detection and response capabilities.

Device management with MDM

Mobile Device Management (MDM) - or more broadly, Unified Endpoint Management (UEM) - gives you centralised control over the devices accessing your corporate resources. Key capabilities include:

Policy enforcement - ensuring devices meet minimum security standards (OS version, encryption enabled, screen lock configured) before they can access company data
Application management - deploying, updating, and removing applications remotely
Configuration management - pushing Wi-Fi profiles, VPN configurations, and email settings automatically
Compliance monitoring - continuous checking that devices remain compliant with your policies
Selective wipe - removing corporate data and profiles from a device without touching personal data (critical for BYOD scenarios)

For South African businesses using Microsoft 365, Intune provides a capable MDM/UEM platform that integrates natively with Azure AD and the rest of the Microsoft ecosystem.

Patch management: the unsexy essential

If there’s one security control that delivers the highest return for the lowest cost, it’s patching. The majority of exploited vulnerabilities have patches available at the time of exploitation - attackers succeed because organisations haven’t applied them.

Effective patch management for a distributed workforce requires:

Automated deployment - patches should be deployed through your managed IT platform automatically, not dependent on users clicking “Update later” for the fifteenth time
Prioritisation - not all patches are equal. Critical and high-severity vulnerabilities, especially those with known exploits, must be fast-tracked. Routine updates can follow a standard cycle.
Testing - for critical business applications, test patches in a staging environment before broad deployment to avoid breaking production workflows
Visibility - dashboards showing patch compliance across your fleet, highlighting devices that are falling behind
Escalation - a process for handling devices that consistently fail to patch, including the authority to restrict their access

Third-party patching

Don’t overlook non-OS software. Browsers, PDF readers, Java, and other common applications are frequent attack targets. Your patching programme must cover third-party applications, not just Windows or macOS updates.

Full disk encryption

If a laptop is lost or stolen - a common occurrence - full disk encryption ensures the data on it remains inaccessible. BitLocker (Windows) and FileVault (macOS) are built into their respective operating systems and should be enabled on every corporate device without exception.

Key considerations:

Recovery key management - store recovery keys centrally (Intune or Active Directory) so that IT can help users who get locked out
Enforcement - use MDM policies to require encryption and prevent access to corporate resources from unencrypted devices
Verification - regularly audit that encryption is actually active across your fleet

Remote wipe capabilities

When a device is lost, stolen, or when an employee departs, you need the ability to remove corporate data remotely. Two levels exist:

Selective wipe - removes only corporate data, accounts, and applications. Appropriate for BYOD devices and standard employee departures.
Full wipe - factory resets the entire device. Appropriate for company-owned devices that are lost or stolen.

Having this capability pre-configured and tested - not scrambling to set it up after an incident - is essential.

BYOD policies that actually work

Bring Your Own Device policies acknowledge reality: employees will use personal devices for work whether you sanction it or not. A good BYOD policy balances security requirements with employee privacy and convenience.

Practical BYOD policy elements:

Minimum device standards - supported OS versions, encryption required, screen lock mandatory
Containerisation - corporate data and applications run in a managed container separate from personal data (Microsoft’s MAM policies in Intune handle this well)
Acceptable use - clarity on what corporate data can and cannot be stored on personal devices
Exit procedures - what happens to corporate data when an employee leaves
Privacy commitments - be explicit about what the company can and cannot see on personal devices. Employees who fear surveillance will resist enrolment.

Zero trust at the endpoint

Zero trust networking assumes that no device, user, or network should be automatically trusted. Every access request is verified based on multiple signals. The endpoint is where many of these signals originate.

A zero trust approach to endpoints means:

Device health checks - before granting access to corporate resources, verify that the device is managed, encrypted, patched, and running security agents
Conditional access policies - adjust access based on risk signals. A managed, compliant device on a corporate network gets full access. An unknown device on a public network might get read-only access to email only.
Continuous evaluation - don’t just check at login. If a device falls out of compliance during a session, restrict access dynamically.
Least privilege - users and devices get access only to the resources they need, limiting the blast radius of any compromise

Integrating endpoint security with your identity and access management strategy is how zero trust moves from concept to reality.

Building your endpoint security programme

A practical implementation path:

Inventory - you can’t secure what you don’t know about. Discover and catalogue every device accessing corporate resources.
Baseline policies - define minimum security standards for all endpoints: encryption, patching, EDR, screen lock.
Deploy MDM/UEM - enrol all devices (corporate and BYOD) and enforce your baseline policies.
Implement EDR - deploy endpoint detection and response across all managed devices.
Enable conditional access - start with basic policies (require MFA, block legacy authentication) and progressively tighten.
Monitor and respond - establish processes for reviewing alerts, investigating anomalies, and responding to incidents.
Review and improve - regularly assess your endpoint security posture and close gaps.

Secure your distributed workforce

The distributed workforce isn’t a temporary arrangement - it’s the operating model. Your security strategy needs to meet people where they work, on the devices they use, without creating so much friction that they look for workarounds.

If you’d like help building or strengthening your endpoint security programme, talk to our security team. We’ll assess your current posture and help you implement practical, sustainable endpoint protection that keeps your distributed workforce secure without slowing them down.