This course is part of the Advanced Cyber Defence & Offensive Security ExpertTrack
Key Skills for Mastering Endpoint Security & Threat Defence
Gain hands-on skills to detect, prevent, and respond to endpoint threats using real-world tools and Zero Trust practices.
Duration
4 weeksWeekly study
1 hourIncluded in an ExpertTrack
Course 3 of 4
Key Skills for Mastering Endpoint Security & Threat Defence
This course has been certified by the CPD Certification Service as conforming to continuing professional development principles. Find out more.
Master endpoint security to detect, stop, and respond to cyber threats.
As technology evolves at an ever-growing pace, critical skills to protect modern digital environments become more crucial everyday.
Empower yourself to detect, respond, and mitigate threats efficiently in complex IT landscapes on this practical 4-week course
Master endpoint detection and response (EDR) techniques
Explore EDR technologies designed for real-time threat detection, investigation, and remediation. Learners will configure telemetry, analyzing alerts, and automating responses.
You’ll study techniques for identifying sophisticated insider threats at the endpoint level. Learning the best practices for maintaining endpoint hygiene to reduce security risks.
Implement zero trust principles and manage insider threats
Apply Zero Trust models to enforce strict access controls and continuous verification within enterprise environments. You’ll analyze behavioral indicators to detect insider threats, including misuse of credentials and privilege escalation.
You’ll design effective threat mitigation and incident response plans centered on endpoint security, balancing security with productivity while maintaining compliance.
Integrate knowledge with hands-on practice and real-world scenarios
Simulate endpoint threat detection and defense through practical exercise. You’ll develop decision-making skills critical for Security Operations Centers (SOCs) and managed detection programs.
Walk away prepared to implement resilient security strategies with confidence.
Syllabus
Week 1
Introduction to Endpoint Security Management
Lesson 1: Course Introduction
Learn to secure, monitor, and defend endpoints with hands-on labs using open-source tools. Explore EDR, Zero Trust, and insider threat defence to build real-world skills for SOC, sysadmin, or cybersecurity roles.
Lesson 2: Foundations & Baseline Hardening
This lesson introduces the concept of endpoints, showcases real-world attack vectors such as phishing and malware injection, and covers key hardening strategies including patching and access control.
Lesson 3: Core Security Concepts
This lesson covers the CIA triad in the context of endpoint security and explains how confidentiality, integrity, and availability map to practical controls like encryption and least privilege.
Lesson 4: Endpoint Security Architecture & Assessment
This lesson introduces key components like endpoint agents, policy engines, and security consoles, along with the concept of configuration compliance.
Week 2
Endpoint Detection and Response (EDR)
Lesson 5: EDR Fundamentals
This lesson contrasts antivirus and EDR approaches, outlines the EDR pipeline from data collection to response, and introduces the MITRE ATT&CK framework to map adversary behaviour.
Lesson 6: Log Generation & Collection
This lesson explains how to monitor key artefacts - processes, file changes, registry edits, and network activity - using Sysmon and Process Monitor.
Lesson 7: Endpoint Alert Handling & EDR Analysis
This lesson introduces osquery and Velociraptor as open-source tools for endpoint telemetry and investigation.
Week 3
Zero Trust Architecture
Lesson 8: Foundations of Zero Trust
This lesson unpacks Zero Trust principles like verify always, assume breach, and least privilege and explains why traditional models fail.
Lesson 9: Inside Zero Trust Architecture
This lesson introduces access workflows based on user identity and device posture, and explains the distinction between policy decision and enforcement points using examples from tools like BeyondCorp.
Lesson 10: Zero Trust in Practice
Hands-on application is key to understanding how Zero Trust works in action. This lesson walks learners through strengthening endpoint posture.
Week 4
Insider Threat Management
Lesson 11: Understanding Insider Threats
This lesson introduces types of insider actors, including negligent users and malicious insiders, and explores motivations behind real-world cases like Snowden.
Lesson 12: Detection Strategies & Endpoint Monitoring
This lesson teaches how to establish normal activity baselines, monitor privileged users, and flag deviations that suggest insider activity.
Lesson 13: Simulating and Identifying Insider Threat Behaviour
This lesson simulates insider behaviours such as file exfiltration and unauthorised access, then uses Sysmon and Sigma rules to detect them.
Lesson 14 : Course Conclusion
You’ve gained practical skills in endpoint hardening, EDR, Zero Trust, and insider threat defence. Apply these tools and concepts to detect, monitor, and respond to real-world threats with confidence.
Prove you're job ready
Highlight the new, job-relevant skills you’ve gained and supplement existing qualifications with a hard-earned, industry-specific digital certificate – plus one for every course within your ExpertTrack.
- Learn the latest in your chosen industry or subject.
- Complete each course and pass assessments.
- Receive certificates validated by the educating organisation.
- Impress employers with learning outcomes you can add to your CV.
- Make your career dreams a reality.
Download a PDF
Who is this accredited by?
The CPD Certification Service was established in 1996 and is the leading independent CPD accreditation institution operating across industry sectors to complement the CPD policies of professional and academic bodies.
Learning on this course
On every step of the course you can meet other learners, share your ideas and join in with active discussions in the comments.
What will you achieve?
By the end of the course, you‘ll be able to...
- Apply endpoint security principles to evaluate architectural components, identify common attack vectors, and implement baseline hardening techniques.
- Configure endpoint telemetry tools to collect and interpret suspicious system activity.
- Configure native Windows security controls to enforce Zero Trust at the endpoint level.
- Analyze endpoint behavior to detect and respond to potential insider threats.
Who is the course for?
This course is ideal for SOC analysts, IT administrators, cybersecurity professionals, security consultants, and MDR specialists seeking deeper expertise in endpoint security.
Who will you learn with?
Who developed the course?
Starweaver
Starweaver is a next generation platform that engages your workforce as no other. Combining business and technical skills, Starweaver provides real-time skill building that is in line with your business objectives and strategies, and in your associates day to day tasks and jobs.
Start learning today - free 2-day trial
After your free trial you can:
- Pay $59 per month to keep learning online
- Have complete control over your subscription; you can cancel any time
- Work at your own pace and set your own deadlines at every stage
- Only pay while you’re learning; the subscription will cancel automatically when you finish
- Complete online assessments to test your knowledge and prove your skills
- Earn digital course certificates and a final award that you can share online, with potential employers, and your professional network
- Keep access to the content of courses you complete even after your subscription ends
Learning on FutureLearn
Your learning, your rules
- Courses are split into weeks, activities, and steps to help you keep track of your learning
- Learn through a mix of bite-sized videos, long- and short-form articles, audio, and practical activities
- Stay motivated by using the Progress page to keep track of your step completion and assessment scores
Join a global classroom
- Experience the power of social learning, and get inspired by an international network of learners
- Share ideas with your peers and course educators on every step of the course
- Join the conversation by reading, @ing, liking, bookmarking, and replying to comments from others
Map your progress
- As you work through the course, use notifications and the Progress page to guide your learning
- Whenever you’re ready, mark each step as complete, you’re in control
- Complete 90% of course steps and all of the assessments to earn your certificate
Want to know more about learning on FutureLearn? Using FutureLearn
