Endpoint and Email Security Audit

Endpoint and Email Security Audit

Photo by Markus Winkler on Pexels

Endpoints — laptops, desktops, tablets, and phones — are where your employees interact with business data. Email is the primary attack vector used to compromise those endpoints. This lesson covers auditing both to ensure your perimeter is secure.

Endpoint Security Audit Checklist

Every device that connects to your network needs protection. Audit each device for:

• Antivirus/anti-malware — Is protection installed, running, and updated? Check definitions are current within the last 7 days.
• OS patches — Are operating systems receiving regular security updates? Windows, macOS, iOS, and Android all need patching.
• Disk encryption — Is BitLocker (Windows) or FileVault (macOS) enabled? If a laptop is stolen, encryption prevents data theft.
• Screen lock — Does the device auto-lock after 5-15 minutes of inactivity?
• Firewall — Is the built-in OS firewall enabled on every device?
• Remote wipe — Can you remotely wipe a lost or stolen device? Use Mobile Device Management (MDM).
• Software inventory — Is unauthorized software installed? Remove games, torrent clients, and unapproved apps.

Email Security Audit Checklist

Email remains the number one attack vector for small businesses. Audit these critical areas:

• Spam filtering — Is a business-grade spam filter active? Built-in filtering from Microsoft 365 or Google Workspace is a minimum.
• Phishing protection — Are suspicious links and attachments blocked? Consider adding a layer like Proofpoint Essentials or Mimecast.
• Email authentication (SPF, DKIM, DMARC) — Are these DNS records configured? They prevent email spoofing of your domain.
• External sender warnings — Are emails from outside your organization labeled with a warning banner?
• Mail forwarding rules — Check for auto-forwarding rules that could exfiltrate data to external addresses. Attackers create these silently.

Step-by-Step Endpoint Audit

1. Inventory all devices — Use your asset list from Lesson 2
2. Verify antivirus status — Check each device's protection console
3. Check patch levels — Review Windows Update or macOS Software Update status
4. Test encryption — Confirm BitLocker/FileVault recovery keys are stored
5. Review installed software — Remove unauthorized applications
6. Verify MDM enrollment — All company devices should be in MDM
7. Document compliance — Record which devices pass/fail each check

Step-by-Step Email Audit

1. Review spam filter settings — Check quarantine and false positive rates
2. Test SPF/DKIM/DMARC — Use MXToolbox (free) to verify DNS records
3. Check for forwarding rules — Search all mailboxes for auto-forwarding rules
4. Review admin accounts — Ensure admin email accounts have extra protection
5. Audit email retention — Verify retention policies match compliance needs
6. Run a phishing simulation — Send a safe test phishing email to staff

Free Tools for Endpoint and Email Security

• Windows Defender / Microsoft Defender for Business — Built-in endpoint protection
• Malwarebytes Free — On-demand malware scanner
• MXToolbox — Free email DNS and blacklist checker
• Google Postmaster Tools — Free email reputation and authentication analysis
• Microsoft Secure Score — Free security assessment including email security
• KnowBe4 Free Phishing Security Test — Free phishing simulation for up to 100 users

Common Findings and Fixes

• Finding: 40% of devices lack disk encryption → Fix: Enable BitLocker/FileVault on all devices immediately
• Finding: No DMARC record configured → Fix: Add DNS records: SPF, DKIM, and DMARC with p=quarantine
• Finding: Employees click 30% of phishing tests → Fix: Implement monthly security awareness training
• Finding: Personal email on company devices → Fix: Block personal email via MDM or group policy

Key Takeaways

• Every endpoint needs antivirus, encryption, and current patches — no exceptions
• Email is the primary attack vector — invest in filtering and authentication
• SPF, DKIM, and DMARC records are free to configure and prevent domain spoofing
• Regular phishing simulations build human firewalls alongside technical ones
• Document endpoint compliance for insurance and compliance requirements