Endpoints

Last updated: Nov 3, 2026

Device management

To protect the data of its clients, Fluid Attacks manages its devices with a Mobile Device Management (MDM) tool.

With this tool, Fluid Attacks can do these tasks:

Get full visibility into device compliance, security configuration, general fleet risk, and device logs.
Make full-disk encryption mandatory on endpoint devices to protect data at rest and manage security compliance.
Block unauthorized users or automated tools so that they cannot restart a device into its Recovery Operating System (Recovery Mode).
Apply hardening configurations through Blueprints. Blueprints contain preconfigured security settings and Library Items.
Restrict removable media and apply the security restrictions on this page.
Find and block malware and malicious activity with endpoint detection and response (EDR).
Identify vulnerable software on its devices with vulnerability management.
Investigate issues quickly and automate remediation workflows.
Disable Bluetooth Sharing to prevent file transfers through Bluetooth.
Disable the Bonjour advertising service. This stops the device from the advertisement of its services on the local network.
Enable Secure Keyboard Entry. This prevents other applications from the capture of the text that the user types in the terminal.
Enable System Integrity Protection (SIP). SIP protects critical system files and processes from changes. Administrators cannot change them either.
Enforce a custom policy banner with the access notification of the organization before login.
Make sure that the system sets the date and time automatically. This keeps the clock synchronized, and the timestamps in logs accurate.
Set a retention period for install.log to keep the software installation log for a defined period.
Show all filename extensions in Finder. This helps users identify file types and prevent disguised malicious files.
Show the location icon in Control Center when system services request the location.

Also, the MDM automatically collects data from the IT assets of Fluid Attacks, for example:

Devices: General inventory of managed devices, with hardware details, OS version, and enrollment status
Activation Lock: The status of Activation Lock on each device
Application Firewall: Status and configuration of the built-in firewall
Apps: Applications installed on each device and their versions
Certificates: Certificates installed on each device
Desktop & Screensaver: Screen lock and screensaver settings
FileVault: Disk encryption status
Gatekeeper & XProtect: Status of the built-in macOS protections against untrusted software and malware
Installed Profiles: Configuration profiles applied to each device
Kernel Extensions: Kernel extensions loaded on each device
Launch Agents & Daemons: Background items that start automatically
Local Users: Local user accounts on each device
Startup Settings: Startup security configuration
System Extensions: System extensions installed on each device
Transparency Database: Permissions that apps have to get access to protected resources, for example, the camera, microphone, or files

Each user account has a related device. Fluid Attacks also monitors and controls the access to these devices (read the article about device enrollment).

Fluid Attacks sets up the Blueprint in accordance with its criteria.

The MDM solution of Fluid Attacks manages the mobile devices that Fluid Attacks gives to the users who need a phone. Okta applies an authentication policy that gives access only to MDM-managed devices, except for the applications that cannot report the device state. Also, mobile devices follow specific security configurations that the MDM Blueprint defines.

Endpoint detection and response (EDR)

The managed devices of Fluid Attacks run the EDR capabilities of its MDM tool. EDR monitors endpoint activity with behavioral detection, blocks malware and other malicious activity, and supports the investigation and remediation of detections. Fluid Attacks manages detections through its incident management process.

Fluid Attacks filters malicious websites and content separately through its web filtering controls.

Vulnerability management

The vulnerability management capability of the MDM tool identifies known vulnerabilities in the operating system and in the applications on the managed devices. Fluid Attacks prioritizes the findings by severity. To remediate them, Fluid Attacks updates or removes the affected software.

Self-Service

With the Self-Service function, users can get access to the enterprise app store, install apps, update software, and maintain their own device without a help desk ticket. The IT Manager and the CTO of Fluid Attacks analyze all Self-Service-hosted applications and approve or deny them. This also applies to all additional application requests from employees.

Device policy

Fluid Attacks uses one MDM Blueprint for all its devices, including laptops and iPhones, for administrators and regular users. This Blueprint includes the different policies that are necessary to manage and secure these devices.

Authorization

Fluid Attacks makes sure that only the intended users can get access to devices, and it controls the permissions on those devices. Fluid Attacks complies with these criteria:

Only the user of a laptop can see its passwords and data. All users must use KeyChain for security. To protect the passwords in KeyChain, it locks automatically when the computer locks or goes into suspension.
Automatic login is disabled to prevent data leaks. The system requires a password to change the system configuration and to get access to data.
Users can get access to the device only through Okta Passport. Users without an active account cannot log in. Also, the local password is synchronized with the Okta password.
The password policy of Fluid Attacks describes the password requirements of Okta.

Requirements:

Updates

The system updates apps from the App Store and Auto Apps immediately when a new version is available. The IT team does not have to run anything manually. The system also manages OS updates automatically. Vulnerability management helps Fluid Attacks find outdated or vulnerable software on its devices, so that it can update or remove it.

Users

Fluid Attacks controls how users log in to devices and creates local accounts that improve security:

The guest account is disabled on all devices. Users without an active account cannot log in.
The login window asks the user for their credentials, verifies their authorization level, and then allows or denies the access of the user to the system.
If the Guest home folder exists, automated audits can fail when they look for compliant settings in all User folders. Thus, it is best to remove this folder.

Requirements:

Preferences

Fluid Attacks controls what the user can do with manual configurations on the devices. It restricts the access to unnecessary system configurations in accordance with the use of the device for each role.

Requirements:

Networking

Fluid Attacks controls insecure protocols and services, because they can compromise the data on the devices.

HTTP Apache server and NFSD are part of the operating system. A user can easily turn them on to share files and give remote connectivity to an end-user computer. Web sharing must occur only through hardened web servers and appropriate cloud services.

Requirements:

Auditing

Fluid Attacks manages logs and monitors its devices for audits as follows:

The audit system writes important operational and security information. This information can be useful for an attacker. An attacker can also try to hide unwanted changes in it. As part of defense-in-depth, the /etc/security/audit_control configuration and the files in /var/audit must be owned by root with group wheel, must be read-only, and must have no ACLs. No other access is allowed.
When the firewall is on in the Security PreferencePane, it uses the socketfilter firewall. To monitor which access the firewall allows and denies, logging must be enabled.

Requirements:

Removable devices

Fluid Attacks limits and controls all removable devices, including external disks, disk images, DVD-RAM, USB storage devices, and removable disc media, for example, CDs, CD-ROMs, DVDs, and recordable discs.

The status of the control can be mountable or not mountable. The current policy of Fluid Attacks is fully restrictive. Nobody can mount these devices.

Requirements:

The staff of Fluid Attacks reads and accepts the Endpoint Secure Management Policy through Vanta.

Endpoints

Device management

Endpoint detection and response (EDR)

Vulnerability management

Self-Service

Device policy

Authorization

Updates

Users

Preferences

Networking

Auditing

Removable devices

References

Requirements

Other secure authorization measures

On this page