Securing Computing Resources
Given a scenario, apply common security techniques to computing resources
What you will learn
- Explain the secure baseline and the cycle of deploying and maintaining it.
- Compare mobile ownership models by the control each gains and loses.
- Choose the right wireless configuration and know why anything below it is no longer acceptable.
- Know what sandboxing is and why it precedes trust rather than replacing it.
Securing a device does not begin after it is deployed but before. A secure baseline is the approved configuration every device is built from: services closed, default accounts disabled, encryption on, logging working. Then the real work begins — noticing devices drifting from it and pulling them back.
The baseline cycle
Establish
Built from an approved standard rather than personal preference, with what it contains and why written down.
Deploy
Automatically onto every new device, not by hand each time.
Maintain
Measuring drift and restoring the device. Every manual change moves it further away.
Mobile
| BYOD | The employee's own device. Cheapest and least controlled, and it raises privacy: you may not wipe the owner's photos. |
|---|---|
| COPE | Company-owned, personally enabled. Full control at full cost. |
| CYOD | The company owns it and the employee picks from a list. A middle ground that standardises what is managed. |
| MDM | Mobile device management: enforcing policy, remote wipe, and separating work data from personal. |
Remote wipe under BYOD is not absolute
The device belongs to the employee, so wiping it entirely deletes their photos and personal messages — a legal question, not a technical one. The right answer in these scenarios is a separate work container that is wiped on its own, not the device. If a question mentions BYOD and privacy, look for separation rather than wiping.
Wireless and application security
| WPA3 | The current wireless standard. It addresses the key-exchange weakness of its predecessor and encrypts open networks. |
|---|---|
| 802.1X / RADIUS | Enterprise per-user authentication instead of one shared password the whole company knows. |
| Input validation | Checking every input before it is used. The root defence against injection of every kind. |
| Code signing | A digital signature on software proving its origin and that it was not altered. A direct link to objective 1.4. |
| Static / dynamic analysis | Examining code without running it versus examining it while it runs. The first is earlier; the second is closer to reality. |
| Sandboxing | Running what you do not trust in an isolated environment to watch its behaviour before allowing it. |
Real-world example: a suspicious attachment
An attachment the mail gateway does not recognise arrives. Instead of blocking it or letting it through, it is detonated in a sandbox: an isolated environment imitating a user's machine. Its behaviour is watched — does it write to system locations? Does it call an external server? Does it try to disable logging? The decision is then made on what it did, not on its signature. That is the difference: a signature knows known malware; a sandbox reveals new malware.
What matters on the exam
- "The device drifted from the approved configuration" = baseline enforcement, not manual re-hardening.
- BYOD plus privacy = a separate work container. COPE = full control, and a full wipe is acceptable.
- An enterprise wireless network = 802.1X, not a shared key, however strong that key is.
- A sandbox reveals behaviour, not signatures. If a question mentions an unknown file, that is the answer.
Quick check
Answer in your head first, then reveal.
What is a secure baseline for, and what keeps it alive?Reveal the answer
Its purpose is that every device starts from a known safe configuration instead of individual improvisation. What keeps it alive is enforcement and drift measurement — without them the device slides back within months.
An employee uses their personal phone for work and the company wants to wipe work data. What is the answer?Reveal the answer
A managed work container wiped on its own. A full wipe deletes personal data the company does not own — a legal exposure, not a technical solution.
Why is a shared wireless key not enough in an organisation?Reveal the answer
Because it does not distinguish one user from another, and revoking it for a leaver means changing it for everyone. 802.1X ties access to an individual identity that can be revoked.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.