Skip to content
All lessons
Objective 4.1Security Operations· 3 min read

Securing Computing Resources

Given a scenario, apply common security techniques to computing resources

What you will learn

  • Explain the secure baseline and the cycle of deploying and maintaining it.
  • Compare mobile ownership models by the control each gains and loses.
  • Choose the right wireless configuration and know why anything below it is no longer acceptable.
  • Know what sandboxing is and why it precedes trust rather than replacing it.

Securing a device does not begin after it is deployed but before. A secure baseline is the approved configuration every device is built from: services closed, default accounts disabled, encryption on, logging working. Then the real work begins — noticing devices drifting from it and pulling them back.

The baseline cycle

  1. Establish

    Built from an approved standard rather than personal preference, with what it contains and why written down.

  2. Deploy

    Automatically onto every new device, not by hand each time.

  3. Maintain

    Measuring drift and restoring the device. Every manual change moves it further away.

Mobile

BYODThe employee's own device. Cheapest and least controlled, and it raises privacy: you may not wipe the owner's photos.
COPECompany-owned, personally enabled. Full control at full cost.
CYODThe company owns it and the employee picks from a list. A middle ground that standardises what is managed.
MDMMobile device management: enforcing policy, remote wipe, and separating work data from personal.

Remote wipe under BYOD is not absolute

The device belongs to the employee, so wiping it entirely deletes their photos and personal messages — a legal question, not a technical one. The right answer in these scenarios is a separate work container that is wiped on its own, not the device. If a question mentions BYOD and privacy, look for separation rather than wiping.

Wireless and application security

WPA3The current wireless standard. It addresses the key-exchange weakness of its predecessor and encrypts open networks.
802.1X / RADIUSEnterprise per-user authentication instead of one shared password the whole company knows.
Input validationChecking every input before it is used. The root defence against injection of every kind.
Code signingA digital signature on software proving its origin and that it was not altered. A direct link to objective 1.4.
Static / dynamic analysisExamining code without running it versus examining it while it runs. The first is earlier; the second is closer to reality.
SandboxingRunning what you do not trust in an isolated environment to watch its behaviour before allowing it.

Real-world example: a suspicious attachment

An attachment the mail gateway does not recognise arrives. Instead of blocking it or letting it through, it is detonated in a sandbox: an isolated environment imitating a user's machine. Its behaviour is watched — does it write to system locations? Does it call an external server? Does it try to disable logging? The decision is then made on what it did, not on its signature. That is the difference: a signature knows known malware; a sandbox reveals new malware.

What matters on the exam

  • "The device drifted from the approved configuration" = baseline enforcement, not manual re-hardening.
  • BYOD plus privacy = a separate work container. COPE = full control, and a full wipe is acceptable.
  • An enterprise wireless network = 802.1X, not a shared key, however strong that key is.
  • A sandbox reveals behaviour, not signatures. If a question mentions an unknown file, that is the answer.

Quick check

Answer in your head first, then reveal.

  1. What is a secure baseline for, and what keeps it alive?Reveal the answer

    Its purpose is that every device starts from a known safe configuration instead of individual improvisation. What keeps it alive is enforcement and drift measurement — without them the device slides back within months.

  2. An employee uses their personal phone for work and the company wants to wipe work data. What is the answer?Reveal the answer

    A managed work container wiped on its own. A full wipe deletes personal data the company does not own — a legal exposure, not a technical solution.

  3. Why is a shared wireless key not enough in an organisation?Reveal the answer

    Because it does not distinguish one user from another, and revoking it for a leaver means changing it for everyone. 802.1X ties access to an individual identity that can be revoked.

Sign in to track your progress on this topic.

Your next step

Read the lesson, then mark it complete

Sources

Used to verify the facts. The writing is original to Passuit.