4.1 Flashcards
Secure baselines, hardening targets, securing wireless and mobile, wireless security settings, application security
A template of a secure configuration that can be modified in order to best serve the specific application it is being used for.
They are often available from the manufacturer of the device or application.
Security baseline
True/False
Most security baselines rarely need updating/changing
True
However, some baselines may require frequent updating due to discovered vulnerabilities or new software needed.
2 common hardening techniques for mobile devices
Update
Segmentation (user vs company data)
True/False
Mobile devices typically have hardening checklists available from the manufacturer
True
4 ways to harden a workstation
Keep it updated
Automate the monthly security patches (but make sure to test them)
Connect to a policy management system (AD group policy, etc.)
Remove unnecessary software
2 ways to harden network infrastructure devices
Configure authentication - don’t use defaults!
Check with the manufacturer for security updates
(Because these are purpose-built devices, they don’t get updated often. But any updates are always important.)
4 ways to harden/secure cloud infrastructure
Secure the cloud management workstation
Implement least privilege
Configure EDR (all devices accessing the cloud should be secure)
Always have backups (you can backup to a separate cloud provider)
4 ways to harden/secure servers
Update and patch
Secure accounts (least privilege, password requirements)
Limit network access (firewall)
Monitor and secure (antivirus, antimalware)
SCADA stands for
Supervisory Control and Data Acquisition System
1 way to harden/secure SCADA/ICS
Extensive segmentation - no access from the outside
3 ways to harden/secure embedded systems
Security patches
Segmentation on their own network
Firewall in front of the segment
Note: Upgrading/modifying an existing embedded system is not always an option. Remember that embedded systems don’t usually allow access into the OS. Things like televisions and watches are easy, but other things not so much.
3 ways to harden/secure RTOSs
Isolate the system from the rest of the network
Run with the minimum amount of services
Use secure communication (firewall)
3 ways to harden/secure IoT devices
Change default accounts and configurations
Deploy updates quickly
Segment IoT devices on their own VLAN
The inspection of a location that involves what wireless networks are nearby, determining the existing wireless spectrum, identifying existing access points, and a plan for how to work around existing wireless frequencies.
Site survey
A two-dimensional diagram that shows wireless AP signal coverage.
Heat map
AKA Wi-Fi coverage map
MDM stands for
Mobile Device Management
BYOD stands for
Bring Your Own Device
A system that allows centralized management of mobile devices. Can set policies on features (camera, apps, data, etc.), enforce segmentation, and manage access control (screen locks, PINs).
MDM
A policy that allows employees to bring their own personal device to be used partially for work. The device will be managed via an MDM.
BYOD
COPE stands for
Corporate owned, personally enabled
A policy where the organization purchases the device for employees to use as both a personal and corporate device.
COPE
Difference between COPE and CYOD
CYOD allows the employee to choose which device they want to use
CYOD stands for
Choose Your Own Device
PAN stands for
Personal Area Network
