Securing Devices

What this unit covers

The topics below follow the published Cybersecurity course framework for Unit 4. Cybersecurity publishes no per-unit weighting, so there is no percentage to chase here.

Lessons in this unit

• Device Hardening and Malware Detection18 min · 3 objectivesIdentify common endpoint vulnerabilities · Choose appropriate device-hardening controls · Use event clues to classify suspicious device behavior
• Patching, Configuration, and Least Privilege18 min · 3 objectivesExplain vulnerability reduction through secure configuration · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact
• Malware, Persistence, and Recovery18 min · 3 objectivesExplain malware behavior and evidence-based recovery · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact

Every term in Unit 4

All 41 terms we publish for Securing Devices, with definitions. Reading them through is the fastest way to find the ones you cannot define — then drill those in cram mode until you can produce them without the prompt.

Patch management

Testing and applying vendor updates on a schedule. Most successful attacks use vulnerabilities that had a patch available — the gap is deployment, not discovery.

Endpoint

Any device connecting to the network — laptop, phone, server, printer, sensor. Each is an entry point, and the ones nobody thinks of are usually the weak ones.

Attack surface

The total set of ways a system can be interacted with. Reducing it — closing ports, removing software, disabling services — is often cheaper than defending it.

Hardening

Reducing a system to only what it needs: uninstall unused software, disable unused services and ports, close default accounts, apply a secure baseline.

Default credentials

Factory usernames and passwords, published in manuals and scanned for constantly. Changing them is the first step of any deployment.

End-of-life software

A version the vendor no longer patches. Every vulnerability found from then on stays open permanently, which is why EOL is a security deadline, not a purchasing one.

Firmware and BIOS/UEFI security

Firmware runs before the operating system, so malware there survives a reinstall. Passwords and signed updates protect it.

Secure boot

Firmware verifies each stage of startup is signed before running it, preventing a tampered bootloader or kernel from loading.

Trusted Platform Module (TPM)

A hardware chip storing cryptographic keys and measuring boot integrity. What lets full-disk encryption unlock automatically only on unmodified hardware.

Full disk encryption

Encrypts the whole drive so a stolen or discarded device reveals nothing. Protects data at rest only — once the system is running and unlocked, it protects nothing.

Malware

Software written to damage, disrupt or gain unauthorized access. The umbrella term over everything below.

Virus

Attaches to a file or program and spreads when that host is run or shared. Requires user action.

Worm

Spreads by itself across a network with no user action, which is why worms scale so much faster than viruses.

Trojan

Malware disguised as legitimate software so the user installs it voluntarily. The delivery method, not the payload, defines it.

Ransomware

Encrypts files and demands payment for the key. Backups that are offline and tested are the only reliable answer; paying is not one.

Spyware

Covertly collects information about activity. Keyloggers are a subtype.

Keylogger

Records keystrokes to capture credentials. Defeats transport encryption entirely, because it reads input before anything is encrypted.

Rootkit

Hides its own presence by subverting the operating system, so the system cannot be trusted to report on itself. Usually requires reimaging rather than cleaning.

Logic bomb

Malicious code that triggers on a condition — a date, a departure from the payroll system. Frequently an insider technique.

Fileless malware

Runs in memory using legitimate system tools rather than writing an executable to disk, so file-scanning antivirus finds nothing.

Potentially unwanted program

Adware, toolbars and bundled software: not clearly malicious, and still degrading the system and its privacy.

Antivirus signature detection

Compares files against a database of known malware. Reliable on known threats, useless on new ones — hence the need for updates and for other methods.

Heuristic and behavioral detection

Flags software by what it DOES — encrypting many files quickly, injecting into other processes — rather than by matching a known pattern. Catches novel malware at the cost of false positives.

Endpoint detection and response (EDR)

Continuously records endpoint activity, detects suspicious behavior and allows investigation and remote containment. Assumes prevention will sometimes fail.

Host-based firewall

Filters traffic at the device itself, so a compromised machine inside the network is still restricted. Defense in depth behind the network firewall.

Host-based IDS

Watches a single system for suspicious change — file integrity, privilege use, configuration drift.

Sandboxing

Running untrusted code in an isolated environment where it cannot affect the host. Used for analysis and to contain browser and document exploits.

Application allowlisting

Only approved software may run, and everything else is blocked by default. Far stronger than blocklisting, and far more work to maintain.

Mobile device management (MDM)

Centrally enforces policy on phones and tablets: encryption, passcodes, app restrictions and remote wipe.

Remote wipe

Erasing a lost or stolen device remotely. Depends on the device being reachable, so encryption is the control that works when wipe does not.

BYOD risks

Personal devices carry organizational data on hardware the organization does not control, cannot fully patch, and may not legally wipe. Containerization separates the two.

Screen lock and timeout

The simplest endpoint control and the most frequently missing one. Unattended unlocked devices are a physical and logical failure at once.

Privilege escalation

Gaining higher permissions than granted. Vertical escalation moves from user to administrator; horizontal moves sideways into another user's account.

Running as administrator

Working day to day with elevated rights means any malware executed inherits them. Standard-user accounts for daily use are a core hardening step.

Removable media risk

USB devices bypass every network control by carrying data and code across the boundary in a pocket. Port control and scanning policies exist for this.

Internet of Things security

Embedded devices often ship with default credentials, no update mechanism and long service lives. Segmenting them away from important systems is usually more realistic than securing them.

Endpoint logs

Authentication attempts, process starts, software installs and configuration changes. The record an investigation reconstructs an incident from.

Log retention

How long records are kept. Too short and an intrusion discovered months later cannot be investigated; too long and storage and privacy obligations grow.

Configuration baseline

A documented known-good configuration. Drift from it is measurable, and without it "the machine was changed" cannot be demonstrated.

Vulnerability scanning

Automated checking for known weaknesses and missing patches. Identifies exposure; it does not exploit it, which is what separates it from penetration testing.

Penetration testing

Authorized simulated attack that actually attempts exploitation, to show what a real attacker could achieve. Requires written scope and permission — without those it is a crime, not a test.

What examiners penalize here

• For a scenario about **vulnerability reduction through secure configuration**, identify the decisive evidence before naming a response. A defensible conclusion here is: Reduce privilege and patch exposure; either control alone leaves a major part of the risk untreated.
• For a scenario about **malware behavior and evidence-based recovery**, identify the decisive evidence before naming a response. A defensible conclusion here is: Contain first, investigate scope, eradicate the cause, then recover from trusted backups and monitor for recurrence.

Practice Cybersecurity

Our practice bank is drawn from across the whole course rather than filtered to one unit, which is closer to how the exam asks anyway — it will not tell you which unit a question is testing.

Questions about this unit

All 5 units of AP Cybersecurity

1. Unit 1 · Introduction to Security
2. Unit 2 · Securing Physical Spaces
3. Unit 3 · Securing Networks
4. Unit 4 · Securing Devices
5. Unit 5 · Securing Applications and Data