Chapter 19 — Systems, endpoints and hardware security: scope and theory
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Scope"]
N2["19.2 Theory"]
N3["19.3 Hardware"]
N4["19.4 Relation to other areas"]
N5["19.5 Bramley's place"]
N6["Why systems security is its own field"]
N7["Theory into practice"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Scope"]
N2["19.2 Theory"]
N3["19.3 Hardware"]
N4["19.4 Relation to other areas"]
N5["19.5 Bramley's place"]
N6["Why systems security is its own field"]
N7["Theory into practice"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 Scope]
|
v
[19.2 Theory]
|
v
[19.3 Hardware]
|
v
[19.4 Relation to other areas]
|
v
[19.5 Bramley's place]
|
v
[Why systems security is its own field]
|
v
[Theory into practice]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) define the field's scope; (2) connect theory to Bramley; (3) place endpoint security among other areas.
19.1 Scope
The field covers servers, laptops, firmware and hardware: their configuration, updates, integrity and recovery.
At Bramley, the scope covers 45 laptops and four servers: how they are set up, how quickly they are updated, whether their firmware and settings stay as intended, and how they are restored after failure. Phones and the website sit outside the capstone, as the scope statement says. Aisha keeps the boundary written down, so new requests are judged against it. The scope also excludes testing devices for weaknesses, in line with the agreement, so the field is studied here from the defender's side only.
19.2 Theory
Configuration management (SP 800-128), patch management (SP 800-40r4) and least privilege provide the main theories applied.
Each of these theories gives Aisha a concrete routine that Gareth can run at Bramley. SP 800-128 supports the five-setting baseline and the checks that keep laptops on it. SP 800-40 Rev. 4 supports the monthly patch cycle with forced restarts. Least privilege, from Saltzer and Schroeder (1975), supports standard staff accounts and named admin accounts. SP 800-123 adds the server side, guiding the role documents and the removal of unneeded services on the four servers.
19.3 Hardware
Firmware and processor issues, such as those shown by Kocher et al. (2019), are fixed by updates, adding to patch volume.
Kocher et al. (2019) showed that speculative execution in processors could leak data across boundaries that software assumed were safe. For Bramley, the practical result is more updates: firmware and microcode fixes arrive from the laptop vendor alongside operating system patches. Aisha records firmware versions in the inventory, so these updates can be tracked like any other. Firmware updates are applied in small groups after recovery keys are checked.
19.4 Relation to other areas
Identity, networks and incident response connect to endpoints.
Aisha draws the links between these areas that matter most for Bramley. Identity decides who holds admin rights on each device; the network decides whether home laptops receive updates; incident response decides what happens when a laptop is lost. A gap in any of these shows up on endpoints, so her capstone records the interface, though not the whole neighbouring field. Aisha writes one sentence for each interface in her scope statement, naming who owns it at Bramley and what her capstone does there.
19.5 Bramley's place
Small organisations need proportionate controls.
A charity with one IT officer cannot run every control in a large framework. Aisha uses CIS Controls v8 implementation group 1 as the starting set, because it is aimed at organisations with limited IT resources. Her test for each proposed control is whether Gareth can run it within his weekly routine without new tools. A control that fails this test is not dropped silently; it is recorded as a recommendation with its cost, for managers to decide.
Why systems security is its own field
Systems and endpoint security sits between hardware, operating systems and organisational practice. It deals with how machines are configured, updated and recovered, and how their hardware and firmware can be trusted. NIST SP 800-53 Rev. 5 includes control families for configuration management, system and information integrity, and maintenance, all central to the field.
For Bramley, the field's concepts translate into practical questions: are all devices known, configured to a baseline, updated in time and recoverable? Aisha uses these four questions as the backbone of her capstone and later chapters.
She also notes topics outside her capstone but within the field, such as firmware integrity and hardware supply chain, and reads introductory material on them to understand the wider landscape.
Theory into practice
Each theory becomes a routine: configuration management becomes the baseline and weekly checks; patch management becomes the monthly cycle; least privilege becomes standard users and named admin accounts.
Reading list
Aisha reads NIST SP 800-123 for servers and SP 800-128 for configuration management as her core texts.
Project log entry
Hardware matters too. NIST SP 800-193 describes platform firmware resiliency: protecting, detecting changes to and recovering firmware. Bramley cannot build such features, but it can buy laptops that support them, keep firmware updated through the vendor tool, and record firmware versions in the inventory alongside operating system versions.
Worked example
Aisha writes a one-page scope statement for her capstone: laptops and servers at Bramley, excluding phones and the website.
Synthetic case. Synthetic.
Errors and limits
Unclear scope makes projects grow.
Exercises
- EX055 — Field scope. What does the field cover? Rubric: 3 = servers, laptops, firmware, hardware; 2 = partial; 1 = vague; 0 = none.
- EX056 — Theories. Name three theories applied. Rubric: 3 = configuration mgmt, patch mgmt, least privilege; 2 = two; 1 = one; 0 = none.
- EX057 — Capstone scope. What does Aisha's capstone exclude? Rubric: 3 = phones, website; 2 = partial; 1 = vague; 0 = none.
Synthesis
Define scope with theory and proportion.
Continue studying — chapter 19 of 40
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →