Chapter 23 — Systems, endpoints and hardware security: methods I
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Baseline"]
N2["Lab — baseline gaps"]
N3["23.2 Reading the result"]
N4["23.3 Priorities"]
N5["23.4 Method"]
N6["Why local admin causes drift"]
N7["Reporting gaps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Baseline"]
N2["Lab — baseline gaps"]
N3["23.2 Reading the result"]
N4["23.3 Priorities"]
N5["23.4 Method"]
N6["Why local admin causes drift"]
N7["Reporting gaps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Baseline]
|
v
[Lab — baseline gaps]
|
v
[23.2 Reading the result]
|
v
[23.3 Priorities]
|
v
[23.4 Method]
|
v
[Why local admin causes drift]
|
v
[Reporting gaps]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) check laptops against a baseline; (2) count gaps by setting; (3) prioritise fixes.
23.1 Baseline
Five settings: disk encryption, firewall, screen lock, local admin removed and automatic updates, drawn from CIS Benchmarks and Microsoft's Windows security baselines.
The five settings were chosen because each one addresses a risk Bramley has already met. Encryption answers the stolen laptop, the firewall answers home and café networks, the screen lock answers unattended sessions, removing local admin limits drift and malware, and automatic updates address the patch tail. Each is checked from agent reports, not by visiting laptops. A setting counts as passing only when the agent reports it as enforced, so a laptop that has not reported is counted as unknown rather than compliant.
Lab — baseline gaps
"""Count baseline gaps per setting across synthetic laptops (stdlib only)."""
import random
random.seed(3)
settings = {"disk_encryption": 0.31, "firewall": 0.04, "screen_lock": 0.18, "local_admin_removed": 0.42, "auto_updates": 0.22}
n = 45
for s, p in settings.items():
fails = sum(random.random() < p for _ in range(n))
print(f"{s:20} {fails:2d}/{n} failing")
Run with python3 lab_baseline.py. Verified output:
disk_encryption 13/45 failing
firewall 1/45 failing
screen_lock 7/45 failing
local_admin_removed 25/45 failing
auto_updates 6/45 failing
23.2 Reading the result
Local admin removal fails on 25 of 45 laptops, disk encryption on 13, screen lock on 7, automatic updates on 6 and firewall on 1.
As percentages, 25 of 45 is about 56%, 13 is about 29%, seven about 16%, six about 13% and one about 2%. The encryption figure matches the 13 unencrypted laptops counted in chapter 1. Rerunning the lab with the same seed gives the same counts, which lets Gareth repeat the check and compare. Gareth can rerun the script after each rollout group and watch each failing count fall towards zero. Local admin is the largest gap by count, but not the first priority.
23.3 Priorities
Encryption first, because of the theft incident; local admin second, because it affects many settings; others follow.
Aisha's order reflects impact and how the settings depend on one another. Encryption comes first because 13 laptops could expose tenant data if lost, as Bramley's stolen laptop did. Local admin comes second because, with 25 laptops affected, its removal also protects the screen lock, firewall and update settings from being changed. Screen lock and automatic updates follow because their gaps are smaller, and the one firewall gap is fixed the same day.
23.4 Method
Settings are applied centrally through the management server, not laptop by laptop.
Gareth applies each setting once as a policy on the management server, and the agents on the laptops enforce it. Doing it this way means a new laptop receives all five settings when it is enrolled, without a manual checklist. The next baseline run shows whether each policy has reached every reporting laptop. Central policies also make rollback simple: Gareth can reverse one setting for one group from the console within the hour the rollback rule allows.
Why local admin causes drift
Local administrators can change any setting, including the firewall and screen lock, and can install software that changes settings. Removing local admin rights reduces the ways other settings can drift, which is why it ranks second despite encryption's higher impact. Aisha links this reasoning to the drift findings of the master's study her tutor shares.
She also notes that the firewall gap affects only one laptop, so it is fixed immediately rather than waiting for a programme.
Reporting gaps
The gap table is shared with Gareth weekly until all gaps close, so progress is visible.
Prioritising gaps
Encryption failing on 13 laptops is the top gap because of the stolen laptop. Local admin on 25 is next, because admin rights let other settings drift. Screen lock on 7 and automatic updates on 6 follow, and the single firewall gap is fixed at once. Aisha orders work by impact and effort, not by count alone.
Worked example
Aisha presents the gap table. Bramley's manager asks why admin rights matter so much. Aisha links them to chapter 13: with admin rights, staff or malware can undo other settings.
Synthetic case. Synthetic.
Errors and limits
Fixing the most common gap first is not always right; consider impact.
Exercises
- EX067 — Lab result. Which setting failed most? Rubric: 3 = local admin 25/45; 2 = partial; 1 = vague; 0 = none.
- EX068 — Priority. Why encryption first? Rubric: 3 = theft incident, data exposure; 2 = partial; 1 = vague; 0 = none.
- EX069 — Central fix. How are settings applied? Rubric: 3 = centrally via management server; 2 = partial; 1 = vague; 0 = none.
Synthesis
Measure baseline gaps and prioritise by impact.
Continue studying — chapter 23 of 40
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →