◇ OpenCyber Academy
Bachelor's · Chapter 31 · English

Chapter 31 — Systems, endpoints and hardware security: advanced cases

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 31 — Systems, endpoints and hardware security: advanced cases

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 Legacy server"]
  N2["31.2 Firmware updates"]
  N3["31.3 Volunteers"]
  N4["31.4 Home Wi-Fi"]
  N5["31.5 Decision records"]
  N6["Writing the routine"]
  N7["Cover"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 Legacy server"]
  N2["31.2 Firmware updates"]
  N3["31.3 Volunteers"]
  N4["31.4 Home Wi-Fi"]
  N5["31.5 Decision records"]
  N6["Writing the routine"]
  N7["Cover"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 Legacy server]
    |
    v
[31.2 Firmware updates]
    |
    v
[31.3 Volunteers]
    |
    v
[31.4 Home Wi-Fi]
    |
    v
[31.5 Decision records]
    |
    v
[Writing the routine]
    |
    v
[Cover]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) handle harder endpoint cases; (2) balance security with service; (3) document decisions.

31.1 Legacy server

The old application server runs software that only works on an unsupported OS. Options: replace, isolate or accept risk. Bramley isolates it on its own segment with limited access while a replacement is procured.

The old server, S04, runs the housing application on Linux, and its operating system is approaching the end of vendor support. Replacing it needs money and the vendor's new version, while accepting the risk would leave unsupported software on the same network as the laptops. Isolation is the middle path: S04 sits on its own segment, reachable only by the staff who use the application, until the board-funded replacement arrives.

31.2 Firmware updates

Vendor firmware updates fix hardware-level issues such as speculative execution flaws (Kocher et al., 2019). Bramley applies them in small groups after checking recovery keys, because firmware changes can trigger recovery prompts.

Before each firmware group, Gareth confirms that every laptop in it has its recovery key in the directory. The worked example in chapter 17 shows why: a firmware update made one laptop ask for its key, and Gareth retrieved it in two minutes. Firmware versions are recorded in the inventory after each group, so the next check can show which laptops are still on old versions.

31.3 Volunteers

Volunteers sometimes need temporary access. They get managed loan laptops rather than using personal devices.

A volunteer who used a personal PC is how DESKTOP-7F2K appeared in the inventory comparison, with access through an old enrolment code. Managed loan laptops avoid that problem: they are encrypted, baselined and enrolled before they are lent, and wiped when they are returned. Bramley adopts the loan scheme from the partner charity in its comparative project, so volunteers get the same protections as staff.

31.4 Home Wi-Fi

Staff home networks are outside Bramley's control; the laptop firewall and VPN protect traffic.

Bramley cannot check or configure a staff member's home router, so the protections must travel with the laptop. The firewall set to the public profile blocks incoming connections on any network, and the VPN encrypts traffic to the office. Internet-based management means updates also reach home laptops, which matters for the home workers who appeared in the patch tail in chapter 12. Staff are asked to keep their home router's default password changed, but Bramley does not rely on that advice for protection.

31.5 Decision records

Each case has a written decision with reasons.

Each decision record names the problem, the options considered, the choice, the reason and an expiry or review date. The isolation of S04 is recorded with an expiry date aligned to the vendor's supported version due next year. Gareth stores the records in the decision log, so a future IT officer can see why each exception exists and when it should end. Decision records are reviewed at the monthly meeting when their date arrives, so an exception ends or is renewed on purpose.

Writing the routine

The weekly routine is a one-page checklist Gareth follows every Monday morning: review the inventory comparison, check update compliance and overdue items, confirm backups completed, scan the logon flags, and note anything unusual. Monthly, he adds the encryption verification and the services check. Each step names its report and the expected time.

Aisha times the routine over three weeks; it takes about forty minutes. She trims one step that duplicated another, bringing it under thirty-five minutes.

The routine includes what to do when something looks wrong: record it, decide if it is urgent, and fix or schedule. Urgent items, such as an unencrypted laptop or a missing backup, are handled the same day.

Cover

A colleague is trained to follow the routine when Gareth is on leave.

Records

Each week's completed checklist is saved, building evidence for audits.

Synthetic case. Synthetic.

Errors and limits

Isolation without an end date becomes permanent.

Exercises

Synthesis

Hard cases need documented, time-limited decisions.

Continue studying — chapter 31 of 40

← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →

Worked answers

EX091. Replace, isolate or accept risk.

EX092. Firmware changes can trigger recovery prompts.

EX093. Through managed loan laptops.