Chapter 32 — Systems, endpoints and hardware security: interdisciplinary interfaces

Lesson map

Lesson 32 published. Map, example, EX094.

flowchart TD
  N0["Learning outcomes"]
  N1["32.1 HR"]
  N2["32.2 Finance"]
  N3["32.3 Law"]
  N4["32.4 Facilities"]
  N5["32.5 Coordination"]
  N6["Why recovery matters"]
  N7["Offline copy"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX094"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["32.1 HR"]
  N2["32.2 Finance"]
  N3["32.3 Law"]
  N4["32.4 Facilities"]
  N5["32.5 Coordination"]
  N6["Why recovery matters"]
  N7["Offline copy"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX094"]

[Learning outcomes]
    |
    v
[32.1 HR]
    |
    v
[32.2 Finance]
    |
    v
[32.3 Law]
    |
    v
[32.4 Facilities]
    |
    v
[32.5 Coordination]
    |
    v
[Why recovery matters]
    |
    v
[Offline copy]
    |
    v
[Worked example] --> [Exercise EX094]

Learning outcomes

You will (1) connect endpoint security with HR, finance and law; (2) coordinate across roles.

32.1 HR

New staff get laptops configured before day one; leavers' accounts are disabled on their last day and laptops wiped.

The joiner step means a new laptop is enrolled, encrypted and baselined before its user arrives, so it never starts outside management. The leaver step closes the gap behind the unreported leaver in the worked example. HR now sends the leavers list to the monthly meeting, and Gareth disables each account on the last day and wipes the returned laptop before it is reissued.

32.2 Finance

Budget for replacing old laptops is planned three years ahead.

Planning three years ahead means the two laptops without a TPM, and others reaching the same age, are replaced on schedule instead of after failure. Aisha gives the finance manager the purchase year of each laptop from her inventory, which turns the replacement plan into a list with dates. The board's decision to fund a replacement for S04 also enters the same budget plan. Laptop replacement also feeds the encryption programme, because new laptops arrive with a TPM and are enrolled before use.

32.3 Law

Data protection duties shape encryption and breach response.

Bramley's duties under data protection law explain why the stolen laptop was reported and why tenants received letters. The same duties shape the breach procedure: Gareth confirms encryption status, the data protection lead decides on reporting, and the decision is recorded. Encryption on all 45 laptops is the control that most changes what such an assessment is likely to find. Aisha also notes that logon records are personal data, which is why they are kept for 90 days and viewed only by IT.

32.4 Facilities

Laptops are stored securely overnight in the office.

The rule agreed at the staff meeting applies here: laptops go home with staff or stay locked in the office, never in a parked car. Facilities provides a lockable cupboard for laptops left overnight, and the server cupboard stays locked with a key held by Gareth and the manager. Aisha records both as physical controls in the architecture, with their owners. The rule about parked cars is repeated in the joiner pack, so new staff hear it on their first day.

32.5 Coordination

A short monthly meeting covers joiners, leavers and purchases.

The meeting brings together Gareth, HR, the finance manager and Bramley's manager for about half an hour each month. It checks three lists: joiners who need laptops, leavers whose accounts must be closed, and planned purchases that must be registered. The leavers check was added after HR forgot to tell IT about one leaver. Each item agreed at the meeting is given an owner and a date, and checked again at the next meeting.

Why recovery matters

Hardening reduces how often things go wrong; recovery decides how bad it is when they do. The CIS Controls stress tested backups and planned restoration as part of data recovery. For Bramley, the key systems are the finance server and file server, and the key question is how long staff can work without them.

Aisha and Bramley's manager agree targets: the file server should be back within one working day with no more than one day's data lost; the finance server within two days. Laptops can be rebuilt from the management server in about two hours each, since data sync to the file server.

A restore test is run on a spare machine: Gareth restores the file server's backup and checks a sample of folders. It takes five hours, within the target. The finance database restore reveals that the application's licence file was not in the backup, which is fixed.

This test shows why backups must be restored, not just made: the missing file would have caused days of delay in a real event.

Offline copy

One backup copy is kept offline and rotated weekly, protecting against ransomware that might reach online backups.

Recovery contacts

A short list of contacts, including the contractor and the finance software vendor, is stored with the plan, on paper as well as online.

Laptop loss

For a lost laptop, the steps are: report, confirm encryption, revoke access, issue a replacement.

Synthetic case. Synthetic.

Errors and limits

Security gaps often lie between departments.

Exercises

• EX094 — Leavers. What happens for leavers?
  Show marking criteria

  Rubric: 3 = disable on last day, wipe laptop; 2 = partial; 1 = vague; 0 = none.
• EX095 — Finance link. How does finance support security?
  Show marking criteria

  Rubric: 3 = planned replacements; 2 = partial; 1 = vague; 0 = none.
• EX096 — Gap. What gap did the meeting close?
  Show marking criteria

  Rubric: 3 = unreported leaver; 2 = partial; 1 = vague; 0 = none.

Synthesis

Endpoint security depends on other departments.

Continue studying — chapter 32 of 40

← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →