Chapter 2 — Systems, endpoints and hardware security: advanced seminar
Lesson map
Lesson 02 published. Map, example, EX008.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Baselines"]
N2["2.2 Why these settings"]
N3["Lab — baseline sample"]
N4["2.3 Reading the sample"]
N5["2.4 Seminar discussion"]
N6["Impact varies"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX008"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Baselines"]
N2["2.2 Why these settings"]
N3["Lab — baseline sample"]
N4["2.3 Reading the sample"]
N5["2.4 Seminar discussion"]
N6["Impact varies"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX008"]
[Learning outcomes]
|
v
[2.1 Baselines]
|
v
[2.2 Why these settings]
|
v
[Lab — baseline sample]
|
v
[2.3 Reading the sample]
|
v
[2.4 Seminar discussion]
|
v
[Impact varies]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX008]
Learning outcomes
You will (1) examine endpoint baselines in depth; (2) measure drift on a small sample; (3) discuss which settings matter most.
2.1 Baselines
A baseline is a documented set of settings. CIS Benchmarks give consensus recommendations, DISA STIGs give stricter requirements for defence systems, and Microsoft publishes Windows security baselines. Halvorsen's baseline selects six settings: disk encryption, firewall, SMB version 1 disabled, autorun disabled, a screen lock within ten minutes and no extra local administrator users.
Six settings is a small selection from the hundreds in a full CIS Benchmark. Halvorsen chose settings that are checked automatically every month, that a user with the right privileges could change, and whose failure has a clear consequence. That makes the baseline measurable for Chloé's study, but it also means her results describe drift in these six settings, not in the whole configuration.
2.2 Why these settings
Disk encryption protects lost laptops; the firewall limits network exposure; SMB1 is an old file-sharing protocol with known weaknesses; autorun can launch software from removable media; screen locks protect unattended devices; local administrators can change any setting.
The last item is different from the other five: an extra local administrator is not only a setting that drifts, it is the means by which the others can drift. A user who is a local administrator can turn off the firewall, re-enable SMB1 or lengthen the screen lock. That is why the seminar treats admin rights as both an outcome and a possible explanation.
Lab — baseline sample
"""Check synthetic laptop settings against a small baseline and count drift per setting (stdlib only)."""
baseline = {"disk_encryption": "on", "firewall": "on", "smb1": "off", "autorun": "off", "screen_lock_min": 10, "local_admin_users": 0}
laptops = [
{"disk_encryption": "on", "firewall": "on", "smb1": "off", "autorun": "off", "screen_lock_min": 10, "local_admin_users": 0},
{"disk_encryption": "on", "firewall": "off", "smb1": "off", "autorun": "off", "screen_lock_min": 30, "local_admin_users": 1},
{"disk_encryption": "off", "firewall": "on", "smb1": "off", "autorun": "on", "screen_lock_min": 10, "local_admin_users": 1},
{"disk_encryption": "on", "firewall": "on", "smb1": "off", "autorun": "off", "screen_lock_min": 10, "local_admin_users": 0},
{"disk_encryption": "on", "firewall": "on", "smb1": "on", "autorun": "off", "screen_lock_min": 15, "local_admin_users": 2},
{"disk_encryption": "on", "firewall": "on", "smb1": "off", "autorun": "off", "screen_lock_min": 10, "local_admin_users": 0}]
def ok(k, v): return v <= baseline[k] if k in ("screen_lock_min", "local_admin_users") else v == baseline[k]
drifted = [i for i, l in enumerate(laptops) if not all(ok(k, l[k]) for k in baseline)]
print(f"laptops {len(laptops)}, fully compliant {len(laptops)-len(drifted)}, drifted {len(drifted)}")
for k in baseline:
n = sum(not ok(k, l[k]) for l in laptops)
if n: print(f" {k}: {n}")
Run with python3 lab_baseline.py. Verified output:
laptops 6, fully compliant 3, drifted 3
disk_encryption: 1
firewall: 1
smb1: 1
autorun: 1
screen_lock_min: 2
local_admin_users: 3
2.3 Reading the sample
In six sample laptops, three comply fully and three drift. Extra local administrator users appear on all three drifted laptops; other failures appear once or twice.
The lab counts each setting across the six laptops: local admin users fail on three, screen lock on two, and encryption, firewall, SMB1 and autorun on one each. The laptop with 30 minutes for the screen lock also has its firewall off; the one with SMB1 on has two extra admins. A per-setting count like this is what lets Chloé later test Explanation A's prediction that admin devices drift on many settings at once.
2.4 Seminar discussion
The class discusses whether local administrator rights cause drift or whether people who need admin rights also change settings for work reasons. Both are plausible, which motivates chapter 4.
The sample is far too small to decide the question; it only shows that admin rights and other drift occur together. Chloé uses the discussion to sharpen her design: if admin rights cause drift, admin devices should drift on many settings; if engineers need both admin rights and changed settings for their software, the drift should concentrate in the engineering department and in specific settings such as firewall rules.
Impact varies
Not all drift is equally serious. A laptop without disk encryption exposes all its data if lost, while a screen lock of fifteen minutes instead of ten is a smaller change. Chloé records drift per setting so later analysis can weigh serious settings separately, and she notes that the study's main outcome treats any drift as drift, a simplification she will discuss as a limitation.
Worked example
A classmate asks why the screen lock counts as drift when set to 15 minutes. Chloé explains the baseline requires ten minutes or less, and the definition counts any difference, though impact varies by setting.
Synthetic case. Synthetic sample.
Errors and limits
Six laptops illustrate the method; they cannot estimate rates.
Exercises
- EX008 — Baseline sources. Name three baseline sources. Rubric: 3 = CIS, STIGs, Microsoft baselines; 2 = two; 1 = one; 0 = none.
- EX009 — Six settings. List Halvorsen's six settings. Rubric: 3 = encryption, firewall, SMB1 off, autorun off, lock ≤10, no extra admins; 2 = five; 1 = three; 0 = none.
- EX010 — Lab result. What did the sample show? Rubric: 3 = 3 compliant, 3 drifted; admin users on all 3; 2 = partial; 1 = vague; 0 = none.
- EX011 — SMB1. Why disable SMB1? Rubric: 3 = old protocol with known weaknesses; 2 = partial; 1 = vague; 0 = none.
- EX012 — Admin ambiguity. What two explanations fit the admin link? Rubric: 3 = admin causes drift; work needs cause both; 2 = partial; 1 = vague; 0 = none.
- EX013 — Screen lock. Why does 15 minutes count as drift? Rubric: 3 = baseline requires ≤10; 2 = partial; 1 = vague; 0 = none.
- EX014 — Sample limit. Why can the sample not estimate rates? Rubric: 3 = only six laptops; 2 = partial; 1 = vague; 0 = none.
Synthesis
Know what each baseline setting protects before measuring drift.
Continue studying — chapter 02 of 08
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →