Chapter 1 — Week 1: Know your devices and update them
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Start with a list"]
N3["1.3 The quick check"]
N4["Lab — Five-point quick check"]
N5["1.4 Reading the result"]
N6["1.5 Getting updates working"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Start with a list"]
N3["1.3 The quick check"]
N4["Lab — Five-point quick check"]
N5["1.4 Reading the result"]
N6["1.5 Getting updates working"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 Start with a list]
|
v
[1.3 The quick check]
|
v
[Lab — Five-point quick check]
|
v
[1.4 Reading the result]
|
v
[1.5 Getting updates working]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) list every device and who uses it; (2) run a five-point quick check; (3) get updates working everywhere.
1.1 The case
Leah Morgan volunteers as the IT lead at the fictional Fenwick Community Food Bank, which has twelve laptops used by staff and volunteers, a shared PC at the front desk and a cloud email and file service. Leah is taking the one-month rapid course from the fictional Northgate Learning. Last month a volunteer's laptop was stolen from a car, and nobody could say whether it was encrypted or what was on it. The trustees asked Leah to make sure that does not happen again, with no budget beyond what the food bank already pays for.
1.2 Start with a list
You cannot protect what you do not know about. CIS Controls v8 starts with an inventory of devices for this reason. Leah makes a simple spreadsheet with one row per device: a short name, who uses it, model, serial number and where it normally lives. She finds the twelve laptops, the front desk PC and an old laptop in a cupboard that nobody uses, which is wiped and recycled.
The serial number column answers the question the theft raised: with it, the food bank can tell the police and the insurer exactly which device was taken. The "where it lives" column matters for the same reason; a laptop that normally goes home in a volunteer's car carries more risk than one that stays in the office.
1.3 The quick check
Leah checks five things on every laptop, because together they cover the most common harms: updates installed within fourteen days, disk encryption on, the user working in a standard account rather than an administrator, a screen lock, and files backed up in the last week. Each is a yes or no.
Each check maps to a part of the stolen-laptop problem. Encryption decides whether a thief can read the disk. Backups decide whether the food bank loses work. Updates and a standard account make it harder for a harmful program to take over a laptop in the first place. A screen lock protects a laptop left open on the front desk. Recording yes or no keeps the check quick enough to repeat every month.
Lab — Five-point quick check
"""Five-point quick check across a small charity's laptops (synthetic, stdlib only)."""
checks = ["updates<=14d", "encrypted", "standard user", "screen lock", "backup<=7d"]
laptops = {"FB01": [1,1,1,1,1], "FB02": [1,0,0,1,1], "FB03": [0,1,1,1,0], "FB04": [1,1,0,1,1], "FB05": [1,1,1,0,1],
"FB06": [1,0,1,1,1], "FB07": [0,0,0,1,0], "FB08": [1,1,1,1,1], "FB09": [1,1,0,1,1], "FB10": [1,1,1,1,0],
"FB11": [1,0,1,1,1], "FB12": [1,1,1,1,1]}
for i, c in enumerate(checks):
print(f"{c:14} {sum(v[i] for v in laptops.values()):2d}/{len(laptops)}")
full = [k for k, v in laptops.items() if all(v)]
print(f"laptops passing all five: {len(full)}/{len(laptops)}; worst: {min(laptops, key=lambda k: sum(laptops[k]))}")
Run with python3 lab_quickcheck.py. Verified output:
updates<=14d 10/12
encrypted 8/12
standard user 8/12
screen lock 11/12
backup<=7d 9/12
laptops passing all five: 3/12; worst: FB07
1.4 Reading the result
Only three of twelve laptops pass all five. Encryption and standard accounts are weakest at eight of twelve each. FB07 fails four checks: it is an old laptop used by a weekend volunteer. Screen lock is nearly everywhere already. This tells Leah where to spend her four weeks.
The lab's per-laptop rows show where the gaps sit. FB02, FB06, FB07 and FB11 are not encrypted; FB02, FB04, FB07 and FB09 have users working as administrators; FB03 and FB07 are behind on updates; FB03, FB07 and FB10 have no recent backup; and only FB05 lacks a screen lock. FB01, FB08 and FB12 pass everything. Encryption comes first because it is exactly what nobody could confirm for the stolen laptop.
1.5 Getting updates working
Two laptops are behind on updates. One has a full disk; the other has updates paused. Leah frees space, removes the pause and sets updates to install automatically with a restart outside opening hours. She also checks that the browser and PDF reader update themselves. NIST SP 800-40 Rev. 4 describes patching as preventive maintenance; for a small charity, that means making automatic updates work and checking them monthly.
Both problems were invisible to the users: a laptop with paused updates keeps working normally until the day a known flaw is used against it. Fixing the cause matters more than installing the missing updates once. A full disk will fill again, so Leah moves old files to the cloud service as well as clearing space. By Friday all twelve laptops show updates within fourteen days.
Worked example
Leah fills in the spreadsheet in an afternoon, runs the quick check over two days as volunteers come in, and fixes the two update problems the same week. By Friday, all twelve laptops show updates within fourteen days.
Synthetic case. Fenwick Community Food Bank, Northgate Learning and all people and data are fictional; figures are synthetic.
Errors and limits
Assuming a laptop is fine because it seems to work is how the stolen laptop's status went unknown. Check, record and date it.
Exercises
- EX001 — Inventory first. Why does the course start with a device list? Rubric: 3 = cannot protect unknown devices, links to CIS; 2 = knowing devices; 1 = vague; 0 = none.
- EX002 — Spreadsheet columns. List the columns of Leah's device spreadsheet. Rubric: 3 = five columns; 2 = four; 1 = fewer; 0 = none.
- EX003 — Cupboard laptop. What should happen to an unused old laptop? Rubric: 3 = wipe and recycle with record; 2 = remove; 1 = keep; 0 = none.
- EX004 — Five checks. Name the five quick checks. Rubric: 3 = all five; 2 = four; 1 = fewer; 0 = none.
- EX005 — Weakest checks. Which checks scored lowest in the lab? Rubric: 3 = encryption and standard user, 8/12; 2 = one; 1 = wrong; 0 = none.
- EX006 — All-five count. How many laptops passed every check? Rubric: 3 = 3 of 12; 2 = three; 1 = wrong; 0 = none.
- EX007 — Worst laptop. Which laptop did worst and why might that be? Rubric: 3 = FB07, old weekend volunteer laptop; 2 = FB07; 1 = wrong; 0 = none.
- EX008 — Full disk. How can a full disk stop updates? Rubric: 3 = no space to download and install; 2 = blocks; 1 = vague; 0 = none.
- EX009 — Paused updates. What should Leah do about paused updates? Rubric: 3 = remove pause, set automatic; 2 = unpause; 1 = vague; 0 = none.
- EX010 — Other software. Besides Windows, what else needs updating? Rubric: 3 = browser and PDF reader with checking; 2 = apps; 1 = vague; 0 = none.
- EX011 — Restart timing. When should automatic restarts happen at a food bank? Rubric: 3 = outside opening hours; 2 = later; 1 = anytime; 0 = none.
- EX012 — Recording dates. Why write the date beside each check? Rubric: 3 = shows when status was true, enables comparison; 2 = tracking; 1 = vague; 0 = none.
- EX013 — Stolen laptop lesson. What did the stolen laptop reveal about the food bank? Rubric: 3 = unknown encryption and contents; 2 = no records; 1 = vague; 0 = none.
Synthesis
In week one, Leah knows every device, has a clear picture of five basics, and has updates working everywhere.