Chapter 3 — Hosts, devices and accounts

Chapter 3 — Hosts, devices and accounts

Lesson map

Lesson 03 published. Map, example, EX009.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Device accounts"]
  N2["3.2 Screen locks"]
  N3["3.3 Device register"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX009"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Device accounts"]
  N2["3.2 Screen locks"]
  N3["3.3 Device register"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX009"]

[Learning outcomes]
    |
    v
[3.1 Device accounts]
    |
    v
[3.2 Screen locks]
    |
    v
[3.3 Device register]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX009]

Learning outcomes

You will (1) relate devices to accounts; (2) configure screen locks and local admin rights; (3) record device ownership.

3.1 Device accounts

Each computer has local accounts as well as directory sign-in. Tomas finds that staff on four surgery computers use a local administrator account for daily work, a habit from when software needed it to install updates. A daily account with administrator rights means any harmful download runs with full control of the machine. He records the four devices and agrees with Priya to remove local admin rights, keeping one separate local admin account per device managed by IT with a unique password.

3.2 Screen locks

Dental surgeries are busy, and a computer left signed in while a dentist examines a patient can be seen by the patient. Tomas configures an automatic lock after five minutes in surgeries and two minutes at reception, through the device management console. He checks each device afterwards and finds one that did not receive the setting because it was not enrolled. He enrols it and checks again. Configuring is not the same as verifying, so he always confirms the setting took effect.

3.3 Device register

Tomas creates a register listing each device, its location, enrolment status, primary user and last check. The register lets him answer questions such as which devices a leaver used and which are not managed. He reviews it monthly. When a nurse leaves, the register shows her assigned laptop, which IT collects and resets. Keeping device and account records linked closes the gap where a person leaves but their device keeps a signed-in session. The register also records which devices hold hardware keys, so lost equipment can be traced quickly.

Worked example

Four devices lose daily admin rights; screen locks reach all devices after one missing enrolment is fixed; a device register is created.

Synthetic case. Devices and findings are synthetic.

Errors and limits

Assuming a pushed setting applied everywhere without checking misses unenrolled devices.

Exercises

• EX009 — Admin risk. Why is a daily admin account risky? Rubric: 3 = harmful downloads run with full control;; 2 = full control;; 1 = slow;; 0 = none.
• EX010 — Lock times. What lock times were set? Rubric: 3 = 5 minutes surgeries, 2 minutes reception;; 2 = five and two;; 1 = one;; 0 = none.
• EX011 — Missed device. Why did one device miss the setting? Rubric: 3 = not enrolled;; 2 = unenrolled;; 1 = broken;; 0 = none.
• EX012 — Register use. How did the register help when a nurse left? Rubric: 3 = showed her laptop to collect;; 2 = laptop;; 1 = vague;; 0 = none.

Synthesis

Linking devices to accounts and verifying settings keeps endpoints from undermining access control.

Continue studying — chapter 03 of 18

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →