Chapter 8 — Hardening workstations
Lesson map
Lesson 08 published. Map, example, EX022.
flowchart TD
N0["Learning outcomes"]
N1["8.1 The baseline"]
N2["8.2 The workstation lab"]
N3["Lab — Checking synthetic workstation settings agains"]
N4["8.3 Prioritising"]
N5["8.4 Repeating the check"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX022"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 The baseline"]
N2["8.2 The workstation lab"]
N3["Lab — Checking synthetic workstation settings agains"]
N4["8.3 Prioritising"]
N5["8.4 Repeating the check"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX022"]
[Learning outcomes]
|
v
[8.1 The baseline]
|
v
[8.2 The workstation lab]
|
v
[Lab — Checking synthetic workstation settings agains]
|
v
[8.3 Prioritising]
|
v
[8.4 Repeating the check]
|
v
[Worked example] --> [Exercise EX022]
Learning outcomes
You will (1) define a workstation baseline; (2) check workstations against it automatically; (3) prioritise fixes.
8.1 The baseline
Jamal and the IT manager agree a four-item baseline for Riverbend workstations: the local firewall on, disk encryption enabled, a screen lock after a few minutes and automatic updates on. Each item addresses a clear risk: network attacks, theft of a laptop, unattended screens at reception and unpatched software. Ms. Grant advises starting with a short baseline that can be checked reliably, then adding items later. He writes each item as a check that a script can perform automatically, with a clear pass or fail result and the setting it reads.
8.2 The workstation lab
The lab checks 210 synthetic workstations. The firewall is on for 201, 95.7 percent; disk encryption for 164, 78.1 percent; screen lock for 187, 89.0 percent; and automatic updates for 196, 93.3 percent. Only 129 workstations, 61.4 percent, meet all four items. Jamal notes that disk encryption is the weakest item and that the combined figure shows almost two in five workstations fail at least one check. He presents the results by item and combined in a short table, and the IT manager says the combined figure is much lower than he expected. They agree that encryption should be the first focus, because it has the lowest pass rate and protects against theft.
Lab — Checking synthetic workstation settings against a four-item baseline
"""Check synthetic workstation settings against a four-item baseline (stdlib only)."""
import random
random.seed(44)
items = ["firewall_on", "disk_encrypted", "screen_lock", "auto_updates"]
fail_p = {"firewall_on": 0.03, "disk_encrypted": 0.12, "screen_lock": 0.09, "auto_updates": 0.05}
ws = [{k: random.random() >= fail_p[k] for k in items} for _ in range(210)]
for k in items:
ok = sum(w[k] for w in ws)
print(f"{k}: {ok}/{len(ws)} ({ok/len(ws):.1%})")
allok = sum(all(w.values()) for w in ws)
print(f"all four: {allok}/{len(ws)} ({allok/len(ws):.1%})")
Run with python3 lab_workstations.py. Verified output:
firewall_on: 201/210 (95.7%)
disk_encrypted: 164/210 (78.1%)
screen_lock: 187/210 (89.0%)
auto_updates: 196/210 (93.3%)
all four: 129/210 (61.4%)
8.3 Prioritising
Jamal sorts failures by risk. Laptops without encryption come first, because they leave buildings and can be stolen. Reception computers without screen lock come next, because members pass them constantly. Desktop computers in locked offices without encryption come later. He discusses the order with the IT manager, who agrees and schedules encryption for laptops in the first week. He creates a simple task list with the failing workstations grouped by centre and priority, so the technician can fix several machines at each visit rather than travelling repeatedly between centres.
8.4 Repeating the check
Jamal schedules the check to run monthly and report results by centre. After two months, the share meeting all four items rises substantially, with remaining failures mostly old desktops due for replacement. He records these as exceptions with replacement dates. Ms. Grant notes that repeated checks turn a baseline from a document into a working control. He adds the monthly results to a chart that the IT manager shows at the quarterly management meeting. Ms. Grant asks him to record the exceptions with the reason and replacement date, so the baseline remains honest about what has not yet been fixed.
Worked example
Jamal defines a four-item baseline, finds 129 of 210 synthetic workstations (61.4 percent) meet all four, prioritises laptop encryption and schedules monthly checks.
Synthetic case. Workstations are synthetic; outputs come from lab_workstations.py.
Errors and limits
Reporting each item separately can hide how many machines fail at least one.
Exercises
- EX022 — Encryption rate. What share has disk encryption? Rubric: 3 = 164 of 210, 78.1 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX023 — Combined rate. How many meet all four items? Rubric: 3 = 129, 61.4 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX024 — First priority. Which failures come first? Rubric: 3 = laptops without encryption;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 08 (chapter 08 of 30)
← Chapter 07 · Course chapter index · Chapter 09 →
Continue to the next authored lesson.