4.3 - Protecting Devices
Managerial Controls for Device Security
Acceptable Use Policy (AUP)
An AUP spells out what's allowed, prohibited, and required on organization-owned devices. This might include blocking social media, gaming, or streaming during work hours, requiring security updates within a set window (commonly 7 days), and restricting peripherals like banning personal USB drives while requiring company-issued encrypted ones instead.
A typical AUP permits business browsing, company email, approved software, and company-issued peripherals, while prohibiting personal social media at work, downloading entertainment content, installing unauthorized software, connecting personal USB drives, disabling security software, or sharing credentials. It requires installing updates promptly, locking your workstation when stepping away, reporting suspicious activity, and completing annual security training, usually with escalating consequences for repeat violations. Technical controls back this up in practice, like web filters blocking prohibited sites, USB ports disabled via group policy, and software whitelisting enforcing what can actually be installed.
Password Policy
A password policy spells out the organization's specific password requirements: length (commonly 12 to 14 characters minimum, with no real reason to cap the maximum), age rules (a short minimum age to prevent immediately changing back, and typically no forced maximum expiration per current guidance), reuse prevention (remembering the last several password hashes), and construction rules (requiring mixed character types, banning usernames, common words, sequential characters, and keyboard patterns like "qwerty"). It typically recommends an approved password manager, prohibits writing passwords on paper or storing them in unencrypted files, and requires MFA for remote access, admin accounts, and financial systems.
Software Installation Policy
This policy defines what users can install and how to request more. Approaches range from complete prohibition (only IT installs anything) to a whitelist approach (users can install from a pre-approved list, with a request process for anything else) to a role-based approach (standard users can't install anything, power users get an approved list, developers get dev tools, and admins have broader access subject to logging).
A typical policy allows things like productivity suites, communication tools, browsers, and approved dev tools, while banning peer-to-peer file sharing, personal cloud storage, unapproved remote access tools, cryptocurrency miners, and unapproved browser extensions. Requests usually go through a ticket with business justification, manager approval, and a short security review before installation, with an expedited path for genuinely urgent business needs. The reasoning here is straightforward: unauthorized software brings real risk, malware, unpatched vulnerabilities, licensing violations, and extra support burden.
Anti-Malware Software
Anti-malware software detects, quarantines, and removes malicious software using a database of known malware signatures, unique identifiers like file hashes, byte patterns, or specific behaviors.
How detection works: the software maintains a signature database, periodically scans the device (full scans weekly or monthly, quick scans daily, real-time scanning continuously as files get accessed), compares scanned files against the database, and when it finds a match, quarantines the file to stop it from executing or spreading, then removes it once confirmed malicious.
Example: a user downloads a disguised executable, and the real-time scanner intercepts it immediately, calculates its hash, matches it against a known trojan in the database, blocks the download, quarantines the file, alerts the user, and logs the incident, all before the malware ever gets a chance to run.
Why updates matter so much: thousands of new malware variants appear every day, so signature databases need to update constantly, ideally multiple times a day for critical threats and at least daily overall. Without recent updates, antivirus can only catch old, already-known threats and will completely miss anything new.
Beyond basic signature matching, modern tools add heuristic analysis (flagging suspicious behavior patterns even without an exact signature match, like a program rapidly encrypting files or hiding from Task Manager), sandbox analysis (running suspicious files in an isolated environment to observe behavior before allowing them on the real system, catching zero-days with no signature yet), and machine learning (trained on millions of malware samples to recognize variants and catch polymorphic malware that changes its own code to dodge simple signature matching).
Operating System and Software Updates
Security researchers and attackers alike are constantly finding new vulnerabilities in operating systems and software. When one is found, the vendor or organization that maintains the software fixes it and sends out an update. A small update is called a patch. Installing the update closes the hole, so adversaries can no longer use that known vulnerability against the device. Security patches fix vulnerabilities and should be treated as urgent, feature updates add new capabilities and are less time-sensitive, and bug fixes resolve non-security issues that can wait.
There's typically a window between when a vulnerability is discovered, when a vendor releases a fix, and when attackers develop working exploits, meaning anything left unpatched after a fix is available sits in real danger. WannaCry in 2017 is the classic example: Microsoft released a patch for the underlying SMB vulnerability in March, but WannaCry itself hit in May, and organizations that had already patched were safe while those that hadn't ended up among the 200,000+ infected computers across 150 countries, causing an estimated $4 billion in damage, purely because a known, available patch hadn't been applied.
Best practice is enabling automatic updates for critical security patches (often scheduled during off-hours), manually reviewing and installing other updates promptly (security patches within days, feature updates within a month or so), testing updates in a staged rollout for enterprise environments before deploying broadly (though critical security patches should go out immediately regardless), and replacing software that's stopped receiving updates entirely, like the risk created by continuing to run Windows 7 well past its 2020 end of support.
Host-Based Firewalls
A host-based firewall protects an individual device by filtering the traffic entering and leaving that specific machine, providing defense in depth even when the network-level firewall gets bypassed or doesn't apply. For example, a laptop on a compromised hotel network has no network firewall protecting it at all, but its own host firewall can still block malicious connections. Or if a malicious insider or malware on a USB drive gets past network defenses, a host firewall can still block unauthorized incoming connections or stop malware from reaching out to a command server.
Host firewalls work just like network firewalls, following sequential rules where the first match wins. A typical Windows Firewall config might allow RDP only from a specific IT management subnet, deny RDP from everywhere else, allow HTTPS for updates, and deny everything else inbound by default.
A really important capability here is blocking outbound traffic, which helps prevent data exfiltration. For example, if an attacker gains remote access and tries to FTP stolen files out, a firewall rule blocking outbound FTP stops that cold. Other useful outbound blocks include denying unused, insecure protocols like Telnet or old NetBIOS/SMB ports vulnerable to worms, restricting things like SSH only to approved servers, routing web traffic only through an approved proxy, and blocking known malware command-and-control ports.
Rules can filter by port, IP address, specific service, protocol, or even specific application, like explicitly allowing a known browser to make outbound connections while denying an unrecognized executable from doing the same.
A well-configured workstation firewall might allow inbound RDP and PowerShell remoting only from IT's management subnet, allow ping from the internal network for troubleshooting, and deny everything else inbound by default with logging. Outbound, it might allow web browsing, email only to the internal mail server, DNS only to the internal DNS server, and file sharing only to the file server subnet, while explicitly denying and logging FTP, TFTP, Telnet, and similar risky protocols, with a default deny catching everything else, plus specific per-application exceptions for things like the browser, email client, video conferencing app, and company VPN. All denied connections and anything to or from external IPs get logged and forwarded to a SIEM, with alerts for things like repeated denied outbound connections or any attempt to use FTP or Telnet.
Reading a host-based firewall's rules: the rule list is an access control list (ACL), just like on a network firewall, and it's checked from the top down. Here's a simple ACL for an office workstation (
10.10.5.0/24 is the IT team's subnet and 10.10.1.10 is the company's DNS server):# | Direction | Action | Traffic | Source or destination |
1 | Inbound | Allow | RDP (TCP port 3389) | From 10.10.5.0/24 only |
2 | Inbound | Deny | RDP (TCP port 3389) | From anywhere |
3 | Outbound | Deny | FTP (TCP ports 20 and 21) | To anywhere |
4 | Outbound | Allow | HTTPS (TCP port 443), web browser app only | To anywhere |
5 | Outbound | Allow | DNS (UDP port 53) | To 10.10.1.10 only |
6 | Inbound | Deny | Anything | From anywhere (default deny) |
7 | Outbound | Deny | Anything | To anywhere (default deny) |
Walking a few connections through it: an RDP connection from an IT computer at
10.10.5.20 matches rule 1 and is allowed. An RDP connection from 198.51.100.9 doesn't match rule 1 (wrong source) but matches rule 2, so it's denied. Malware trying to send a stolen file to its server over FTP matches rule 3 and is blocked, which is exactly the exfiltration that rule is there to stop. An unknown program trying to connect out over port 443 doesn't match rule 4 (it isn't the browser), so it falls through to rule 7 and is denied. Replies to allowed outbound connections, like a web page coming back to the browser, still get in, since host-based firewalls are usually stateful (see 3.4).Order matters here too. If rule 2 were moved above rule 1, every RDP connection, including IT's, would hit the deny first, and IT could never connect.
Defense in Depth for Devices
Combining all of these device controls creates real layered protection: policy (AUP, password policy, software policy) sets the ground rules for secure behavior, anti-malware catches known threats via signatures, updates eliminate vulnerabilities before they can be exploited, host firewalls filter traffic to block unauthorized access, and authentication (especially MFA) prevents access even if credentials get stolen.
Example of layers working together: a phishing email with a malicious attachment gets blocked by anti-malware. A browser exploit attempt fails because the browser's already patched. Stolen credentials get blocked at login because MFA demands a second factor the attacker doesn't have. A physical access attempt at remote connection gets blocked by the host firewall. And an attempt to install unauthorized software gets blocked by the software policy and application whitelisting. Each layer catches what the others might miss, so no single bypassed control leads to a full compromise.