Security techniques for computing resources

Every device class needs its own hardening. This objective covers secure baselines, hardening targets from mobile phones to ICS, wireless security settings, application security, sandboxing, and monitoring.

Secure baselines

A secure baseline is the approved, hardened configuration for a type of system. The life cycle is establish (build it from benchmarks such as CIS), deploy (push it with images, group policy, or configuration management), and maintain (update it and check for drift). Hardening targets include mobile devices, workstations, switches, routers, cloud infrastructure, servers, ICS/SCADA, embedded systems, RTOS, and IoT.

Wireless

Use WPA3 where possible; it replaces the pre-shared key handshake with SAE, which resists offline dictionary attacks. Enterprise mode uses 802.1X with a RADIUS server so each user has their own credentials. A site survey and heat map show coverage and help place access points so the signal doesn't leak far outside the building.

Application security and sandboxing

Secure coding practices include input validation, secure cookies (Secure and HttpOnly flags), static code analysis (reviewing source without running it), and code signing. Sandboxing runs untrusted code in an isolated environment so it can't affect the host, which is how browsers and malware analysis tools contain risk.

• Input validation: reject or sanitize bad input at the boundary.
• Static analysis: find flaws in source code before release.
• Code signing: prove the publisher and that code is unaltered.
• Sandboxing: isolate execution of untrusted code.

Key terms

Secure baseline

An approved, hardened configuration standard that systems of a given type must match.

WPA3

The current Wi-Fi security standard, which uses SAE to resist offline password-guessing attacks.

Simultaneous Authentication of Equals (SAE)

The WPA3 key exchange that replaces the pre-shared key handshake and resists offline dictionary attacks.

RADIUS

A protocol that centrally authenticates, authorizes, and accounts for network access.

Site survey

An assessment of a location's wireless environment to plan access point placement and find interference.

Input validation

Checking that input matches expected format, type, and length before using it.

Static code analysis

Examining source code for security flaws without running it.

Sandboxing

Running code in an isolated environment so it can't affect the host or other systems.

Secure cookies

Cookies set with flags such as Secure and HttpOnly to stop interception and script access.

Mobile device hardening

Securing phones and tablets with screen locks, encryption, updates, and app restrictions.