4.3 Protecting Devices

Protecting a device isn't just about installing one tool and calling it a day. Real device security comes from layering several defenses together: written rules that tell people how to behave, software that hunts down malware, updates that patch holes before attackers find them, and a firewall that controls what traffic gets in or out. This topic walks through each of those layers and how they work together to keep a single device safer.

Managerial Controls for Device Security

Before you even touch a piece of software, organizations need written rules that tell employees how to use their devices. These written rules are called managerial controls, and they're the first line of defense. The three big ones you need to know are the acceptable use policy, the password policy, and the software installation policy.

more resources to help you study

practice questions

Acceptable Use Policy

An acceptable use policy (AUP) describes what users can, cannot, and must do on devices owned by the organization. Think of it as the rulebook every employee agrees to follow when they're handed a company laptop.

An AUP might include things like:

• Blocking access to certain websites or categories of sites (social media, gaming, streaming, etc.)
• Requiring users to keep their software updated
• Allowing users to connect peripherals like a mouse, keyboard, or monitor
• Prohibiting users from plugging in external drives or USB sticks (those can carry malware or be used to steal data)

The point of an AUP is to reduce risky behavior before it becomes a security incident. If someone plugs a random USB they found in the parking lot into their work laptop, that's a problem. A good AUP tells them not to do that, and it gives the company grounds to act if they do.

Password Policy

A password policy spells out the rules for user passwords inside an organization. Weak passwords are one of the easiest ways for attackers to break in, so this policy matters a lot.

Common requirements in a password policy:

• A minimum password length (and sometimes a maximum)
• A maximum amount of time you can keep the same password before changing it
• A rule against reusing old passwords
• Construction rules, like no dictionary words and required character sets (uppercase, lowercase, numbers, symbols)
• A recommendation to use a password manager instead of writing passwords on sticky notes

A solid password policy makes brute-force and dictionary attacks much harder. Password managers also get a shout-out because writing passwords down (or reusing the same one everywhere) is one of the most common user mistakes.

Software Installation Policy

A software installation policy describes what software, if any, users are allowed to install on their devices. This matters because every piece of software is a potential security risk. Unauthorized programs can carry malware, contain vulnerabilities, or quietly send data somewhere it shouldn't go.

A software installation policy usually includes:

• A rule against users installing software on their own
• A process to request new software they need for their job
• A list of pre-approved software users can install without asking

This way, the IT or security team gets to vet anything new before it lands on the device.

Anti-Malware Software

Even with strong policies, malware can still sneak onto a device. That's where anti-malware comes in.

Anti-malware software (also called antivirus software) is a tool that detects, quarantines, and removes malware. Malware is any software designed to corrupt, spy on, or destroy a system, and anti-malware is the dedicated tool built to fight it.

How Signatures Work

Every piece of known malware has identifying patterns in its code or behavior. These patterns are called signatures. Think of a signature like a fingerprint: even if the malware is hiding inside a file with a normal name, its signature gives it away.

Here's the basic process:

1. The anti-malware software keeps a database of malware signatures.
2. It periodically scans the files on the device.
3. For each file, it checks whether anything in the file matches a signature in its database.
4. If there's a match, the software quarantines the file (isolates it so it can't run or spread) and then removes it.

This is why anti-malware needs frequent updates. New malware appears every day, and if your signature database is from six months ago, you're going to miss the newer threats. The database has to stay current to be useful.

Keeping the Operating System and Software Updated

Updates are easy to ignore, but they're one of the most important things you can do to keep a device secure.

Software is written by humans, and humans make mistakes. Sometimes those mistakes create vulnerabilities: weaknesses that an attacker can exploit. When a vendor (like Microsoft, Apple, or Google) discovers a vulnerability in their operating system or app, they write a fix and send it out as an update. A small, targeted update like this is called a patch.

Here's the catch: once a patch is released, the vulnerability becomes public knowledge. Attackers now know exactly what hole to look for. If your device hasn't installed the patch, you're a sitting target. This is sometimes called a "known vulnerability," and attackers love them because the work is already done.

Keeping your operating system and applications updated to the latest version closes those known holes before adversaries can use them. It's one of the cheapest, most effective security habits there is, and yet it's the one people skip most often.

Configuring a Host-Based Firewall

A host-based firewall is software that runs on a single device and decides which network traffic is allowed in or out of that device. It works just like a network-based firewall, but instead of protecting an entire network, it protects one host.

Why use one if the network already has a firewall? Because if the network gets compromised, or if you're connected to a sketchy network (like public Wi-Fi at an airport), your network firewall isn't going to help you. A host-based firewall gives you an extra layer of defense that travels with the device.

How Firewall Rules Work

A host-based firewall follows a set of rules, also known as an ACL (access control list). Each rule says something like "allow this kind of traffic" or "deny that kind of traffic."

The most important thing to remember: rules are processed in order, and the first rule that matches is the one that gets applied. If rule 1 says "allow all web traffic" and rule 5 says "deny traffic from this specific website," rule 5 never runs for web traffic because rule 1 already matched. Order matters a lot.

Rules can allow or deny traffic based on:

• Source or destination IP address (where the traffic is coming from or going to)
• Source or destination port (like port 80 for HTTP, port 443 for HTTPS, port 21 for FTP)
• Service or protocol (TCP, UDP, ICMP, etc.)
• Application (the specific program trying to send or receive traffic)

Inbound and Outbound Traffic

A host-based firewall handles both directions:

• Inbound traffic: data coming into the device. Blocking unneeded inbound traffic stops attackers from connecting to services they shouldn't reach.
• Outbound traffic: data leaving the device. Blocking unneeded outbound traffic stops malware or attackers on your machine from sending data out.

A good rule of thumb: block any port or service the device doesn't actually need. If your laptop doesn't run an FTP server, there's no reason to allow inbound FTP traffic. If your laptop never legitimately uses FTP to send files anywhere, block outbound FTP too.

Here's why outbound blocking matters. Imagine an attacker gets remote access to your computer and tries to use FTP to copy your files to their own server. If your firewall has a rule blocking outbound FTP, that exfiltration attempt fails. The attacker is stuck on your machine but can't get the data out.

Sample Firewall Rules

Here's what a simple host-based firewall ACL might look like:

</>Code
Rule 1: ALLOW inbound TCP traffic on port 443 from any IP    (HTTPS web traffic)
Rule 2: ALLOW outbound TCP traffic on port 443 to any IP     (HTTPS to websites)
Rule 3: ALLOW outbound TCP traffic on port 53 to any IP      (DNS lookups)
Rule 4: DENY outbound TCP traffic on port 21 to any IP       (block FTP exfiltration)
Rule 5: DENY inbound traffic on any port from any IP         (default deny)

A few things to notice:

• Rule 4 specifically blocks outbound FTP, which protects against the exfiltration scenario above.
• Rule 5 is a "default deny" rule at the bottom. Anything that didn't match an earlier "allow" rule gets blocked here. This is a common firewall design pattern: allow only what you need, deny everything else.
• If Rule 5 were at the top instead of the bottom, it would block everything and nothing else would work. Order matters.

Steps to Configure a Host-Based Firewall

When you're setting one up, the general process looks like this:

1. Identify what the device actually needs. What services does it run? What does it connect to? A web browser needs outbound ports 80 and 443. A mail client needs different ports.
2. Write allow rules for needed traffic. Be specific. Allow only the ports, protocols, and IPs that are necessary.
3. Write deny rules for known-bad or risky traffic. Block outbound FTP, Telnet, and other risky protocols if they aren't needed.
4. Add a default deny rule at the end. Anything not explicitly allowed gets blocked.
5. Order the rules carefully. Remember, the first match wins.
6. Test it. Make sure legitimate traffic still flows and unwanted traffic actually gets blocked.

Layering all of these (policies, anti-malware, updates, and a host-based firewall) gives a single device a real shot at staying safe, even when something on the network goes wrong.