Given a scenario, apply common security techniques to computing resources
Secure baselines, hardening targets, wireless security settings, and mobile deployment models.
- Reading time
- 26 min read
- Flashcards
- 21 cards
- Practice questions
- 10 questions · 3 PBQs
A broad objective covering how you actually make things secure: baselines, hardening, wireless, mobile, and application security. Mostly recognition, with a few distinctions the exam leans on hard — particularly the mobile deployment models and WPA3.
Secure baselines
A baseline is the defined secure configuration a system type should have. Three verbs, and the exam uses them:
Establish the baseline (usually from a benchmark like CIS — see 4.4). Deploy it consistently across systems. Maintain it, because a baseline that drifts is no longer a baseline.
Configuration drift
Systems gradually diverging from their baseline through ad-hoc changes. It is why maintenance is a named step rather than an afterthought — and it is what change management (1.3) exists to prevent.
Hardening
Hardening is reducing attack surface. The universal moves, whatever the target:
- Remove or disable unnecessary services, software and ports
- Change default credentials
- Apply patches
- Enforce least privilege
- Enable logging
- Install a host-based firewall and EDR
CompTIA lists specific hardening targets, and the distinctions worth holding are the awkward ones:
ICS / SCADA · embedded · RTOS
- Often cannot be patched or taken offline
- Availability outranks confidentiality
- Harden by isolation and monitoring
Servers · workstations · mobile
- Patchable on a normal cycle
- Standard baseline and hardening applies
- Managed centrally
The tellIf the target cannot be patched, the answer is segmentation and compensating controls — the same pattern as 1.1 and 4.3.
Check yourself
A manufacturing plant's SCADA controllers run an unsupported OS that cannot be patched. What is the appropriate hardening approach?
Wireless
Installation considerations are two terms:
Site survey — measuring the physical environment to plan access point placement, channels and power. Heat map — the visual output showing signal coverage and dead zones.
Wireless security settings
WPA3 is current and the correct answer for modern wireless. What it improved:
- SAE (Simultaneous Authentication of Equals) replaces the WPA2 pre-shared key handshake, defeating offline dictionary attacks against captured handshakes.
- Forward secrecy, so capturing traffic now and cracking the password later does not decrypt it.
WPA2 is legacy, WEP is broken and always wrong.
Enterprise vs personal is the other distinction:
WPA3-Personal (PSK/SAE)
- One shared passphrase
- Everyone uses the same secret
- Home and small office
WPA3-Enterprise (802.1X)
- Per-user credentials via RADIUS
- Revoke one user without changing anything else
- Corporate networks
The tellIf a departing employee should lose access without re-keying the whole network, the answer is Enterprise with 802.1X and RADIUS.
AAA/RADIUS provides the authentication back end for 802.1X — the same AAA from 1.2.
Mobile deployment models
Reliably tested. Three models, distinguished by who owns the device and who chooses it:
| Model | Owner | Device choice | Privacy tension |
|---|---|---|---|
| BYOD | Employee | Employee's own | Highest — personal device, company data |
| COPE | Company | Company-issued, personal use allowed | Moderate |
| CYOD | Company | Employee picks from an approved list | Moderate |
MDM
Mobile Device Management — enforces policy on mobile devices: encryption, screen lock, app restrictions, and remote wipe. The control that makes any of these models workable.
Connection methods worth recognising: cellular, Wi-Fi, and Bluetooth. Bluetooth attacks appear in 2.4 (bluejacking, bluesnarfing), so keep the term in view.
Check yourself
Employees use their personal phones for work email. The company needs to remove corporate data if a phone is lost, without deleting personal photos. Which capability is required?
Application security
Four items CompTIA lists explicitly:
Input validation
Checking that input matches what is expected before processing it. The root defence against injection attacks — and the reason parameterised queries beat filtering.
Secure cookies
Cookies flagged Secure (HTTPS only) and HttpOnly (unreadable by JavaScript, which blunts session theft via XSS).
Static code analysis
Automated review of source code without running it. Same as SAST in 4.3.
Code signing
Signing code with a private key so users can verify it came from the stated publisher and has not been altered. Note the reuse of digital signatures from 1.4.
Sandboxing and monitoring
Sandboxing runs untrusted code in an isolated environment where it cannot affect the host. Used for malware analysis and to contain browser and application processes.
Monitoring closes the loop — a hardened system that nobody watches drifts, and 4.4 covers the machinery.