2.0 Security

• Choose controls based on what is being protected: people, facilities, devices, accounts, data, or services.
• Physical controls slow, deter, detect, and document unauthorized access.
• Logical controls verify identity, enforce authorization, limit privilege, and track activity.

Physical Controls

• Locks, badge readers, key fobs, smart cards, mobile credentials, guards, fences, gates, lighting, cameras, alarms, and motion sensors protect spaces and assets.
• Access vestibules help prevent tailgating by controlling one person or group at a time.
• Biometrics can verify a person by fingerprint, face, voice, retina, palm, or other body features.

Logical Controls

• Least privilege gives users only the access needed for the task.
• Zero Trust verifies explicitly instead of trusting based on location alone.
• MFA, SSO, SAML, ACLs, IAM, PAM, JIT access, MDM, DLP, and directory services support identity and access control.

Security Design

• Good controls reduce risk while allowing legitimate work.
• Overly broad access creates exposure; overly restrictive controls can create workarounds.
• Monitoring and logs help prove what happened after an event.

• Windows security includes antivirus, firewall rules, account types, authentication methods, file permissions, encryption, and policy.
• Use standard user accounts for everyday work and administrative elevation only when needed.
• Protect the device and the data; do not focus only on sign-in.

Accounts and Authentication

• Local accounts, Microsoft accounts, domain accounts, standard users, administrators, guests, and power users have different rights.
• Authentication can include password, PIN, fingerprint, facial recognition, SSO, and passwordless sign-in.
• UAC reduces accidental administrative changes and prompts for elevation when needed.

Permissions and Encryption

• NTFS permissions protect files and folders locally; share permissions control network access.
• Inheritance can pass permissions from parent folders to child objects.
• BitLocker protects full drives; BitLocker To Go protects removable drives; EFS encrypts selected files or folders.

Defender and Firewall

• Microsoft Defender Antivirus should be enabled, updated, and monitored.
• Windows Defender Firewall uses profiles and rules to allow needed traffic and block unwanted traffic.
• Domain policies can enforce settings consistently across managed computers.

• Wireless traffic needs encryption and authentication because the signal extends beyond the cable plant.
• Use WPA3 when supported; use WPA2 with strong settings when WPA3 is not available.
• Avoid weak or legacy methods unless a scenario explicitly explains a temporary compatibility constraint.

Protocols and Encryption

• WPA2 and WPA3 are common modern wireless protections.
• AES is preferred over older TKIP-based protection.
• Open networks provide convenience but do not protect private access.
• Hidden SSIDs are not strong security because wireless tools can still discover networks.

Authentication Services

• RADIUS supports centralized authentication, commonly with 802.1X wireless or wired access.
• TACACS+ is often associated with device administration authentication, authorization, and accounting.
• Kerberos is used in many domain authentication environments.

MFA and Identity

• MFA requires more than one proof of identity, such as password plus code, push approval, token, smart card, or biometric.
• Enterprise wireless supports per-user accountability better than a shared passphrase.

• Malware clues include encryption notices, suspicious processes, browser redirects, disabled tools, credential prompts, performance issues, unknown extensions, and unusual network traffic.
• Containment matters when malware could spread or steal data.
• Cleanup must be followed by prevention and verification.

Common Malware

• Trojans disguise malicious action as something useful.
• Rootkits hide deeply and can undermine trust in the OS.
• Viruses spread by infecting files; boot sector malware affects startup areas.
• Spyware, keyloggers, stalkerware, and adware track, capture, or manipulate user activity.
• Ransomware encrypts or threatens data; cryptominers consume resources for profit.
• Fileless malware uses memory and trusted tools to reduce obvious files on disk.

Security Tools

• Antivirus, anti-malware, EDR, MDR, XDR, software firewalls, email gateways, and recovery environments provide different layers.
• Offline or preinstallation scans can help when malware interferes with normal tools.
• OS reinstall or reimage may be the right answer when trust cannot be restored.

Prevention

• Patch systems, restrict privilege, filter email, use endpoint protection, train users, and back up data.
• Anti-phishing training helps users recognize delivery paths before malware runs.

• Social engineering attacks manipulate trust, urgency, fear, authority, curiosity, or convenience.
• The best response often depends on whether the attack arrived by email, phone, SMS, QR code, physical access, or compromised software.
• Train users to verify before acting.

Social Engineering

• Phishing uses email; spear phishing targets a specific person or group; whaling targets executives or high-value users.
• Vishing uses voice; smishing uses SMS; QR phishing uses malicious QR codes.
• Shoulder surfing, tailgating, impersonation, and dumpster diving exploit physical or human process gaps.

Threats and Attacks

• DoS and DDoS disrupt service availability.
• Evil twin networks impersonate trusted Wi-Fi.
• Spoofing, on-path attacks, brute force, dictionary attacks, BEC, SQL injection, cross-site scripting, insider threats, zero-days, and supply chain attacks each have different clues.

Vulnerabilities

• Unpatched software, end-of-life systems, unprotected systems, non-compliant systems, and unmanaged BYOD increase risk.
• A vulnerability becomes more dangerous when it aligns with an active threat and valuable data.

• Do not jump straight to cleanup if the system may spread malware or expose data.
• Verify symptoms, contain the system, remediate, restore protections, and educate the user.
• Escalate or reimage when the device cannot be trusted.

Investigation and Quarantine

• Identify symptoms and confirm the issue with evidence.
• Quarantine affected systems when needed by disconnecting from the network or limiting access.
• Protect credentials and sensitive data if compromise is possible.

Remediation

• Disable System Restore where appropriate before cleanup so malware is not preserved in restore points.
• Update anti-malware tools and scan in normal, safe, or preinstallation environments as appropriate.
• Use recovery tools, EDR guidance, or OS reinstall if cleanup is not reliable.

Recovery and Education

• Re-enable restore protections, create a clean restore point, run updates, schedule scans, and verify normal operation.
• Educate the user about how the infection likely happened and how to avoid repeat exposure.

• Hardening makes the default workstation safer before an attack occurs.
• Focus on data protection, account protection, firmware protection, login limits, service control, and physical protection.
• Use baselines so settings are consistent and repeatable.

Data and Credential Protection

• Use device encryption to protect data at rest.
• Password policies may include length, complexity, uniqueness, expiration, and password manager usage.
• Screen locks and automatic lock timers protect unattended sessions.
• Handle PII carefully and avoid unnecessary local storage.

Firmware and Physical Controls

• Firmware passwords protect BIOS/UEFI settings.
• Disable AutoRun/AutoPlay where removable media risk exists.
• Laptop locks and secure storage reduce theft opportunities.

Account Restrictions

• Restrict permissions, login times, guest accounts, failed attempts, lockout duration, account expiration, default admin accounts, and unused services.
• Disable or remove what is not needed.

• Mobile security protects devices that leave the building, connect to many networks, and hold sensitive personal or company data.
• Use encryption, strong screen locks, OS/app updates, endpoint tools, backups, remote actions, and clear ownership policies.
• Lost device planning matters before the device disappears.

Device Controls

• Lock methods include PIN, password, pattern, fingerprint, facial recognition, and swipe. Stronger methods are preferred for sensitive data.
• Device encryption protects data if the device is lost or stolen.
• Configuration profiles and MDM can enforce settings across company-owned and BYOD devices.

Endpoint Protection

• Keep mobile OS and apps patched.
• Use anti-malware, content filtering, app controls, and safer app-store practices where appropriate.
• Android openness can increase risk; iOS controls reduce some risks but do not eliminate them.

Loss and Recovery

• Locator apps can show current or last known location.
• Remote lock, message display, sound, and wipe can protect data when recovery is uncertain.
• Remote backups allow recovery to a new or replacement device.

• The right disposal method depends on sensitivity, media type, reuse plan, policy, regulation, and environmental requirements.
• Deleting files is not the same as sanitizing data.
• Documentation matters when compliance, chain of custody, or third-party disposal is involved.

Physical Destruction

• Drilling or hammering damages platters; shredding destroys drives with machinery.
• Degaussing works on magnetic media such as HDDs, not SSDs or flash media.
• Incineration destroys media at high temperatures when appropriate and approved.

Reuse and Erasure

• File-level overwriting affects selected files but may leave other data behind.
• Whole-drive wipe overwrites the drive for reuse.
• Quick format prepares the file system but may not erase data; regular format can overwrite sectors depending on OS and method.

Regulatory and Environmental

• Follow policy, industry requirements, contracts, privacy rules, and data retention requirements.
• Use certified recyclers such as R2 or e-Stewards where appropriate.
• Keep certificates of destruction, asset records, serial numbers, recycler documentation, and chain-of-custody records.

• SOHO security is about practical control: router settings, filtering, placement, UPnP, segmentation, management access, wireless settings, guest access, and firewall rules.
• Small router settings can affect every connected device.
• Open only what the scenario truly requires.

Router and Management

• Change default administrator credentials and keep firmware current.
• Use allow lists, deny lists, IP filtering, content filtering, and category filtering where appropriate.
• Keep management local unless remote access is specifically needed and strongly protected.

Wireless and Guests

• Use unique SSIDs that do not reveal vendor, model, owner, location, or purpose.
• Use WPA3 where supported or WPA2 with strong settings.
• Use guest networks for visitors, IoT, or temporary systems, and isolate them from private resources.

Segmentation and Firewall

• Use a screened subnet or DMZ for public-facing services that should not sit inside the private LAN.
• Disable unused physical ports and use NAC/802.1X when appropriate.
• Use narrow, documented port forwarding only when an internal service must be reachable externally.

• Browsers handle downloads, credentials, sessions, certificates, cached data, sync, extensions, proxies, DNS, and site permissions.
• Configure based on the scenario instead of resetting everything.
• Small browser settings can prevent large security problems.

Safe Software and Updates

• Download from trusted vendor sources, app stores, or approved portals.
• Verify hashes or digital signatures when available.
• Keep browsers patched through built-in update tools and OS update mechanisms.

Extensions and Credentials

• Install extensions and plug-ins only from trusted sources and review permissions.
• Remove unused or suspicious add-ons.
• Use trusted password managers with unique passwords, secure sync, and MFA where available.

Connections and Settings

• Investigate certificate warnings, mismatched names, expired dates, untrusted issuers, and incorrect system time.
• Use pop-up blockers, clearing data/cache, private browsing, browser sync, ad blockers, proxy settings, secure DNS, and site permissions appropriately.
• Do not treat private browsing or HTTPS as complete protection by itself.