This objective transitions from theory into hard, practical implementation. CompTIA will present a scenario in which a specific endpoint, network device, or application is exposed, and you must apply the appropriate technical technique to lock it down.
1. Secure Baselines & Hardening Targets
A secure baseline is a documented, pre-tested set of security configurations that defines the minimum acceptable security posture for an asset.
- Establish: Create the configuration profile using industry standards (such as CIS Benchmarks or NIST guidelines). This defines exactly which ports are closed, which protocols are disabled, and password complexity.
- Deploy: Pushing the baseline out automatically across the enterprise using automation tools such as Group Policy Objects (GPOs) in Active Directory, MDM profiles, or Infrastructure as Code (IaC) playbooks.
- Maintain: Continuously monitoring systems to prevent “configuration drift” (where manual tweaks over time degrade security) and updating the baseline as new vulnerabilities emerge.
Hardening Specific Infrastructure Targets
When hardening a device in a scenario, your strategy must adapt to what the device actually does:
| Hardening Target | Primary Technical Focus / Strategy |
| Workstations & Servers | Turn on Full-Disk Encryption, install endpoint protection (EDR), disable unnecessary native services, configure local host firewalls, and enforce strict local authentication. |
| Switches & Routers | Disable insecure management protocols (swap Telnet/HTTP for SSH/HTTPS), change default administrative credentials, configure 802.1X port security, and disable unused physical network ports. |
| Cloud Infrastructure | Enforce strict Identity & Access Management (IAM) least-privilege roles, mandate Multi-Factor Authentication (MFA) across all tenants, and audit cloud object storage (S3 buckets) to ensure they aren’t publicly exposed. |
| ICS/SCADA & IoT | Place these devices in strictly segmented, isolated network zones (VLANs) behind dedicated firewalls, with no direct internet access, to protect them from remote exploits. |
| Embedded Systems & RTOS | Implement a hardware root of trust (TPM), disable unused physical debugging interfaces (such as JTAG ports), and use firmware code signing to prevent malicious modifications. |
2. Wireless Devices & Enterprise Security
Securing wireless environments requires optimizing physical placement before locking down the logical authentication protocols.
- Site Surveys: The physical process of analyzing a facility to identify structural obstacles (such as concrete walls or elevator shafts) and existing radio-frequency (RF) interference. This ensures access points (APs) are positioned effectively.
- Heat Maps: A visual graphical representation of wireless signal strength generated by site survey software. It highlights dead zones and reveals “signal bleed”, where Wi-Fi signals leak outside the physical building’s perimeter into public areas like parking lots, exposing the network to drive-by attackers.
Enterprise Wireless Security Settings
Traditional home Wi-Fi relies on a single shared password (Pre-Shared Key / WPA-Personal). Enterprise wireless relies on explicit, centralized user identity validation.
- WPA3 (Wi-Fi Protected Access 3): The modern standard for wireless encryption. It introduces Simultaneous Authentication of Equals (SAE) to replace the vulnerable WPA2 4-way handshake, completely neutralizing offline brute-force dictionary attacks.
- AAA / RADIUS: For WPA3-Enterprise, access points do not authenticate users locally. Instead, they act as pass-through gatekeepers, forwarding the user’s login request to a central RADIUS server linked to the corporate user directory (like Active Directory) to validate credentials or digital certificates.
- Cryptographic & Authentication Protocols: To prevent credentials from traversing the airwaves in plain text, authentication is wrapped in secure tunnels using protocols such as PEAP (Protected Extensible Authentication Protocol) or EAP-TLS (which requires both the client and the server to present digital certificates).
3. Mobile Solutions & Deployment Models
Managing corporate data on devices that leave the office’s physical protection.
- MDM (Mobile Device Management): A centralized software suite used by IT to enforce security baselines, monitor compliance, track asset locations, enforce storage encryption, and execute remote data wipes if a corporate phone is lost or stolen.
Mobile Deployment Tiers
CompTIA will ask you to balance corporate control against user preference across these deployment strategies:
- BYOD (Bring Your Own Device): Employees use their personal smartphones and tablets for work purposes.
- Security Reality: Lowest cost for the company, but highest security risk. Privacy boundaries make it difficult for IT to fully monitor or restrict the device. Security relies on containerization (isolating corporate data inside a secure app workspace).
- COPE (Corporate-Owned, Personally Enabled): The organization buys the device and maintains full architectural control over the underlying OS settings, but allows the employee to use it for personal tasks (like installing social media or personal email apps).
- CYOD (Choose Your Own Device): The company provides a pre-approved menu of specific smartphone models. The company purchases the chosen device, ensures it meets the necessary enterprise hardware security baselines, and deploys it.
Mobile Connection Risks
- Cellular: Generally the most secure transport layer for remote data transmission, as traffic is handled by telecom provider networks.
- Wi-Fi: Highly vulnerable to On-Path (MitM) attacks. MDM profiles should be configured to mandate an always-on VPN whenever an endpoint connects to an untrusted public Wi-Fi network.
- Bluetooth: Vulnerable to short-range proximity exploits if left in a continuous discoverable state.
4. Application Security & Sandboxing
Securing software execution requires locking down code logic and isolating runtime environments.
- Input Validation: A foundational development control that inspects and sanitizes all data entered into application fields before processing it. It strips out dangerous characters, completely preventing SQL Injection (SQLi) and Cross-Site Scripting (XSS).
- Secure Cookies: Configuration flags applied to web application cookies:
Secure: Forces the browser to only transmit the cookie over encrypted HTTPS connections, preventing it from being intercepted in plain text.HttpOnlyBlocks client-side scripts (like JavaScript) from accessing the cookie, thereby neutralizing session hijacking via XSS.
- Static Code Analysis (SAST): Reviewing source code for vulnerabilities and structural security flaws without running the program (examining the raw code at rest).
- Code Signing: Using asymmetric cryptography to append a digital signature to an executable or software update. This serves as a preventive control, demonstrating to the destination operating system that the software is from a trusted vendor and has not been altered by a third party.
- Sandboxing: Isolating a running application or untrusted code execution inside a heavily restricted, walled-off environment. The application has zero visibility into the host OS kernel or adjacent files. (e.g., running a suspicious email attachment inside a secure analyzer sandbox to see if it behaves like malware before delivering it to the end user).
- Monitoring: Implementing continuous endpoint log and behavioral analysis (via Sysmon, local event viewers, or SIEM feeds) to detect post-execution anomalies in real time.