Week 13: Security Controls, Windows Security, and Device Hardening

Security gets messy when controls become a checklist.

Turn on antivirus. Add MFA. Enable encryption. Lock the door. Disable services. Use WPA3. Add a badge reader.

Fine.

Now answer the harder question:

What specific risk does each control reduce, which boundary does it protect, and what new dependency does the control create?

BitLocker protects data at rest if a device is lost, but now recovery-key management matters. MFA strengthens authentication, but it does not decide what the user is authorized to do after sign-in. A badge reader controls one entrance, but it does not help if the door is propped open. MDM can enforce mobile policy, but ownership and privacy still matter.

Security is architecture.

The system model

asset
  ↓
threat / misuse / failure condition
  ↓
trust or access boundary
  ↓
control
  ↓
management / recovery dependency
  ↓
verification
  ↓
remaining risk

How the chapter moves

1. Physical and Logical Security Controls connects barriers, credentials, least privilege, MFA, SSO, JIT/PAM, IAM, DLP, MDM, directory services, and Zero Trust to the boundaries they actually protect.
2. Windows Security, Permissions, and Identity separates authentication, authorization, elevation, firewall policy, permissions, encryption, accounts, and domain management.
3. Wireless Authentication and Device Hardening combines modern wireless protection, centralized authentication, workstation hardening, patching, mobile encryption, MDM, and lost-device response.
4. Secure Endpoint Configuration Lab hardens fictional endpoints while preserving legitimate work, recovery, and management.
5. Security Controls Practical requires every control choice to be defended by risk, tradeoff, verification, and remaining uncertainty.

More controls are not automatically more secure.

A control that does not match the risk adds complexity without solving the problem.