Lesson 5: Security Controls Practical

Core path: 42 minutes

Security support is not a contest to enable the most controls.

A professional technician identifies the asset, risk, authority boundary, and recovery dependency before changing configuration.

Ticket A: server-room access

Current state:

• badge reader installed;
• door sometimes propped open;
• no door alarm;
• camera covers the hallway.

Choose an additional physical control and explain why the badge reader alone is insufficient.

Ticket B: temporary administrator need

A technician needs elevated rights for one approved maintenance task.

Compare:

• permanent administrator membership;
• just-in-time privileged access;
• shared administrator password.

Select the strongest model and explain the audit/recovery tradeoff.

Ticket C: shared-folder access

Evidence:

• user reaches the server/share;
• NTFS permission denies the target folder;
• user belongs to the wrong security group;
• inheritance is enabled.

Correct the permission/group boundary. Do not grant Everyone Full Control.

Ticket D: removable drive with sensitive data

Requirement:

• data must remain protected if the USB drive is lost;
• Windows endpoint supports the required encryption feature.

Select the appropriate encryption concept and state how recovery keys must be managed.

Ticket E: wireless staff login

Requirement:

• WPA2/WPA3-capable infrastructure;
• centralized user authentication;
• individual user identity rather than one shared password.

Map wireless encryption, RADIUS/Kerberos-style identity services, and MFA to the correct roles.

Ticket F: mobile device lost

Evidence:

• corporate-owned phone;
• encrypted;
• MDM enrolled;
• remote backup current;
• locator service available;
• user reports confirmed loss.

Build the approved response path including lock/locate, account/security review, and remote wipe only when authorized.

Ticket G: workstation hardening shortcut

Proposal:

Disable the firewall, UAC, screen lock, and antivirus because they create support tickets.

Reject the proposal. For each control, identify the risk it reduces and a better way to solve legitimate application/usability issues.

Ticket H: SSO convenience

A user argues that SSO means MFA is unnecessary.

Explain why SSO changes the number of sign-ins while MFA changes the authentication evidence required at the identity boundary.

Final practical record

Complete five tickets:

asset:
risk:
current state/evidence:
selected physical/logical control:
why this control:
least-privilege/identity consideration:
recovery or management dependency:
verification:
remaining risk:

Week 13 checkpoint

You should now be able to distinguish and apply:

physical security
→ identity / MFA / SSO / JIT / PAM
→ Windows accounts / permissions / UAC / encryption
→ wireless encryption + centralized authentication
→ workstation hardening
→ mobile encryption / MDM / remote controls
→ verify + document

Next week focuses on threats, malware, removal, data destruction, SOHO security, and browser hardening.