Establish, Deploy, Maintain: Secure Baselines, Hardening Targets, BYOD vs. COPE vs. CYOD, and WPA3 on Security+

Wireless installation: the survey and the heat map

Before a wireless network can be secured it has to be placed. A site survey is the physical and RF assessment of a facility used to decide access point placement, channel selection and power levels. Its output is a heat map: a floor plan overlaid with signal strength by color. Heat maps matter for two reasons that pull in opposite directions. Coverage gaps are dead zones that push users toward rogue access points. Coverage spills are strong signal bleeding into the parking lot, where an attacker can probe the network without entering the building. Surveys are repeated after buildouts and periodically, because the RF environment changes.

Mobile: ownership decides control

Mobile device management is the enforcement tool, and many suites add containerization, separating a managed work profile from personal data so a corporate wipe does not delete family photos. How much MDM may control depends on who owns the device, which is what the three deployment models describe.

The three connection methods each bring a characteristic risk. Cellular bypasses your perimeter entirely because the carrier manages it, so corporate data over 4G or 5G needs a VPN. Wi-Fi has the most bandwidth and the biggest attack surface, rogue and evil-twin access points and unencrypted public hotspots, so enforce WPA3 or WPA2-Enterprise and a VPN on untrusted networks. Bluetooth is short range, and its named attacks are bluejacking (unsolicited messages) and bluesnarfing (data theft); keep devices non-discoverable and unpair what is unused.

Wireless security: WPA3, SAE, and 802.1X with RADIUS

WPA3 is the current Wi-Fi security generation, and its headline change in personal mode is replacing WPA2's pre-shared key four-way handshake with Simultaneous Authentication of Equals. SAE is a password-authenticated key exchange in which the password is never transmitted and cannot be derived from captured traffic. That kills the classic WPA2 attack of capturing a handshake and brute-forcing it offline, and it provides forward secrecy: recovering today's password does not decrypt yesterday's capture.

Enterprise wireless removes the shared password altogether and authenticates each user through AAA, usually via RADIUS behind an 802.1X port-based access control deployment. The supplicant is the connecting device presenting credentials or a certificate over EAP. The authenticator is the access point or switch, which blocks everything except EAP until authentication succeeds and relays EAP inside RADIUS. The authentication server is the RADIUS server, UDP 1812 for authentication and 1813 for accounting, which checks the directory and returns accept or reject with authorization attributes. Two supporting bullets round out the objective: cryptographic protocols are the ciphers protecting frames, AES-CCMP and GCMP, with WEP and TKIP broken and forbidden; authentication protocols are the EAP family, PEAP wrapping authentication in a TLS tunnel and EAP-TLS using certificates on both sides.

Application security, sandboxing, monitoring

The last bullets move from the device to the code it runs, and the exam settles them with one-line mappings.

• Input validation: never trust input; check type, length, format and range on the server side, preferring an allow list over a block list. The primary defense against injection, SQLi, XSS and command injection, the flaw family the exam returns to most.
• Secure cookies: the Secure attribute sends the cookie only over HTTPS; HttpOnly denies JavaScript access and blunts XSS session theft; SameSite mitigates CSRF.
• Static code analysis: automated review of source without executing it, catching flaws early. Dynamic analysis, its contrast, tests the running application.
• Code signing: a digital signature that proves origin (authenticity) and that the code was not altered (integrity). Unsigned or invalid-signature code should be blocked.
• Sandboxing: running code in an isolated environment with no access to production, for testing untrusted programs or detonating suspicious attachments. Damage stays inside.
• Monitoring: instrumenting resources so you know when hardening fails: log collection, behavior baselines, alerting. Objective 4.4 supplies the tooling.

The mapping the exam expects: "reviews code before execution" is static analysis; "tests the running app" is dynamic; "proves who published the code and that it is unmodified" is code signing; "stops SQL injection" is input validation.

Four stems, decoded

1. An audit finds that servers imaged correctly six months ago now have unauthorized services enabled and missing patches. Maintain failed. Right at rollout; nobody audited for drift.
2. A company wants full control over devices, including remote wipe, but employees expect to use them personally. COPE. Corporate ownership gives the highest control; personal enablement is the trade-off described.
3. An attacker captures a wireless handshake in the parking lot and cracks the password offline overnight. WPA2-Personal was in use. WPA3's SAE resists offline attacks because every guess requires a live exchange; the spill into the parking lot is a site-survey finding.
4. A script from an unknown source runs on a workstation because the endpoint had no way to verify where it came from. Code signing was missing. A valid signature proves origin and integrity, and unsigned code should be blocked.

Securing computing resources is objective 4.1 of Security+ Domain 4, Security Operations, 28% of the exam and the largest domain on it. Everything here is the "make it safe to run" half of operations, which the monitoring and response objectives that follow assume. Work all 39 Domain 4 topics with our free Security+ Domain 4 study guide.

#SecurityPlus #SY0701 #Hardening #SecureBaselines #MDM #WPA3 #8021X #ApplicationSecurity #InfoSec #CyberSecurity