4.1

Secure Baselines - Establish

Defining a set of minimum security standards, configurations, and hardening rules for hardware, software, and network devices before deployment.

Secure Baselines - Deploy

Rolling out standardized secure configurations across systems using automated deployment tools, scripts, or disk images.

Secure Baselines - Maintain

Continuously auditing, patching, and updating system configurations over time to prevent configuration drift and address new security risks.

Hardening Targets - Mobile Devices

Securing smartphones and tablets via encryption, screen locks, remote wipe capabilities, patch management, and MDM policies.

Hardening Targets - Workstations

Securing end-user PCs by removing default accounts, disabling unused services, enforcing least privilege, and enabling host firewalls and EDR.

Hardening Targets - Switches & Routers

Securing core networking hardware by disabling unused ports, enforcing encrypted management protocols (SSH/HTTPS), changing default credentials, and enabling port security.

Hardening Targets - Cloud Infrastructure

Securing cloud workloads by enforcing strict Identity and Access Management (IAM), configuring virtual firewalls, auditing storage permissions, and enabling API logging.

Hardening Targets - Servers

Hardening physical or virtual servers by stripping unnecessary software, disabling unused services, closing open ports, and applying strict access controls.

Hardening Targets - ICS/SCADA & RTOS

Securing industrial and real-time operational technology by isolating control networks, restricting physical access, applying compensating controls, and strictly managing patch timing.

Hardening Targets - Embedded Systems & IoT

Securing dedicated microcontrollers and connected devices through network segmentation, disabling default remote access, and enforcing secure firmware updates.

Wireless Installation - Site Surveys

Analyzing physical facilities, RF signal propagation, wall density, and nearby interference to plan optimal wireless access point (WAP) placement and power output.

Wireless Installation - Heat Maps

Visual representations of wireless signal strength and coverage across a physical layout, used to identify dead zones and optimize WAP placement.

Mobile Solutions - Mobile Device Management (MDM)

A centralized software platform used by IT administrators to enforce security policies, push software updates, track, wipe, and monitor mobile devices.

Mobile Deployment - BYOD (Bring Your Own Device)

A deployment model where employees use their personal devices for enterprise work, requiring containerization to separate corporate data from personal data.

Mobile Deployment - COPE (Corporate-Owned, Personally Enabled)

A deployment model where the organization purchases and owns the mobile device, but allows the employee to use it for personal tasks under strict policy guidelines.

Mobile Deployment - CYOD (Choose Your Own Device)

A deployment model where employees choose a device from an enterprise-approved list of corporate-owned or personal devices that meet specific security requirements.

Mobile Connections - Cellular, Wi-Fi, Bluetooth

Wireless connectivity mediums requiring distinct controls, such as enforcing VPNs over public Wi-Fi, turning off Bluetooth discoverability, and monitoring cellular data usage.

Wireless Security - Wi-Fi Protected Access 3 (WPA3)

The modern Wi-Fi security standard using SAE (Simultaneous Authentication of Equals) to protect against offline dictionary attacks and provide forward secrecy.

Wireless Security - RADIUS / AAA

A centralized authentication protocol framework (Authentication, Authorization, Accounting) used in 802.1X enterprise networks to validate user credentials against an identity provider.

Wireless Security - Cryptographic & Authentication Protocols

Protocols (e.g., EAP-TLS, AES-CCMP, SAE) used to securely authenticate clients and encrypt wireless data payloads.

Application Security - Input Validation

Checking and sanitizing user inputs on both client and server sides to prevent security flaws like SQL injection, Command Injection, and XSS.

Application Security - Secure Cookies

Setting flags on web cookies (e.g., Secure, HttpOnly, SameSite) to ensure they are transmitted over HTTPS and remain inaccessible to client-side scripts.

Application Security - Static Code Analysis

Testing source code without executing it (SAST) to identify potential vulnerabilities, coding errors, and compliance issues early in development.

Application Security - Code Signing

Cryptographically signing executable code with a digital certificate to verify software origin and ensure the code has not been tampered with.

Sandboxing

An isolated execution environment that isolates unverified code or untrusted applications from the rest of the network and operating system to prevent malicious damage.

Monitoring

Continuously tracking system logs, network traffic, resource usage, and security events to detect anomalies, unauthorized changes, and security incidents.