Securing devices
Harden a device and investigate alerts
Connect patching, authentication, least privilege, and endpoint logs.
Work through defensive scenarios and explain the evidence behind each decision.
Reduce what can go wrong
Remove unused services, apply tested security updates, and use an account with only the permissions needed for the task. Authentication checks who is requesting access. Authorization checks what that identity may do. A successful login does not grant every permission.
Multifactor authentication combines different factor types, such as a password and a hardware token. Two passwords are still one factor type. Account recovery must also be protected or it can undermine the normal login controls.
Build a defensible timeline
Compare login events, newly started processes, and file changes. Record timestamps and time zones. Multiple failed logins followed by a success deserve investigation, but check whether an authorized user simply corrected a password.
When an incident is suspected, follow the organization's response procedure. Preserve useful logs, document actions, and isolate a device only within your authority. An alert is the start of analysis, not automatic proof that a specific person attacked the system.
Check yourself
A signed-in user can read another team's confidential folder. Which control failed?Show answer
Authorization. The identity may be valid, but its permitted access is too broad.
References used to build these lessons
We used these official documents as references when building this course's lessons. They are the sources for the syllabus structure and course requirements.
College Board · Effective fall 2026