Protecting Devices
Finding weaknesses was step one. Now you harden the farm's devices — with policies, anti-malware, patching, and a host-based firewall.
Welcome to the AgriNova Device Hardening Workshop. You've inventoried the devices (4.1) and locked down logins (4.2). Now you reduce the chance an attack succeeds at all by protecting each device: writing security policies, installing anti-malware, keeping software updated, and configuring a host-based firewall that controls which traffic reaches the machine.
Device hardening is the process of reducing a device's attack surface — removing weaknesses and adding layers of defense so there are fewer ways in and faster ways to stop an intruder. This is the AP skill Mitigate Risk in pure form.
Set Policy
Managerial controls — written device security policies — tell everyone how devices must be configured and maintained.
Defend & Update
Anti-malware catches malicious code; patching closes known holes before attackers use them.
Filter Traffic
A host-based firewall allows only needed traffic and blocks the rest — shrinking the attack surface.
- 1Identify managerial controls related to device security.
- 2Explain how anti-malware software can make a device more secure.
- 3Explain why keeping a device's OS/software updated makes it more secure.
- 4Configure a host-based firewall.
AgriNova's devices work but are soft targets: no written policy, expired anti-malware on the office laptops, the data server running months of missed updates, and the irrigation controller accepting connections from anywhere. In this workshop you build the policy, choose anti-malware actions, prioritize patches, and configure a host firewall — all on a safe, fictional network.
Big Idea
Protection is layered. No single control is enough — policies set the rules, anti-malware and patches remove known threats, and a host firewall limits what can even reach the device. Together they reduce the attack surface and mitigate risk.
You'll identify managerial controls, explain how anti-malware and updates harden a device, configure host-firewall allow/block rules, and assemble a complete secure-device checklist — building fluency with the AP Mitigate Risk skill.
Layers of Device Protection
Policies, anti-malware, updates, and firewalls stack into a defense that's stronger than any single layer.
Device protection works in layers (defense in depth). If one layer fails, the next still stands. AP groups protections into controls you should recognize:
- Managerial controls (policy): written rules — a device security policy, acceptable-use rules, update schedules, who may install software.
- Anti-malware software: scans for, blocks, and removes malicious code; updates its definitions to catch new threats.
- Software/OS updates (patching): fixes known vulnerabilities so attackers can't reuse published exploits.
- Host-based firewall: runs on the device itself and decides which network traffic is allowed or blocked.
Device Security Policy Builder
Toggle the managerial controls AgriNova should require. Build a policy and see your coverage score.
AgriNova Device Security Policy
Toggle controls above to draft the policy.
Terms for MCQ and Device Security Analysis
Definitions you'll need for multiple choice and free-response answers.
| Term | Definition | Workshop Example |
|---|---|---|
| Device hardening | Reducing weaknesses to make a device tougher to attack. | Turning on the firewall + patching. |
| Attack surface | All the points where an attacker could try to get in. | Open ports, extra apps, old software. |
| Managerial control | A policy/administrative rule that governs security behavior. | The device security policy. |
| Device security policy | Written rules for how devices must be configured & maintained. | "All laptops must run anti-malware." |
| Anti-malware | Software that detects, blocks, and removes malicious code. | Scans laptops and quarantines threats. |
| Definition update | New data that lets anti-malware recognize the latest threats. | Daily signature refresh. |
| Patch / update | Vendor fix that closes a known software vulnerability. | Server OS security update. |
| Host-based firewall | Firewall running on the device, filtering its own traffic. | Built-in firewall on the laptop. |
| Allow / block rule | A firewall instruction permitting or denying specific traffic. | Allow port 443; block all else. |
| Default deny | Block everything unless explicitly allowed. | Safest firewall starting posture. |
| Control Type | What it is | Examples |
|---|---|---|
| Managerial / administrative | Policies and procedures that direct behavior. | Security policy, update schedule, training. |
| Technical | Technology that enforces protection. | Anti-malware, firewall, patching tools. |
| Physical | Real-world barriers protecting devices. | Locked server room (covered in 4.4-style topics). |
What the Exam Wants You to Explain
Skill in focus: Mitigate Risk — choose protective controls and explain how each reduces risk.
A complete AP answer about protecting devices: (1) names a control (anti-malware, patching, host firewall, policy), (2) explains the mechanism — how it works, and (3) ties it to the risk it reduces. "Update the OS" earns little; "update the OS to close the known vulnerability before attackers exploit it" earns full credit.
- Confusing a host-based firewall (on the device) with a network firewall (at the perimeter).
- Thinking anti-malware works without definition updates — outdated definitions miss new threats.
- Calling a firewall a managerial control — it's a technical control; the policy requiring it is managerial.
- Believing patching is optional once a device "works fine."
If a stem says a device "runs software that hasn't been updated in a year," the expected mitigation is patching/updates to close known holes. If it says the device "accepts connections from any address," the fix is a host firewall with default-deny allow/block rules.
anti-malware: installed, definitions
43 days oldOS updates:
17 pending (3 critical)host firewall:
OFFopen inbound ports:
22, 80, 3389, 8080 (3389 = remote desktop)
Read it like AP wants: stale definitions = anti-malware weakened (update them); 3 critical patches pending = patch immediately; firewall OFF + open remote-desktop port = large attack surface (turn on the host firewall, block 3389). Each finding maps to a specific mitigation.
Lab: Configure a Host-Based Firewall
The flagship lab. Build allow/block rules for the farm server, then test traffic against your ruleset and read the AP-style reasoning.
A host-based firewall inspects traffic at the device and applies your rules in order: traffic that matches an allow rule passes; everything else is blocked by default. Start from default deny and open only what the device truly needs — that's how you shrink the attack surface.
Anti-Malware Decision Lab
For each fictional alert, choose the best anti-malware response. Instant feedback explains the reasoning.
Host-Based Firewall Configuration Simulator
Add allow/block rules for the FarmGrid server, then test sample traffic against your ruleset (default deny).
No rules yet — with default deny, all traffic is currently blocked.
Prompt: "The FarmGrid server is reachable on several ports from any address. Configure a host-based firewall to mitigate this risk and justify your rules."
Model answer: Start with default deny so nothing is allowed unless specified. Allow the HTTPS dashboard (443) only from the farm office network, and allow SSH/remote admin only from the admin VPN. Block the legacy web panel (8080) and remote desktop (3389) from the internet entirely.
Why it mitigates risk: limiting which services and sources can reach the server reduces the attack surface — an attacker on the open internet can no longer even connect to the risky ports, so most remote attacks fail before they start. Combined with patching and anti-malware, this is layered defense.
Misconceptions That Cost AP Points
Recognize the wrong answer and you'll avoid writing it.
× "Anti-malware alone fully protects a device."
Anti-malware is one layer and can miss brand-new threats, especially with outdated definitions. You still need patching, a firewall, and policy.
AP trap: single-control answers; AP rewards layered defense.
× "A host firewall and a network firewall are the same."
A host-based firewall runs on the individual device; a network firewall sits at the network's edge. Both filter traffic but at different places.
AP trap: "on the device" signals host-based.
× "Updates are optional if the device works fine."
"Works fine" doesn't mean "secure." Unpatched known flaws are among the easiest things for attackers to exploit.
AP trap: stems that say a device "still functions" — still patch it.
× "A firewall is a managerial control."
A firewall is a technical control. The policy requiring firewalls is the managerial control.
AP trap: separate the rule (managerial) from the tool (technical).
× "Allow-all is fine if I block the bad stuff."
You can't enumerate every bad thing. Default deny (block unless allowed) is far safer than allow-all.
AP trap: "block known bad" leaves unknown threats open.
× "Installing anti-malware once is enough."
Without regular definition updates, anti-malware can't recognize new malware. It must stay current.
AP trap: ignore the word "outdated" in the stem at your peril.
Protection Reference + Hardening Tools
A quick-reference table plus three hands-on tools: a patch board, a vulnerability matcher, and a secure-device checklist.
| Protection | How it works | Attack surface it reduces |
|---|---|---|
| Device security policy | Sets required configurations & behavior. | Human/process gaps. |
| Anti-malware (updated) | Detects, blocks, removes malicious code. | Malware infection. |
| Patching / updates | Closes known software vulnerabilities. | Exploits of public flaws. |
| Host-based firewall | Allows needed traffic, blocks the rest. | Remote/network exposure. |
| Disable unused services | Removes features attackers could target. | Extra entry points. |
Patch Prioritization Board
Set severity and exposure for each pending update. The board computes which to patch first.
Mitigation-to-Vulnerability Matcher
Click a vulnerability, then click the protection that best mitigates it. Correct pairs turn green.
Anti-malware (updated)
Patching / updates
Host-based firewall
Security policy
Secure Device Checklist
Work through the hardening checklist for a new farm device. Your readiness meter fills as you complete steps.
- Add the device to the asset inventory
- Change default credentials & set a strong password
- Apply all OS/software updates and enable auto-update
- Install anti-malware with current definitions
- Enable host-based firewall (default deny)
- Disable unused services, ports, and accounts
Mini AP Quiz + Takeaways
Five quick AP-style questions with instant feedback, then your snapshot for review.
Mini AP-Style Quiz
Choose the best answer. Explanations appear instantly; your score totals at the end.
- 1Device protection is layered: policy + anti-malware + patching + host firewall, each covering different risks.
- 2Managerial controls (policies) set the rules; technical controls (firewall, anti-malware) enforce them.
- 3Anti-malware only works well with current definitions — keep it updated.
- 4Patching closes known vulnerabilities before attackers can reuse public exploits.
- 5A host-based firewall with default deny allows only needed traffic, reducing the attack surface.
To "mitigate risk" when protecting a device, name the control, explain how it works, and state which risk it reduces — e.g., "host firewall with default deny → blocks unneeded ports → shrinks the attack surface."
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.