[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.1.a
AP Cybersecurity · Securing Devices
Types of Computing Devices
Classify by what the device is for — because that predicts how well it can be defended.
key ideaClassify by what the device is for — because that predicts how well it can be defended.
The categories
The three categories are not about size. They are about purpose and constraint: a general machine you administer, a portable one that travels, and a specialized one built into a machine — and the third is the one that resists every control you would normally apply.
Reading down, control gets harder. A laptop accepts patches and anti-malware; an embedded computer often accepts neither, and may be in service for a decade.[Figure: The families the CED names, at their real relative scale: servers, desktops, laptops, mobiles and IoT. Every one of them is an endpoint, and the smallest are the ones most often left unpatched.]
The families the CED names, at their real relative scale: servers, desktops, laptops, mobiles and IoT. Every one of them is an endpoint, and the smallest are the ones most often left unpatched.| Category | What it is | Examples | Security characteristic |
|---|
| personal computer | designed for use by one person, general purpose | desktops, laptops | patchable, defensible, actively managed |
| handheld computer | smaller, runs on battery power | tablets, smartphones, wearables such as smart watches | leaves the building; joins untrusted networks |
| embedded computer | part of a machine, with instruction sets specific to that machine | vehicles, medical equipment, industrial controllers | rarely updated; long service life |
Also called mobile computers or information appliances, handhelds are ordinary computers with an unusual threat profile. The embedded row is where the hard problems live.
Personal computerA device designed for one person to use for work or recreation — word processing, design, browsing, media.
Handheld computerSmaller than a PC and battery powered. Also called a mobile computer or information appliance.
Embedded computerA computer that is part of a machine, with a specific instruction set for interfacing with that machine's components.
IoT deviceAn everyday device containing an embedded computer — the term the CED uses for the consumer-facing end of this category.
Critical infrastructureSystems such as power, water and transport, many of which run on embedded computers that are difficult to patch.
Telling them apart
the deciding question
- Ask whether the device serves one person generally, one person portably, or one machine specifically.
- Embedded computers appear in transportation, critical infrastructure, and everyday appliances — where they are called IoT devices.
- Handhelds are defensible, but they spend time outside your network and outside your physical controls.
- Embedded devices tend to be long-lived and rarely updated, so a vulnerability can persist for years.
Personalgeneral purpose, patchable
Handheldbattery powered and it travels
Embeddedpart of a machine, rarely updated
Worked examples
EX 1
Classify a fleet
A hospital lists: nurses' tablets, an MRI scanner's controller, radiologists' desktops, and smart building thermostats. Classify each.
1
Tablets
Handheld computers — smaller, battery powered, mobile.
2
MRI controller
An embedded computer — part of a machine, with instructions specific to that machine's components.
3
Desktops
Personal computers — general purpose, one user each.
4
Thermostats
Embedded computers in everyday devices — IoT.
5
Draw the security conclusion
The desktops and tablets can be patched on a schedule. The MRI and thermostats probably cannot, and need compensating controls instead.
EX 2
Why the embedded category matters
A water treatment plant runs embedded systems that cannot be patched without vendor recertification. What does the classification tell you?
1
Name the category
Embedded computers operating critical infrastructure.
2
State the constraint
Instruction sets are specific to the machine, and updates may require recertification.
3
Note the service life
Such systems remain in place for years or decades, so a known flaw persists.
4
Change the control strategy
If patching is unavailable, rely on segmentation, strict access control and monitoring.
5
State the general rule
The category tells you which controls are even available, which is why classifying comes first.
EX 3
The device that leaves
An organization defends its network well and issues smartphones to staff. Where does the classification change the risk?
1
Name the category
Handheld computers — battery powered and mobile.
2
Note what mobility removes
Outside the building, none of the network or physical controls apply.
3
List what travels with the device
Whatever is on it: cached credentials, documents, message history.
4
Give the controls that follow it
Full-disk encryption, screen lock, remote wipe, MFA — all device-resident.
5
State the principle
For devices that leave, the device must carry its own defense.
Watch out
The categories are about purpose, not size
A rack server and a laptop are both general-purpose; a smart watch and an industrial controller are not the same category despite both being small.
“IoT” is a label for embedded computers
The CED describes everyday devices with embedded computers as IoT. It is the same category, named for where it appears.
Embedded does not mean unimportant
Embedded computers run transportation and critical infrastructure. They are the least patchable devices doing the most consequential work.
Handhelds are computers
They run the same classes of software and face the same attacks — plus the ones that only apply to a device that spends time outside your control.