[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.1.d
AP Cybersecurity · Securing Devices
Assessing Device Risks
Ask what the device touches — sensitive data, critical operations, or neither.
key ideaBand a device finding by asking what it reaches: sensitive data, critical operations, or neither.
The stages
Device risk is assessed the same way as any other, with one distinctive question: what does this particular device touch? The same missing patch is a different risk on a mail server than on a meeting-room display.
1
Inventory the devices and what they hold
Personal computers, handhelds, and embedded systems. Record what data each holds and which operations depend on it — that is what turns a technical finding into a risk.
in an estate out a device list with context
2
Enumerate the vulnerabilities on each
Unpatched software, weak authentication, missing firmware passwords, autorun, open ports, absent firewall or anti-malware.
out device–vulnerability pairs
3
State what an adversary would gain
The CED's outcomes: impersonate an authorized user, remotely control the device, encrypt the drive to ransom the data, or wipe it.
out an impact statement
4
Weigh likelihood
A published exploit raises it sharply. A vulnerability needing physical access, or an unusual skill level, lowers it — without lowering severity.
out a likelihood rating
5
Band and document
High: sensitive data or critical operations at stake. Moderate: weak authentication, or less likely to be exploited. Low: little impact if exploited.
out a ranked register
| Band | Test | Illustrative finding |
|---|
| high | potentially compromises sensitive data or critical operations | an unpatched email server with a known exploit available |
| moderate | weak authentication, or less likely to be exploited | a water plant's embedded systems on default credentials but physically isolated |
| low | little impact if exploited | an employee laptop with telnet port 23 open and nothing listening of value |
Notice how the moderate example combines a serious weakness with a mitigating circumstance. Recording both is what makes the band defensible when someone re-reads the register later.
Applying it
The four outcomes the CED names — impersonation, remote control, ransom, wiping — are a useful checklist. If none of them applies, the finding is probably low; if two or more do, it is almost certainly high.
| Outcome | What it looks like | Typical band contribution |
|---|
| impersonate an authorized user | the adversary acts with the user's access | high if the user has broad access |
| remotely control the device | a RAT or equivalent | high — the device becomes a platform |
| encrypt the drive to ransom the data | ransomware | high — and worse without backups |
| wipe the device | destruction rather than theft | depends entirely on what was on it |
The last row is the one where context decides everything. Wiping a well-backed-up workstation is an inconvenience; wiping an unbacked-up controller is an outage.
four habits
- The same vulnerability is a different risk on different devices — record what the device touches.
- A published exploit raises likelihood sharply; physical-access-only lowers it.
- A mitigating circumstance must be written down, or the band cannot be defended later.
- Low-band findings still belong in the register — many are nearly free to fix.
Worked analysis
EX 1
Score a high finding
An organization has not applied the most recent update to its email server, and the missing patch fixes a vulnerability with a public exploit. Assess it.
1
Name the asset
The email server — correspondence, attachments, and account-recovery messages.
2
State what an adversary gains
Remote control of the server, and access to sensitive data for the whole organization.
3
Weigh likelihood
A published exploit for a known flaw — high.
4
Apply the band test
Potentially compromises sensitive data → high.
5
Document the mitigation
Apply the update; if that must wait, isolate the host and monitor it.
EX 2
Weak credentials with a mitigating factor
A water treatment plant's embedded systems use default credentials but sit on a network with no external route. Band it.
1
Name the weakness
Weak authentication — default credentials, unchanged.
2
Note the severity if exploited
Critical operations — potentially very high.
3
Note the likelihood
Exploitation requires reaching the network, which is not externally routable.
4
Apply the band test
Weak authentication with reduced likelihood → moderate.
5
Record the assumption explicitly
The band depends on the isolation holding. If a connection is ever added, this becomes high overnight.
EX 3
A genuinely low finding
An employee's laptop has telnet port 23 open. Nothing is listening on it that holds data. Is this low?
1
Name the weakness
An open port — a legitimate finding.
2
Ask what it reaches
No sensitive data, and no critical operation depends on this laptop.
3
Ask about likelihood
Reaching it requires being on the same network, and there is little to gain.
4
Apply the band test
Little impact if exploited → low.
5
Fix it anyway
Closing an unused port is nearly free, which is why low-band findings still belong in the register.
Check yourself
What four outcomes does the CED name for device compromise?
Show answer
Impersonating an authorized user, remotely controlling a device, encrypting a drive to ransom the data, and wiping a device.
What makes a device risk high?
Show answer
It involves potentially compromising sensitive data or critical operations — the illustrative case being an unpatched email server with a known exploit available.
What falls into the moderate band?
Show answer
Risks from weak authentication requirements, or from vulnerabilities that would be less likely to be exploited — two different situations sharing one band.
What characterizes a low device risk?
Show answer
A vulnerability that, if exploited, would have little impact — such as an unused open port on a laptop with nothing valuable behind it.