[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.3.a
AP Cybersecurity · Securing Devices
Managerial Controls for Device Security
A device policy works when it says what is allowed and how to ask for the rest.
key ideaA device policy works when it says what is allowed and how to ask for the rest.
Matching controls to threats
Device policies are managerial controls: rules enforced through people and process rather than hardware. They cover the decisions a user makes daily — what to install, what to plug in, whether to apply that update — and those decisions are where most device compromises begin.
| Policy clause | What it governs | Attack it answers |
|---|
| prohibit specific websites or categories | social media, gaming and similar | drive-by downloads and credential-harvesting pages |
| require software to be kept updated | patch application by users | exploits for known vulnerabilities |
| allow or prohibit peripheral devices | what may be connected | malware on external drives; hardware keyloggers |
| prohibit personal devices on the network | what joins the network | unmanaged, unpatched machines |
| password policy | length, age, reuse, complexity | guessing, reuse, stale credentials |
| software installation policy | what users may install | unvetted software carrying malware |
Every clause is a decision taken once, centrally, instead of thousands of times by individuals under time pressure. That is the entire value of a managerial control.
Acceptable use policyGoverns how devices may be used — websites, updates, peripherals, and personal devices on the network.
Password policyDetails password requirements: minimum or maximum length, how long a password may be kept, reuse limits and complexity.
Software installation policyDescribes what software users may install, and a process to request specialized software they need for their work.
Peripheral deviceAnything connected to a device — drives, keyboards, docks. Each is a potential malware or keylogger path.
Request processThe half of an installation policy that makes it survivable. Without it, users route around the rule.
Layering
The third box carries the clause people forget: a software installation policy describes what may be installed and a process for requesting what is not on the list. A prohibition with no route to yes gets bypassed.| Policy written as… | Likely outcome |
|---|
| “users may not install software” | shadow installations, or work that cannot be done |
| “users may not install software; request via IT, 2-day turnaround” | followed, because there is a route to yes |
| “keep your software updated” | inconsistent — no schedule, no check |
| “updates applied within 7 days; devices report compliance” | measurable, and gaps are visible |
The pattern across both pairs: a policy is followed when it is specific, has a route to yes, and is checkable. Strictness is not what makes it work.
Acceptable usehow the device may be used
Password policywhat a credential must look like
Installation policywhat may be added — and how to ask
Worked analysis
EX 1
Write an installation policy that holds
A design team needs specialized tools IT has never heard of. A blanket install ban is proposed. Advise.
1
Name the risk being managed
Unvetted software carrying malware, and unmanaged versions nobody patches.
2
Name the failure of a blanket ban
The team either cannot work or installs anyway, unreported.
3
Add the missing half
A request process for specialized software, with a stated turnaround.
4
Add the vetting step
IT reviews and packages the tool, so it is inventoried and patchable.
5
State the principle
A prohibition with no route to yes is a prohibition that will be broken — quietly, and without a record.
EX 2
Peripherals in a clinical setting
A hospital debates whether to permit USB drives on clinical workstations. Frame the decision.
1
State the threat
Malware on external drives, and hardware keyloggers between keyboard and machine.
2
State the operational need
Some imaging equipment genuinely exchanges data by physical media.
3
Reject both extremes
A blanket ban breaks clinical work; unrestricted use accepts the full risk.
4
Write the middle
Prohibit by default; permit named devices on named workstations, with anti-malware scanning enforced.
5
Note the policy type
This is an acceptable use clause — allowing users to connect peripheral devices is exactly what the CED lists.
EX 3
Two policies that overlap
Both the acceptable use policy and the password policy mention passwords. Is that a problem?
1
Identify what each covers
Acceptable use governs behavior; the password policy governs the credential itself.
2
Name the risk of duplication
Two documents drifting out of step, so nobody knows which applies.
3
Give the resolution
One authoritative statement in the password policy; the acceptable use policy references it.
4
Note why it matters
A rule stated twice differently is a rule that cannot be enforced.
5
Generalize
Policies should reference each other rather than repeat each other.
Check yourself
What does an acceptable use policy govern?
Show answer
How devices may be used — prohibiting specific websites or categories such as social media or gaming, requiring software to be kept updated, whether users may connect peripheral devices, and whether personal devices may be used.
What does a password policy detail?
Show answer
The requirements for user passwords — minimum or maximum length, how long a user may keep the same password, and related requirements such as reuse and complexity.
What two things does a software installation policy contain?
Show answer
What software users are allowed to install, and a process for requesting specialized software they need to do their jobs.
Why does the request process matter as much as the prohibition?
Show answer
Without a route to yes, users who genuinely need a tool will install it unreported — producing the exact unmanaged software the policy was written to prevent.