Choosing Device Detection Controls

AP Cybersecurity · Securing Devices

Choosing Device Detection Controls

Choose per device, not per organization — the criteria resolve differently on each machine.

key ideaChoose per device, not per organization. The criteria pull in different directions on different machines.

Matching controls to threats

Every device could have the strongest detection available. None of them should, because detection consumes memory and processing power and a license costs money on every machine you put it on. The question is which devices earn the expensive option.

Criterion	What it measures	Pushes toward
performance	memory and processing power the tool consumes	signature-based on constrained devices — anomaly-based uses more resources
cost	licenses for the number of devices monitored	selective deployment, or a cheaper tier on low-risk devices
sensitivity or criticality	what the device stores, processes, or provides	stronger detection where the device is more likely to be targeted

The third criterion is the one that overrides the other two. A device that is more likely to be targeted justifies the performance and license cost — and a meeting-room display does not.

Layering

Read the third box first. Criticality decides how much performance cost and license spend a device is worth — the other two then say what is affordable on the rest.

Device	Sensitivity / criticality	Resource headroom	Sensible choice
domain controller	very high	ample	anomaly-based or hybrid, fully monitored
finance workstation	high	adequate	anomaly-based, tuned
general office laptop	moderate	moderate	signature-based, centrally reported
embedded controller	high	minimal	network-side detection instead — the device cannot host a tool
meeting-room display	low	minimal	basic protection; monitor at the network

Row 4 is the interesting one: high criticality and no resources. When the device cannot carry the tool, detection moves off the device rather than being abandoned.

Performanceanomaly costs more than signature

Costa license per device

Criticalitydecides which devices earn it

the three criteria, and what follows

Detection tools consume system memory and processing power and can affect device performance.
Anomaly-based tools use more system resources than signature-based ones.
Licensing is per device, so cost scales with the number of devices monitored.
Devices storing sensitive information or providing critical services are more likely to be targeted.

Worked analysis

EX 1

Choose for a mixed estate

An organization has 400 office laptops, 6 servers holding customer data, and 40 embedded sensors. Allocate detection.

Rank by criticality

Servers highest — sensitive data means more likely to be targeted.

Assign the servers

Anomaly-based; they have the resources and warrant the license cost.

Assign the laptops

Signature-based — 400 anomaly licenses is a cost the risk does not justify.

Assign the sensors

They lack the memory and processing power; detect at the network instead.

State the reasoning

One estate, three answers — because the three criteria resolve differently on each class of device.

EX 2

When performance is the constraint

A team wants anomaly-based detection on a set of aging point-of-sale terminals. What is the objection, and the alternative?

State the resource fact

Anomaly-based tools use more system resources than signature-based ones.

Apply it to the hardware

Aging terminals have little headroom; the tool would degrade the till.

Note the business consequence

A slow checkout is an operational problem staff will escalate until the tool is removed.

Give the alternative

Signature-based on the device, plus anomaly-based detection on the network segment they sit in.

State the principle

Detection that degrades the device gets uninstalled, which is worse than a lighter tool that stays.

EX 3

Justifying the license spend

Finance asks why detection is not simply deployed to every device at the cheapest tier. Answer.

Grant the cost logic

Uniform cheap licensing is genuinely the lowest-cost option.

Introduce criticality

Devices storing sensitive information or providing critical services are more likely to be targeted.

State the mismatch

Uniform detection gives the same coverage to the domain controller and the meeting-room display.

Reframe the spend

Concentrate the strong tier where attacks are likely, and keep the cheap tier everywhere else.

State the outcome

Similar total cost, materially better coverage where it matters.

Check yourself

How does performance factor into choosing a detection method?

Show answer

Detection tools use system memory and processing power and can impact device performance — and anomaly-based tools use more system resources than signature-based ones.

How does cost factor in?

Show answer

Organizations must consider the cost of enough software licenses for the number of devices they need to monitor — so the price is multiplied across the estate.

Why does sensitivity or criticality matter?

Show answer

Devices that store or process sensitive information or provide critical services are more likely to be targeted, which justifies stronger detection despite its cost.

What should be done for a critical device that cannot run a detection tool?

Show answer

Move the detection off the device — monitor the network segment it sits in — rather than leaving it unwatched.

Course map. Topic 4.4.b · LO 4.4.B — determine controls for detecting attacks against a device (EK 4.4.B.1–4.4.B.3: performance, since detection tools use system memory and processing power and anomaly-based tools use more; cost, including licenses for the number of devices monitored; sensitivity or criticality, since devices storing sensitive information or providing critical services are more likely to be targeted).