Node, Device and Storage Security
Node security covers the endpoint-laptops, servers, phones, and attached storage-and asks how you harden, patch, encrypt, back up, and retire it. Controls are layered: firmware/UEFI Secure Boot, OS updates, least-privilege accounts, host firewall, application allowlisting or sandboxing (SELinux, AppArmor), endpoint protection, and full-disk encryption.
Device hardening rules
- Patch the OS and third-party apps; enable automatic updates where possible. An unsupported OS is a finding, not a nuisance.
- Remove unnecessary services and packages; close listening ports; disable default accounts.
- Use full-disk encryption (LUKS/dm-crypt, BitLocker, FileVault) with a strong passphrase and TPM where available; encrypt backups too.
- Lock screens, set idle timeouts, and enable remote wipe/locate on mobile via MDM or built-in tools.
- Control removable media and USB; malware travels by USB.
- Use Secure Boot and measured boot to resist bootkits.
Storage and disposal
Deleting a file or formatting a disk removes metadata, not the blocks. For HDDs, overwrite (a single pass is adequate for modern drives) or degauss; for SSDs, use the drive's secure-erase/ATA SANITIZE or crypto-erase by destroying the key. Physical destruction is the fallback for high sensitivity.
Worked example
A consultant's laptop is stolen from a car. It has LUKS full-disk encryption, a 5-minute screen lock, and the user was logged out. Reasoning: at rest the data is ciphertext; the passphrase is the barrier. If the machine had been suspended with the key in RAM, cold-boot or DMA attacks could matter; if the disk were unencrypted, the loss is a reportable data breach.
Traps
Deleting is not erasing. Encryption does not protect a running, unlocked session. Backups support availability, but an unencrypted backup leaks everything. Patching only the OS and ignoring the browser or PDF reader is common.