2.4 System Security

Layered defenses for systems

System security relies on layered controls that protect devices and data even if one control fails. Key techniques include operating system updates/patches, antivirus/anti-malware software, firewalls, encryption, and user account controls. Keeping software patched closes known vulnerabilities before attackers can exploit them, while multiple overlapping defenses create defense in depth.

Authentication and access control

Systems verify identity through authentication (passwords, biometrics, tokens) and limit what verified users can do through authorization, often via the principle of least privilege — granting only the access needed to perform a task. Multi-factor authentication (MFA) combines two or more factors (something you know, have, or are) to strengthen login security beyond a single password.

Monitoring and maintaining systems

Ongoing system hardening removes unnecessary services, accounts, and default settings that could be exploited. Logging and monitoring track system activity to detect suspicious behavior, while regular backups ensure data can be restored after an attack like ransomware. Together, these practices reduce the attack surface and improve resilience against compromise.

Key terms

Defense in depth

Using multiple layered security controls so that if one fails, others still protect the system.

Principle of least privilege

Granting users only the access needed to perform their specific tasks.

Multi-factor authentication (MFA)

Requiring two or more verification factors (something you know, have, or are) to confirm identity.

System hardening

Reducing a system's attack surface by removing unnecessary services, accounts, and default settings.

Why backups matter

They allow data and systems to be restored after attacks like ransomware, minimizing data loss.

Try an AP-style question

What is the principle of least privilege?

1. Share one account among staff
2. Give users only the access they need
3. Remove all user accounts
4. Give every user admin rights