Simple explanation
Two related ideas: hardening (locking down individual systems to a secure baseline) and asset management (knowing what you own, throughout its whole lifecycle, so nothing gets forgotten and left vulnerable).
Technical explanation
Secure baselines — a defined, approved secure configuration that systems are deployed against and periodically checked to still match.
Hardening targets: mobile devices, workstations, switches, routers, cloud infrastructure, servers, ICS/SCADA, and embedded/RTOS/IoT devices — each has different hardening considerations, but the underlying principle (minimize attack surface, remove what's unnecessary) is the same everywhere.
Mobile solutions: MDM (Mobile Device Management — centrally enforcing policy on enrolled devices). Deployment models: BYOD (Bring Your Own Device — employee-owned, least organizational control), COPE (Corporately Owned, Personally Enabled — org-owned but employee can use it personally), CYOD (Choose Your Own Device — employee picks from an approved list, org owns it). Connection methods: cellular, Wi-Fi, Bluetooth — each with different security implications for a managed device leaving the corporate network.
Wireless security settings — encryption standard (WPA3 over WPA2/WEP), authentication method, and disabling unnecessary broadcast (like SSID broadcast in some cases).
Application security — secure coding practices, input validation, keeping applications patched.
Sandboxing — running untrusted code/files in an isolated environment to observe behavior without risking the production system.
Monitoring — ongoing visibility into hardened systems to confirm they stay in their secure state.
Asset management lifecycle:
- Acquisition/procurement — vetting security posture before purchase, not after deployment.
- Assignment/accounting — ownership (who's responsible), classification (how sensitive), inventory (a complete, accurate list of what exists).
- Monitoring/asset tracking — knowing where assets are and what state they're in, continuously, not just at purchase.
- Disposal/decommissioning — sanitization (removing data before reuse/disposal), destruction (physically destroying media that can't be safely sanitized), certification (documented proof that sanitization/destruction actually occurred, often required for compliance), data retention (following legal/policy requirements for how long data must be kept before disposal is even allowed).
Synonyms / related terms
| Term | Means | |---|---| | MDM | Mobile Device Management | | BYOD | Bring Your Own Device | | Secure baseline | Sometimes called a "golden image" when referring to a pre-hardened deployment template |
Concept Check
"An organization decommissions old hard drives but can't verify with certainty that they were wiped before recycling." The gap here isn't sanitization itself — it's the missing certification: documented proof of the sanitization event. Without it, the organization can't demonstrate compliance even if the wipe genuinely happened.
Interview-style Q&A
Q: Why would a company choose COPE over BYOD despite the higher cost of owning the devices? A: "BYOD maximizes employee flexibility but minimizes the org's control — you can't fully enforce security policy on a device you don't own, and there are real privacy tensions in trying to. COPE keeps the org as the legal owner, which makes MDM enforcement, remote wipe, and asset tracking far more defensible and reliable, at the cost of buying and maintaining the hardware."
Memory trick
"Buy, Own, Choose" — BYOD, COPE, CYOD — read left to right as "employee buys, org owns fully, employee chooses from org's list" and the spectrum of control makes intuitive sense.