• (A) The password policy — a 14-character minimum on the laptop login would have stopped the installer running.
• (B) The acceptable-use policy — its rule against streaming video and social media on company laptops covers personal web activity.
• (C) The software-installation policy — an approved-software list, with installs performed by IT rather than by the technician.
• (D) The patch policy — a fixed monthly operating-system update cycle applied to every field laptop in the fleet.

• (A) Run a full disk scan on every laptop each night, so an infection is found sooner even when the database is old.
• (B) Require each laptop to pull signature updates over the technician’s hotspot before every site visit, and lock the tools until it does.
• (C) Replace the anti-malware product with one whose database is larger, so fewer new samples fall outside what it knows.
• (D) Switch off the laptop’s host-based firewall while it is in the field, so an update server is never blocked.

DRAFT PROCEDURE: Onboard Controller Firmware (rev 2)
Owner: R. Boyle, IT Lead

1. Vendor firmware releases are reviewed within 5 business days.
2. Critical updates are tested on a bench machine before field rollout.
3. A machine is updated only when a technician is already on site for
   another reason, so no visit is scheduled just to apply an update.
4. Every applied update is recorded against the machine serial number.
5. A machine that misses two update cycles is flagged for follow-up.

• (A) Step 3 — tying updates to unrelated service visits leaves a known vulnerability open for as long as the machine has no other reason to be visited.
• (B) Step 1 — a five-business-day review window is too slow; every vendor release should be pushed to field machines on the day it is published.
• (C) Step 2 — bench testing delays rollout, so critical updates should go straight to field machines and be rolled back if they misbehave.
• (D) Step 5 — flagging after two missed cycles is pointless, because update history should not be kept per machine in the first place.

• I. A host-based firewall keeps filtering traffic when the laptop is plugged into a customer network Kestrel does not own or inspect.
• II. Because the firewall runs on the device itself, a rule that denies a port cannot be overridden by a broader rule placed above it in the list.
• III. A host-based firewall can restrict outbound connections, which is what keeps a compromised device from reaching an attacker’s server.
• IV. A host-based firewall filters traffic into and out of the device, but it does not remove malware already installed on it.

1. An ordered list of allow and deny rules that a firewall evaluates from the top, where the first matching rule decides the outcome, is called an .

2. The published fingerprint of a known malware sample, which anti-malware software compares files against, is called a .

3. Applying a vendor’s update to close a known vulnerability in software or firmware is called .