Topic 2: Workstation, Mobile & Hardware Security

Every desktop, laptop, smartphone, and printer - every component of the digital side of your business is an endpoint that requires basic physical and software protection. Physical security, software patching, firmware updates and device controls form your business's security foundation.

Items Ranked by Priority

The items below are ordered from urgent daily risks to long-term hardware maintenance.

1. Leaving Workstations Unlocked and Unattended

Why It’s a Threat: An unlocked computer allows anyone walking past — customers, delivery drivers, or visitors — to view client data, install malware or copy files in just a few moments.

Real-World Example: An employee steps away for a few moments. A visitor steps behind the counter, inserts a flash drive into the open desktop and copies an unknown mount of company data or uploads malware.

Solution: Enforce a "lock before you walk" policy across your office (press Windows + L or Control + Command + Q on Mac) and configure screens to auto-lock after 2 to 5 minutes of inactivity.

2. Outdated Operating Systems & Unpatched Software

Why It’s a Threat: Software updates fix security flaws that automated hacking tools scan for. Running outdated systems or applications allows these tools to infect machines quietly.

Real-World Example: An office PC runs unpatched software. An employee clicks a link in what appears to be a routine email, and malware uses the unpatched flaw to quietly install ransomware without asking for password permissions. Other attack vectors include browsers, PDF readers, office applications, mobile operating systems, router and printer firmware, and other installed software.

Solution: Turn on automatic operating system and software updates across all business devices, scheduling automatic restarts outside of office hours.

3. Using Personal/Unmanaged Devices for Work (BYOD Risks)

Why It’s a Threat: Personal laptops or phones often do not have proper security controls configured, share access with household members, and may carry undetected malware onto your business systems.

Real-World Example: An employee checks company email on a home PC shared with family. A family member has previously downloaded an infected game mod that installs a keylogger. (Keyloggers are hidden programs that record every keystroke - including bank logins and passphrases - and sends them to hackers.)

Solution: The true issue is not who owns the devices, it is how they are protected. In the case of a solopreneur enterprise, it is very likely that the owner's personal devices will also be used for business purposes. Therefore, the device must have, at the minimum, controls such as a passcode or bio, encryption, current software, remote wipe (if possible), and limits on locally stored business data.

4. Unrestricted Administrative Rights on Daily Workstations

Why It’s a Threat: Logging in as an Administrator for daily tasks like email or browsing means any malware you encounter inherits full administrative privileges. That means that the malware can do anything you can do - disable antivirus, alter system files, copy data out, or install more malware.

Real-World Example: An office worker who has logged in with full admin rights opens an infected attachment. The malware silently installs system-level software and disables the firewall without a prompt.

Solution: Users should use standard (non-admin) user accounts for daily tasks, reserving Administrator logins strictly for approved software installations and maintenance.
Everyone does not require Admin access. Consider restricting use of admin accounts to those who make system changes.

5. Relying Solely on Basic Antivirus (Or Turning It Off)

Why It’s a Threat: Understand that antivirus software has its place in the security scheme, but should be layered together with other controls.

Real-World Example: An employee gets a security warning on a file, temporarily pauses real-time antivirus protection to finish their task, and accidentally executes undetected ransomware.

Solution: Pair antivirus with other controls such as updates, firewalls, backups, email filtering, least-privilege accounts, and employee awareness. Lock settings so A/V and other protections cannot be turned off from standard accounts during daily work.

6. Unencrypted Laptops and Mobile Storage

Why It’s a Threat: Laptops or USB drives stolen from vehicles or travel bags allow anyone to remove the hard drive and extract unencrypted files without knowing your Windows or Mac password.

Real-World Example: A manager's laptop is stolen overnight. Because the drive was not encrypted, the thief is able to extract customer tax records and other protected data directly from the hard drive.

Solution: Enable full-disk encryption (Windows BitLocker or macOS FileVault) on all laptops and portable storage devices. Full-disk encryption protects data when a laptop or drive is lost or stolen and powered off.
It does not protect a computer that is already powered up and unlocked.
The recovery keys for each encrypted device require secure storage, off-site if possible.

7. Lack of a Centralized Device Inventory

Why It’s a Threat: Operating without an accurate hardware and software inventory makes it impossible to determine who the device has been assigned to, track missing (or extra) equipment or verify whether all devices are running critical system and application updates.

Real-World Example: A remote employee leaves, but because no asset tracker exists, nobody remembers to request the return of a company tablet holding active business logins.

Solution: Maintain a simple hardware inventory spreadsheet listing device make and model, serial numbers, assigned users, software and firmware versions, and encryption status.

8. Plugging in Unknown USB Flash Drives

Why It’s a Threat: USB drives dropped in parking lots or lobbies are a common trick; curiosity leads staff to plug them in and opening an 'interesting' file, executing malicious code.

Real-World Example: Curiosity leads staff to plug in an unknown USB drive. Even without clicking a file, a malicious USB (BadUSB) can emulate a keyboard and execute harmful commands in seconds.

Solution: AUTORUN is a setting that tells the OS to automatically run an executable. Fortunately, it is disabled by default in Windows 11, so it will not automatically run any applications on the drive. However, BadUSB takes control as part of the recognition process and executes its malware payload.
Teach staff to not plug in unknown USB devices and instead, to report, and deliver the devices to management.

9. Missing Physical Lock Defenses in Public-Facing Areas

Why It’s a Threat: Unsecured desktop computers, backup drives, or network switches sitting in reception areas or open offices can be unplugged and stolen by visitors or night cleaning crews.

Real-World Example: A retail computer store prepares a display with a computer, monitor, keyboard and mouse near the front of the store. A person comes in, quickly gathers all the displayed components and runs out the door - all in under 30 seconds. A car is waiting. He tosses the components in the back seat, jumps in the front and the driver speeds away.

Solution: Anchor desktop PCs [even displays] and backup drives to desks using cable locks, and lock backup drives, routers, switches, and central network gear inside dedicated locking cabinets.

10. Improper Disposal of Old Computers & Storage Drives

Why It’s a Threat: Deleting files or formatting drives does not permanently remove data. Discarded or donated hardware can yield recoverable client files when checked with free recovery software.

Real-World Example: A firm donates old PCs without sanitizing the drives. A buyer purchases one online and uses basic software to recover client invoices.

Solution: Perform a secure multi-pass disk wipe using specialized software or physically destroy hard drives before discarding hardware. Solid-state drives and flash storage should generally use a manufacturer secure-erase process, or physical destruction.
Verify Destruction - Record the device serial number, disposal date, sanitization method, and person or company that performed the work. If secure erasure cannot be verified, destroy the storage device.

11. Neglecting Printer, Copier, & Scanner Security

Why It’s a Threat: Modern office multi-function copiers are specialized computers with internal hard drives that retain copies of every printed, scanned, or emailed document.

Real-World Example: A leased copier is returned to a vendor, who resells it without clearing the drive, exposing scanned client contracts.

Solution: Change default administrative passwords on office printers and perform a full disk wipe on leased copiers before returning them to leasing companies.