AP® Cybersecurity · Unit 4: Securing Devices · Topic 4.1
Device Vulnerabilities and Attacks
An endpoint is any device that connects to, stores, or processes information: a laptop, phone, tablet, server, printer, wearable, camera, smart speaker, or industrial sensor. A weakness in its software, configuration, identity controls, connections, physical protection, or user behavior can expose both the device and everything it can reach.
Five terms that organize device security
These words describe different parts of a security problem. Keeping them separate makes an AP® Cybersecurity answer more precise.
| Term | Meaning | Defensive device example |
|---|---|---|
| Vulnerability | A weakness that could be used or triggered. | A tablet runs an outdated operating system with a known flaw. |
| Threat | A circumstance or actor capable of causing harm. | A criminal group sends malicious attachments to device users. |
| Exploit | A method or code that takes advantage of a vulnerability. | Malicious content targets the unpatched flaw. No operational details are needed to assess the risk. |
| Attack | An attempt to compromise confidentiality, integrity, or availability. | A malicious file is delivered and executed on an endpoint. |
| Risk | The possibility and consequence of harm when a threat can affect an asset. | The affected tablet can access student records, making the impact more serious. |
Reasoning model: Risk ≈ likelihood × impact. Controls reduce likelihood, impact, or both; they rarely make risk exactly zero.
Recognize weaknesses; do not test them
Never attempt to exploit, bypass, root, probe, or install software on a device without explicit authorization. Report concerns through the device owner’s approved support or security channel.
Common endpoint vulnerabilities
Outdated operating systems, applications, drivers, and firmware may contain publicly known flaws. Missing patches leave fixes unapplied; unsupported products may receive no future security corrections.
Weak, reused, or default passwords and missing multifactor authentication make stolen or guessed credentials more useful. Shared accounts also reduce accountability.
Excessive permissions let users, apps, and services access more than they need. If one is compromised, the attacker may inherit that broad reach.
Misconfigured settings include disabled screen locks, unnecessary services, overly broad sharing, exposed remote access, weak privacy choices, or security tools turned off.
Malicious apps, unsafe downloads, and untrusted browser extensions may request unnecessary permissions, collect data, change browsing, or install unwanted components. Use approved stores and publisher checks.
Theft, loss, tampering, or unattended access can expose stored data, logged-in sessions, removable media, hardware, and organizational accounts.
Malicious USB devices and unauthorized peripherals may imitate trusted input, storage, or network hardware. Unknown cables, adapters, drives, and charging accessories should not be connected.
Insecure Bluetooth, Wi-Fi, NFC, and other radios can expose connections or device discovery. Disable unused interfaces, avoid unknown networks and pairing requests, and follow policy.
Jailbreaking or rooting alters manufacturer restrictions and may weaken sandboxing, update reliability, app controls, or organizational management. Disabling built-in security creates similar risk.
Social engineering persuades users to reveal credentials, approve an MFA prompt, install an app, open a file, connect a device, or disable protection. The user is targeted through the endpoint.
Unsupported is different from unpatched
An unpatched product has an available fix that has not been applied. An unsupported product may no longer receive fixes at all, so replacement, isolation, or a documented compensating control may be necessary.
Drivers and firmware matter
Security depends on more than visible apps. Drivers connect the operating system to hardware, while firmware controls low-level device functions. Both require trusted, authorized updates.
Default does not mean secure
Factory credentials, discoverable radios, unused services, broad sharing, or permissive app access may prioritize quick setup. A secure baseline changes settings to match the device’s real purpose.
Malware that targets devices
Malware is software or firmware designed to perform unauthorized or harmful actions. Categories describe behavior and can overlap: one incident may involve spyware, remote access, persistence, and ransomware.
| Category | What it threatens | Defensive takeaway |
|---|---|---|
| Ransomware | Encrypts, locks, steals, or otherwise makes data and systems unavailable while demanding payment. | Patching, least privilege, segmentation, tested backups, monitoring, and response planning reduce harm. |
| Spyware | Secretly gathers browsing, messages, location, credentials, files, camera or microphone data. | Control applications and permissions; investigate unexpected privacy access or data use. |
| Keylogger | Captures keystrokes or input, potentially exposing credentials and sensitive text. | Endpoint protection, MFA, safe software practices, and investigation of unusual processes help. |
| Rootkit | Attempts deep persistence or concealment by altering low-level system behavior. | Secure boot, trusted updates, integrity monitoring, and specialist recovery may be required. |
| Remote-access malware | Provides an unauthorized person remote control or surveillance of the device. | Restrict remote tools, monitor unusual connections, and verify support requests through known channels. |
| General malicious code | May delete or modify files, spread, display unwanted content, abuse resources, or download other components. | No single tool catches everything; use layered controls and human awareness. |
Social engineering often starts the chain
A message may impersonate a teacher, delivery service, help desk, game, employer, or security warning. Pause when a request creates urgency, asks for a password or MFA code, demands an installation, or sends you to an unfamiliar login. Verify through a separate trusted channel.
Mobile, wearable, printer, camera, and IoT risks
Smartphones and tablets are portable, sensor-rich, frequently connected, and often hold work, school, payment, health, and personal data. Loss, unsafe apps, broad permissions, untrusted networks, unattended sessions, and delayed updates can have consequences beyond the device itself.
Internet of Things (IoT) devices—including wearables, smart speakers, printers, cameras, thermostats, door controllers, and sensors—may have limited interfaces, long replacement cycles, unclear support periods, or weak monitoring. A device that appears simple can still store data, communicate externally, or provide a path into a network.
Smart camera
A camera with a reused password, exposed remote access, and old firmware can threaten video privacy and the home or school network.
Shared printer
A printer may store jobs, expose an administration interface, accept removable media, and run firmware. Treat it as a computer, not just office furniture.
Wearable
A fitness or health device may collect location and biometric data, sync through a phone, and depend on a vendor cloud service. Review permissions and lifecycle support.
Signs a device may be compromised
One symptom rarely proves malware. A failing battery, faulty update, full disk, or legitimate background process can look similar. Strong detection combines symptoms, logs, account activity, network evidence, and authorized investigation.
Performance and availability
- Unexpected crashes, overheating, severe slowdown, battery drain, storage loss, or high network use
- Files renamed, missing, inaccessible, or unexpectedly encrypted
- Security tools, backups, or updates fail without explanation
Software and configuration
- Unknown apps, extensions, administrator accounts, services, profiles, or pop-ups
- Browser homepage, search provider, permissions, or security settings change unexpectedly
- Camera, microphone, location, or accessibility indicators appear without expected use
Identity and communication
- Unrecognized logins, password resets, MFA prompts, sent messages, or purchases
- Contacts receive messages the user did not send
- The device contacts unfamiliar destinations or transfers unusual volumes of data
Physical and peripheral clues
- Broken seals, altered ports, missing components, unexpected cables, adapters, drives, or pairing requests
- A device disappears and returns without explanation
- Lock-screen attempts, unfamiliar fingerprints, or unauthorized management prompts appear
Respond without destroying evidence
Record what you observed, stop sensitive activity if policy directs, and contact the owner, school IT, workplace service desk, or security team through a known method. Do not run random “cleaner” tools, delete logs, reconnect unknown peripherals, or confront a suspected person.
Layered defenses for endpoints
- Know the deviceMaintain an inventory, owner, purpose, software versions, support status, data sensitivity, and approved connections.
- Harden and updateUse a secure baseline, remove unnecessary services, patch promptly, and obtain firmware, drivers, and apps from trusted sources.
- Limit accessUse unique passwords, MFA, screen locks, least privilege, application control, approved peripherals, and managed accounts.
- Protect and recoverEncrypt sensitive data, keep tested backups separate, monitor security state, report warnings, and follow an incident plan.
| Practice | Why it helps | Important limitation |
|---|---|---|
| Patching and supported software | Corrects known flaws and maintains access to security updates. | Updates do not prevent every new flaw or unsafe user action. |
| Secure configuration | Reduces exposed services, permissive settings, and unnecessary interfaces. | Baselines must match the device’s purpose and be maintained. |
| Strong authentication and least privilege | Limits unauthorized access and the damage a compromised account or app can cause. | Users can still approve fraudulent prompts; identity controls need monitoring. |
| Encryption | Protects data at rest and, with secure protocols, in transit. | An unlocked or compromised device may expose data while it is in use. |
| Backups | Support recovery after loss, failure, ransomware, or accidental deletion. | Backups must be protected, separated, retained, and tested. |
| Application and peripheral control | Restricts unapproved code, extensions, USB devices, and accessories. | Approved software and hardware can still contain vulnerabilities. |
Device-security decisions in context
Personal laptop
A “free converter” asks for administrator access and a browser extension. The user stops, checks whether the task can be done with an existing trusted tool, and avoids the unverified download.
School tablet
A student receives repeated unexpected MFA prompts. They deny the prompts, stop using links in the message that preceded them, and report the event through the school’s approved channel.
Workplace server
A required application depends on an unsupported operating system. The organization documents the risk, restricts access, adds monitoring and backups, and plans replacement rather than ignoring the lifecycle problem.
Mobile phone
A lost phone contains school and personal accounts. A strong lock, encryption, account recovery plan, current backup, and authorized remote-management features reduce impact.
IoT camera
Before deployment, a family checks the vendor’s update policy, changes unique credentials, disables unneeded remote access, reviews data collection, and places the camera on an appropriate network segment.
Shared lesson
Device risk comes from technology, configuration, connections, physical access, lifecycle support, and human decisions. Defense in depth addresses all six.
Watch: understanding device threats
As you watch, note one vulnerability, one possible impact, one warning sign, and one defensive control.
Interactive knowledge check
Endpoint Expedition
Choose the strongest defensive answer. The quiz runs locally in your browser and collects no personal information.
What the quiz covers
Security vocabulary; updates and support; authentication and least privilege; unsafe apps and peripherals; malware; mobile, wireless, and IoT risks; compromise signs; and layered defensive responses.
How scoring works
There are 10 questions worth one point each. Answer all questions, select Check my answers, read the explanations, and use Restart quiz for a fresh attempt.
AP® Cybersecurity study support
Endpoint
A device that connects to or processes data in a networked environment.
Patch
An update intended to correct flaws, including security vulnerabilities.
Firmware
Low-level software embedded in hardware that controls device functions.
Sandbox
An isolation boundary that restricts what code or an app can access.
Application control
Policy and technology that permit approved software and restrict unapproved code.
Secure baseline
An approved starting configuration designed to reduce unnecessary exposure.
Exam reasoning pattern
Identify the asset, name the vulnerability and threat, describe the likely impact, select controls that reduce likelihood and impact, then state a safe reporting or recovery step.
Continue studying
Explore RevisionTown computer science resources, connect device encryption with the cryptography guide, or plan retrieval practice with the AP® self-study guide.
Frequently asked questions
1. What is an endpoint vulnerability?
It is a weakness in a device’s hardware, software, firmware, configuration, identity controls, connections, physical protection, or user practices that could contribute to harm.
2. Is a vulnerability the same as an attack?
No. A vulnerability is a weakness; an attack is an attempt to compromise a system. A threat may use an exploit to take advantage of the vulnerability.
3. Why is unsupported software risky?
The vendor may no longer provide security fixes, compatibility updates, or technical support. Known weaknesses can remain while defensive options shrink.
4. Can antivirus software stop every device attack?
No. Endpoint protection is one layer. It cannot replace secure configuration, updates, strong authentication, least privilege, encryption, backups, physical security, and aware users.
5. Why are default credentials dangerous?
They may be documented, predictable, reused across devices, or left unchanged by many owners. Unique credentials and MFA, where supported, reduce this exposure.
6. Are browser extensions a security risk?
They can be. Extensions may read page content, alter browsing, or access data. Install only necessary extensions from trusted publishers and review permissions and updates.
7. Why should unknown USB devices not be connected?
An unknown peripheral can imitate storage, a keyboard, a network adapter, or another trusted device. Report it and let authorized personnel follow approved handling procedures.
8. Does encryption protect a lost device?
Encryption can protect stored data when the device is locked and keys are secure. It works best with a strong screen lock, account protection, current backups, and an incident plan.
9. What makes IoT devices difficult to secure?
Some have limited interfaces, long lifetimes, unclear support, weak defaults, broad connectivity, little monitoring, or sensitive sensors. Security capabilities and vendor support vary widely.
10. What should I do if I think a device is compromised?
Stop sensitive activity if policy directs, record observable facts, and contact the owner or approved IT or security channel. Avoid deleting evidence or using unapproved repair tools.
Trusted references
AP® is a trademark registered by the College Board, which is not affiliated with and does not endorse this page. This lesson provides defensive cybersecurity education. Device assessment, monitoring, software installation, evidence handling, and response must be authorized and follow applicable policies, privacy requirements, and law.
