Endpoint cybersecurity: When smart devices turn stupid

With the proliferation of ever-cheaper IoTs (or smart devices) from smart doorbells to WiFi security cameras and baby monitors and hybrid work arrangements involving relaxed BYOD (Bring Your Own Device) policies, cybersecurity education must build awareness on the threats that endpoints pose. While securing corporate networks from cyberattack gains much attention, there is a dearth of educational material that exemplifies the processes by which endpoints are used in hacks, and how to build defenses against endpoint vulnerabilities. This teaching case provides a Defense in Depth (DiD) learning framework on how to defend industrial cyber-physical systems, digital infrastructure and assets. The case illustrates the applicability of a DiD framework independent of attack vector yet particular to endpoint vulnerabilities and shows how lessons from the past can help defend and mitigate future cyberattacks.