The doors nobody locked
An analyst gets a new laptop to work on a file of customer orders. It arrives with extras: a game, a trial program and a file-sharing tool nobody asked for. There is a guest login with no password. Several doors are open to the outside.
Each extra is one more way in for an attacker. A technician locks the ones nobody needs.
Key words
| Word | What it means | Example |
|---|---|---|
| Hardening | making a device safer by removing what it does not need | |
| Port | a numbered door that a program uses to talk over a network | 80 |
| Attack surface | all the ways an attacker could try to get in | |
| Least privilege | giving each user only the rights they need | |
| Permission | a right to open, change or run something | |
| Default | the setting a device has when it is new | a password of "admin" |
| Network | devices joined so they can share things | |
| Firewall | a utility that allows or blocks network traffic by rules |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can list what to remove or change to harden a device.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Every extra is a door
Hardening shrinks the attack surface: all the ways an attacker could try to get in. The fewer doors you leave, the fewer you must guard.
You do four things. Close ports you do not use. Remove programs you do not need. Cut permissions to the least needed. Remove or lock accounts and access that nobody uses.
Four hardening jobs
| Remove or change | Why | Example |
|---|---|---|
| Unneeded ports | A program listening on a port is a door | Close remote desktop on a laptop that never needs it |
| Unneeded applications | Every program may have weak spots | Uninstall a trial game |
| Unneeded permissions | Least privilege limits the damage | A clerk cannot install software |
| Unneeded access | Old accounts and default logins are easy targets | Delete the guest login and change the default password |
The cells students fill in are left blank in this preview.
Extra: See which ports are listening
ss -tlnA command for the lesson’s lab terminal. It is shown here and not run.
Extra: See a file only the system may read
ls -l /etc/shadowA command for the lesson’s lab terminal. It is shown here and not run.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.