The survey file on the old laptop
An analyst keeps a survey file on a laptop. The login has a strong lock. But the laptop runs a system that stopped getting updates years ago.
Nobody breaks the lock. They walk in through the old part.
Today you find weak rules and old parts, the open windows of a data system.
Key words
| Word | What it means |
|---|---|
| Vulnerability | A weakness an attacker can use. |
| Encryption | Scrambling data so only the right key can read it. |
| Weak encryption | Scrambling that is old or simple, so an attacker can undo it. |
| Password policy | The rules for how passwords are made and changed. |
| MFA | Multi-factor login: two or more proofs of who you are. |
| Firmware | Software stored inside a device, such as a router or a printer. |
| Legacy system | An old system that is still in use. |
| Zero-day | A weakness nobody has fixed yet, because the maker has only just learned of it. |
| Patch | A small update that fixes a weakness. |
| Unsupported | No longer updated by its maker. |
| Data warehouse | A big store of data kept for analysis. |
| Network | Computers joined together so they can share data. |
| Firewall | A guard that decides which internet traffic may pass. |
| Router | A device that passes traffic between networks. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name the technical weaknesses in a data system and say how each one lets an attacker in.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Weak processes let attackers in
A process is a rule or a habit. Three weak ones:
Weak encryption. Old or simple scrambling that an attacker can undo. Stolen survey data is then readable.
An inadequate password policy. Short passwords, the same one reused, no change after a leak. Attackers guess them.
No MFA. One stolen password is then enough to open the account.
Weak process, harm and fix
| Weakness | What can go wrong | The fix |
|---|---|---|
| Weak encryption | A stolen customer file is unscrambled and read | Use current, trusted encryption |
| Poor password policy | Easy guesses and reused passwords | Long passphrases, no reuse, a banned list |
| No MFA | One stolen login opens the data warehouse | Turn on MFA for every account that can |
The cells students fill in are left blank in this preview.
Check: weak processes
Have a go
Check: weak processes
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.