A school laptop has many guards
Think about a school laptop. A password stops a stranger. A program checks files for harm. The teacher lets you install only some programs. The school checks the people who run the IT.
No single guard is enough. Today you meet the main guards, and what each one costs.
Key words
| Word | What it means | Example |
|---|---|---|
| Anti-malware | Software that finds and removes harmful software. | a virus scanner |
| Signature | A known pattern of a harmful file. The scanner looks for it. | a known bad piece of code |
| Quarantine | A safe place where a suspect file is locked away. | a locked box for a file |
| Intrusion detection | A system that watches for signs of an attack and raises an alert. | a burglar alarm |
| Hardening | Making a system harder to attack by removing what it does not need. | switching off unused services |
| Least privilege | Give each person only the access they need. | a student cannot edit marks |
| Vetting | Checking a person's background before you hire them. | asking a past boss about the person |
| Access control | Rules and tools that decide who may use what. | a login and a list of roles |
The cells students fill in are left blank in this preview.
Quick check: which guard?
Have a go
Quick check: which guard?
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Guards that work on the machine
| Guard | What it does | Benefit | Drawback |
|---|---|---|---|
| Security settings (hardware) | A password when the computer starts. USB ports switched off | Stops a thief or a USB attack | Staff may find it annoying |
| Security settings (software) | Screen lock after a few minutes. Only trusted programs allowed | Stops people from using it by mistake | May block a tool people need |
| Anti-malware | Scans files. Finds known and suspect software. Quarantines or deletes it | Catches most common malware | Slows the machine. Misses very new malware. Sometimes blocks good files |
| Software access control | Logins and roles decide who can open what | Limits the damage one account can do | Needs setting up and looking after |
| Device hardening | Remove unused software. Close unused ports. Change default passwords. Install updates | Fewer weak points to attack | Takes time. A fix may break an old program |
The cells students fill in are left blank in this preview.
The alarm that does not lock the door
An intrusion detection system watches for signs of an attack. For example: 50 wrong passwords in one minute. It sends an alert. It does not stop the attack by itself. It is the alarm and not the locked door.
A drawback: an alarm can ring when nothing is wrong. Someone must read each alert.
Guards about people
| Guard | What it is | Benefit | Drawback |
|---|---|---|---|
| User access policy | Written rules: who may use what, and how to do it safely | Everyone knows the rules | Rules nobody reads do nothing |
| Staff vetting | Checks on a person before they are hired | Less risk of a bad hire | Takes time and money. Cannot know what a person will do later |
| Staff training | Lessons on phishing (fake messages that trick you), passwords and reporting | Fewer mistakes | People forget. It must be repeated |
The cells students fill in are left blank in this preview.
Least privilege
data-callouts.tip.label
Ask: what is the least access this person needs to do their job? Give that. No more. If their account is stolen, the thief gets only that little access.