The till with a game on it
A café till runs a payment program. Staff have also installed a free game, shared the admin password and left every setting as it came.
The game has a hole. An attacker uses it to reach the payment program.
Six small jobs, done once, would have closed every door.
Key words
| Word | What it means |
|---|---|
| Hardening | Making a device safer by removing what it does not need and tightening its settings. |
| Default password | The password a device is sold with, which everyone can look up. |
| Permission | A setting that says who may read, change or run a file. |
| Unauthorised device | A device that has not been approved for use, such as a personal memory stick. |
| Test plan | A list of checks to run, and what a pass looks like. |
| Evidence | A record that shows a check was made and what it found. |
| End user device | A computer, phone or tablet used by a member of staff. |
| Vulnerability | A weak point that an attacker could use. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can carry out the six hardening steps on a device and write a test that shows the work succeeded.
Starter: installing software
Have a go
Starter: installing software
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: six hardening steps
- Change default passwords. Everyone knows them.
- Set correct permissions on files and services: give only the access that is needed.
- Apply updates and fixes.
- Remove unnecessary software. Less software means fewer holes.
- Apply security policies, such as a screen lock and a password rule.
- Disable unauthorised devices, such as unknown memory sticks.
Run: lock an unused account
useradd -m olduser 2>/dev/null; usermod -L olduser && passwd -S olduserA command for the lesson’s lab terminal. It is shown here and not run.
What you should see
Note
A line with olduser and the letter L: the account is locked. A leaver's account, or one nobody uses, is a door that should be shut.
Run: fix a file everyone can change
echo secret > /tmp/keys.txt && chmod 666 /tmp/keys.txt && find /tmp -maxdepth 1 -name keys.txt -perm -o+w; chmod 600 /tmp/keys.txt && ls -l /tmp/keys.txtA command for the lesson’s lab terminal. It is shown here and not run.
What you should see
Note
First the file name: it was open to everyone. Then a line starting -rw------- : now only the owner can use it.