Installed does not mean working
A technician installs anti-virus on forty laptops. Six weeks later one laptop is found with ransomware (software that locks data and demands money).
The anti-virus was there. But on that laptop it had stopped, and nobody checked.
Today you install security software, and then you prove that it works.
Key words
| Word | What it means |
|---|---|
| Vulnerability scanner | Software that looks for weak points, such as open doors and missing updates. |
| Port scanner | A scanner that checks which ports on a device are open. |
| Device scanner | A scanner that finds the devices on a network and lists them. |
| Anti-malware | Software that finds and removes harmful software. |
| Firewall software | A firewall that runs on one device and filters its traffic. |
| Hardening | Making a device safer by removing what it does not need and tightening settings. |
| End user device | A computer, phone or tablet used by a member of staff. |
| Port | A numbered door on a computer, used by one kind of service. |
| Malware | Software made to harm a computer or steal data. |
| Ransomware | Software that locks your data and demands money to unlock it. |
| Network | Computers and devices linked so they can share data. |
| Vulnerability | A weak point that an attacker could use. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can install and configure a scanner, anti-malware and firewall software, remove what is not needed, and check the result.
Starter: choosing techniques
Have a go
Starter: choosing techniques
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: three kinds of software
Three kinds of software protect an end user device.
- A vulnerability scanner finds weak points. A port scanner lists open ports. A device scanner lists the devices on a network.
- Anti-malware finds and removes harmful software.
- Firewall software filters the traffic of that one device.
Each must be installed, set up and kept up to date.
Only scan what you own
Warning
A scanner is also an attacker's tool. Scan only your own machine, or one you have written permission to scan. Scanning other machines without permission can be a crime under the Computer Misuse Act. In the lab, you scan the lab machine itself.
Run: scan your own machine for open ports
(command -v nmap >/dev/null || (apt-get update -qq && apt-get install -y -qq nmap >/dev/null 2>&1)); (python3 -m http.server 8080 --bind 127.0.0.1 >/dev/null 2>&1 &); sleep 1; nmap -sT -p 22,80,443,8080 127.0.0.1 | grep -E "^[0-9]+/|Nmap scan"; pkill -f "http.server 8080"A command for the lesson’s lab terminal. It is shown here and not run.
What you should see
Note
A line for each port. Ports 22, 80 and 443 are closed. Port 8080 is open, because the command started a small web server for a moment, then stopped it. Every open port is a door. Is each one needed? That question is the point of a port scan.
Cycle 2: configure it as well
Installing is half the job. Then configure:
- Scanner: set what to scan, how often, and who gets the report.
- Anti-malware: switch on real-time scanning and automatic updates.
- Firewall: allow only the services the device needs. Block the rest.
Finally, harden the device: remove software it does not need. Every extra program is one more thing that can have a hole.