Four open windows
A firm is attacked. The review finds four open windows. A fix from months ago was never installed. A default password was never changed. Anybody could change the start-up menu. A leaver could still sign in.
None needed clever hacking. All four were small jobs left undone.
Today you learn the four weak points and the control for each.
Key words
| Word | What it means |
|---|---|
| Vulnerability | A weak point that an attacker could use. |
| Patch | A small update that fixes a fault, often a security hole. |
| Firmware | The built-in software that runs a device such as a printer or a camera. |
| BIOS | The first program a computer runs when it starts. UEFI is its newer form. |
| Brute force | Trying many passwords until one works. |
| Dictionary attack | Trying common words and passwords from a list. |
| Privilege | The power a user has, such as the right to install software. |
| Lockout | Blocking an account for a while after too many wrong passwords. |
| Network | Computers and devices linked so they can share data. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name four common weak points, say how an attacker uses each, and give the controls that fix them.
Starter: identify, protect, detect
Have a go
Starter: identify, protect, detect
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Weak point 1: missing patches, firmware and updates
Attackers read the same notes as defenders. When a fix comes out, they build an attack for firms that have not installed it.
Controls:
- Patch manager software tracks every device and installs updates.
- Track network traffic to spot devices that behave oddly or are out of date.
- Test groups: try an update on a few devices first, then roll it out.
Firmware counts too. A camera with old firmware is a hole nobody sees.
Run: list waiting updates
apt list --upgradable 2>/dev/null | head -3A command for the lesson’s lab terminal. It is shown here and not run.
What you should see
Note
The word Listing, then any packages with a newer version ready. An empty list is good. A long list is a lot of open windows. On Windows the patch manager does the same job for the whole firm.
Weak point 2: password weaknesses
Common faults: missing passwords, weak ones, default ones, and no lockout. With no lockout, an attacker can try millions of guesses: brute force, or a dictionary attack from a list of common words.
Controls:
- Minimum rules in line with NCSC guidance: favour length (many firms say 12 or more), block common passwords, and let people use a password manager. Odd symbols add little.
- A password reset policy: reset on a suspected leak, and when a default is found.
- Lockout after a few wrong tries.
Check: patches and passwords
Have a go
Check: patches and passwords
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.