A strong door and an open window
A small office has a strong front door with a good lock. But the back window is always open.
Computer systems are the same. A weak rule or an old machine is the open window.
Today you find the open windows: weak processes, and parts that are out of date.
By the end of this lesson
Note
I can name the technical weaknesses in a system and say how each one lets an attacker in.
Key words
| Word | What it means |
|---|---|
| Vulnerability | A weakness an attacker can use. |
| Encryption | Scrambling data so only the right key can read it. |
| Weak encryption | Scrambling that is old or simple, so an attacker can unscramble it. |
| Password policy | The rules for how passwords must be made and changed. |
| MFA | Multi-factor authentication: two or more proofs of who you are. |
| Firmware | Software stored inside a device, such as a router or a printer. |
| Legacy system | An old system that is still in use. |
| Zero-day | A weakness nobody has fixed yet, because the maker has just learned of it. |
| Patch | A small update that fixes a weakness. |
| Unsupported | No longer updated by its maker. |
| Network | Computers joined together so they can share data. |
| Firewall | A guard that decides which internet traffic may pass. |
| Authentication | Proving you are who you say you are. |
| Router | A device that passes traffic between networks. |
The cells students fill in are left blank in this preview.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: weak security processes
A process is a rule or habit. Three weak ones:
Weak encryption. Old or simple scrambling, which an attacker can undo. Stolen data is then readable.
An inadequate password policy. Short passwords, no changes after a breach, the same password reused. Attackers guess them.
No MFA. A stolen password is then enough to get in.
Weak process, impact and fix
| Weakness | What can go wrong | The fix |
|---|---|---|
| Weak encryption | Stolen data is unscrambled and read | Use current, trusted encryption |
| Poor password policy | Easy guesses, reused passwords | Long passphrases, no reuse, a banned list |
| No MFA | One stolen password opens everything | Turn on MFA for every account that can |
The cells students fill in are left blank in this preview.
Check: weak processes
Have a go
Check: weak processes
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.