Chapter 7 — Safe software installation | Technical Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Safe software installation

Lesson map

Lesson 07 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Trusted sources"]
  N2["7.2 Verifying downloads"]
  N3["7.3 Approving software"]
  N4["7.4 Recording"]
  N5["Browser extensions and unused software"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Trusted sources"]
  N2["7.2 Verifying downloads"]
  N3["7.3 Approving software"]
  N4["7.4 Recording"]
  N5["Browser extensions and unused software"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX025"]

[Learning outcomes]
    |
    v
[7.1 Trusted sources]
    |
    v
[7.2 Verifying downloads]
    |
    v
[7.3 Approving software]
    |
    v
[7.4 Recording]
    |
    v
[Browser extensions and unused software]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) choose trusted sources; (2) verify downloads; (3) record installed software.

7.1 Trusted sources

Software should come from the vendor's official site, the Microsoft Store or the supplier's managed catalogue. Free tools from download sites often bundle unwanted programs, which is how the adware arrived. At Harlow & Pike, a staff member downloaded a free PDF tool from a download site, and adware came with it. Using official sources reduces that risk. Nadia explains the change in a short note to staff, with the catalogue as the easy alternative. The supplier removed the adware and the PDF tool it came with, and replaced the tool with the vendor's official reader from the catalogue.

7.2 Verifying downloads

Many vendors publish a checksum for each download. Nadia shows staff how the supplier checks a downloaded installer's SHA-256 hash against the vendor's published value before adding it to the catalogue. A matching hash shows the file was not corrupted or replaced. The hash check confirms that the installer is the one the vendor published, not a copy changed on the way. Staff do not need to check hashes themselves, since the supplier does it before adding software to the catalogue. Nadia records the hash with each catalogue entry, so the check can be repeated if needed.

7.3 Approving software

New software requests go to Lena, who checks the business need, and to the supplier, who checks the source and licence. Approved software goes into the catalogue. Two checks mean software is both needed and safe to install. Lena knows what work staff do, while the supplier knows where software comes from and whether the firm may use it. Approved software appears in the self-service catalogue, so staff can install it without admin rights. Requests are logged with the decision and date, and a refused request receives a reason and, where possible, an approved alternative.

7.4 Recording

The supplier keeps a list of approved software and versions. CIS Controls v8 Control 2 asks organisations to keep a software inventory and allow only authorised software. The list lets the supplier and Nadia spot software that should not be there, such as the free antivirus she found. Each entry records the version, source and who approved it. Nadia compares the list with what is installed on a few PCs each month, and anything unexpected is checked with the user and Lena. The list also helps the supplier know what to update when a vendor releases a fix.

Browser extensions and unused software

Browser extensions can read every page a user visits, including client portals. The supplier allows only approved extensions, such as the password manager, and other requests follow the normal software process. Nadia explains that free coupon or download extensions often collect browsing data, which matters for a firm handling client finances. Unused software is another quiet risk: every installed program needs updates even if nobody opens it. Nadia lists programs not opened in six months and, with each user's agreement, the supplier removes them. Fewer programs mean fewer updates to track and fewer places for flaws to hide.

Worked example

A request for a screen-capture tool is approved, the installer's hash is checked against the vendor's page, and it appears in the catalogue the next day.

Synthetic case. Events are synthetic.

Errors and limits

A hash only helps if it comes from the vendor's official page, not the same download site.

Exercises

EX025 — Bundled software. Why are third-party download sites risky? Rubric: 3 = bundled unwanted programs;; 2 = risky;; 1 = vague;; 0 = none.
EX026 — Hash check. What does a matching SHA-256 hash show? Rubric: 3 = file unchanged from vendor's;; 2 = integrity;; 1 = vague;; 0 = none.
EX027 — Approval roles. Who approves software, and what does each check? Rubric: 3 = manager need, supplier source/licence;; 2 = both;; 1 = one;; 0 = none.
EX028 — CIS link. Which CIS Control covers software inventory? Rubric: 3 = Control 2 with description;; 2 = 2;; 1 = wrong;; 0 = none.

Synthesis

Trusted sources, verification and approval keep unwanted software out.

Continue studying — chapter 07 of 18

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →