Lesson 1.3: Why it matters: lessons from real incidents
Three well-known incidents and the simple failures behind them: a ransomware outbreak that spread through unpatched Windows machines (WannaCry, 2017), a breach through a web framework that had a patch available for months (Equifax, 2017), and a pipeline shut down after a break-in with a single password (Colonial Pipeline, 2021). In the lab you review a company's inventory with the same three questions: what is unpatched, which accounts lack multi-factor authentication, and did last night's backup work?
18 min
You will learn to
- Describe three real incidents and what went wrong in each
- Explain patch, ransomware, data breach and multi-factor authentication
- Find unpatched systems in an inventory
- Find accounts without MFA and failed backups
Key terms
- Vulnerability
- A weakness in software, configuration or a process that someone could use to break confidentiality, integrity or availability.
- Patch
- An update from the vendor that fixes a vulnerability or bug.
- Ransomware
- Malicious software that encrypts a victim's files and demands payment for the key.
- Data breach
- An incident in which protected data is seen, copied or taken by someone not authorised to.
- Multi-factor authentication (MFA)
- Proving who you are with two or more different kinds of evidence, such as a password plus a code from your phone.
- Backup
- A copy of data kept separately so it can be restored after loss, damage or ransomware.
← What is Linux? · All lessons · Linux distributions →