Updates and Antivirus: Why and How

Your accounts are now better protected, but every account is reached through a device, and devices are made of software, which always contains mistakes. Updates fix those mistakes, and antivirus tools catch what slips through. In this lesson you will learn why updating is the single most effective thing you can do for a device, how to make it painless, and what a security tool can and cannot do for you.

In Chapter 1 you saw that attackers like known flaws, those that already have a fix that people simply have not installed. This lesson is about taking that easy win away from them.

Why software has flaws

Modern programs contain millions of lines of code written by humans, so mistakes are unavoidable. Some of those mistakes are security vulnerabilities: places where a program can be made to do something its authors never intended, such as running a stranger's code. Researchers, companies and sometimes criminals look for them constantly.

When a vulnerability is discovered and the maker publishes a fix, it is often listed in a public catalogue so that everyone can identify it. The best known is the CVE system (Common Vulnerabilities and Exposures, see cve.org), with detailed records in the US National Vulnerability Database (nvd.nist.gov). You will meet them again later in this learning path. For now, what matters is the timeline:

1. A flaw exists in a program.
2. Someone discovers it, and the maker prepares a fix.
3. The fix is published as an update (or "patch").
4. Attackers study the update to understand what was fixed, and build tools to exploit it on devices that have not yet been updated.

The window between steps 3 and your installation of the update is the period when you are most exposed. Shortening it is a very powerful protection. Many widespread attacks over the years have succeeded on flaws that were fixed months earlier.

What to keep updated

Do not stop at the operating system. The full list looks like this:

• The operating system of your computers, phones and tablets.
• Your web browser and its extensions. The browser is the program most exposed to the internet, so it deserves special attention.
• Applications: office tools, PDF readers, messaging apps, media players.
• Your router and other connected devices: home router, smart TV, camera, printer, game console. These are often forgotten, and they sit permanently on your network.
• Firmware: the low-level software inside devices, which also receives security updates.

Making updates painless

People postpone updates because they interrupt work. The solution is to schedule and automate them.

• Turn on automatic updates for the operating system, the browser and your apps. Security updates should never depend on your memory.
• Choose a convenient time, for example overnight while the device is charging and connected.
• Restart when asked. Some updates only take effect after a restart. A computer that has been "waiting for a restart" for weeks is still vulnerable.
• Do a monthly check on devices that do not update by themselves, such as a router or an old tablet.
• Remove what you do not use. An application that you never open still needs updates and still adds to your attack surface.

End of life: when updates stop

Every product has a support period. After that, the maker stops publishing security fixes and the device becomes steadily more dangerous, because new flaws are found but never repaired. Typical cases include old phones that no longer receive updates, old operating systems, and routers abandoned by their manufacturer.

If a device you rely on reaches the end of its support, you have three options: replace it, restrict it to non-sensitive uses (for example, a tablet used only to display recipes, never for banking), or isolate it from the rest of your network. Before buying a new connected device, check how long the maker promises to provide updates.

Antivirus and security tools

An antivirus (today more often called an "endpoint protection" or "security suite") is a program that scans files and activity for signs of malware. It does this in two main ways:

• Signatures: comparing files to a large list of known malicious samples.
• Behavior analysis: watching for suspicious actions, such as a program suddenly encrypting hundreds of files.

What it does well: blocks many known threats, scans downloads and attachments, warns about dangerous websites, and can catch the quiet infections that you would never notice.

What it cannot do: stop you from giving your password to a fake site, make up for an unpatched system, or detect every brand-new threat. Think of it as a smoke detector: indispensable, but not a substitute for being careful with the stove.

Do you need to buy one?

Recent operating systems include a decent built-in security tool, switched on by default, and for many home users that is a reasonable baseline when it is kept enabled and up to date. A third-party suite can add features (extra layers for banking, family controls, identity monitoring), but it is not automatically better. If you choose one:

• Get it from the vendor's official website or your operating system's official store.
• Install only one real-time antivirus, because several together conflict and slow the device.
• Be suspicious of any "cleaner" or "optimizer" that appears from a pop-up or a link in a message. Fake security tools are a common way to deliver malware, as seen in the fake support scams of Chapter 1.

The French agency ANSSI and the platform cybermalveillance.gouv.fr publish clear, free guidance on these basics, and similar resources exist in most countries.

Other built-in protections to keep on

• The firewall: a filter that controls which connections can reach your device. It is on by default on most systems, and you should leave it that way.
• Browser safe-browsing warnings about dangerous sites and downloads.
• The standard user account: for everyday use, avoid working with an administrator account. If something malicious runs, it will have fewer rights. Keep the administrator account for installations and system changes.

Safe downloading habits

• Install software only from the official website of the maker or the official store of your system.
• Avoid cracked software, "keygens" and pirated copies. They are one of the most common ways to receive a trojan.
• Be wary of fake update banners on web pages. Real updates come through your system's update tool, not through a pop-up.
• Check what you are about to install: the name of the publisher, the number of users, and recent reviews.

Your turn

Exercise. Perform a ten-minute update audit on your main computer and your phone. Check that automatic updates are on, install any pending update, restart if required, and check the status of the built-in security tool.

See a solution

1. Open your system's update settings. Confirm that automatic updates are enabled and install pending updates; restart if asked.
2. Open the browser's "About" page, which triggers a check for updates, and restart the browser if needed. Do the same for key applications.
3. Open the security center and verify that real-time protection and the firewall are on, and run a quick scan.
4. List the devices you forgot: the router, the TV, a tablet, a camera. For each, note whether it still receives updates. Plan a replacement or a restriction for any that do not.
5. Find the oldest app on your phone that you never use, and uninstall it.

Add to your Security Notebook

Create the heading "3. Devices". Add a table with each of your devices, its update status (automatic or manual) and the end-of-support concerns. Note the date on which you will check the router.

An updated device is harder to break into remotely. But what if someone has the device in their hands? That is the subject of the next lesson.