[Reading Time - 2 minutes 37 seconds]
Yesterday I decided to clean out the closet in my study. Now, for better or for worse, I am one of those types of people who tend to hold on to things that I no longer use until I know for certain I will not use it again. Once I am assured that I don't need it I can then give it away, recycle it, or toss it. Unfortunately, that usually results in things piling up that should have gone out the door a long time ago. I guess that's why yesterday I came across a CD with Microsoft Windows XP and a set of CDs of Microsoft Office 2007. These are now gone, and my closet is a much happier place.
But cleaning out a closet is one thing. Do I need to also clean out my computer and remove software that I no longer am using? With the size of my hard drive and the amount of RAM installed, I certainly have the room to keep it. Should I? And what about my smartphone? What about all those apps I downloaded but only used a few times and have not even looked at for months? Does it matter if I have programs or apps on my devices that I don't need?
The answer is yes, it does matter. Why? Because those unnecessary programs and apps can provide a larger "attack surface" for attackers to attempt to manipulate. This is one reason why several security professionals shun installing antivirus (AV) software on their devices. The AV software itself presents a very large attack surface. Instead of just trying to find a vulnerability in the browser or operating system, attackers can use vulnerabilities in AV to launch attacks.
Instead of stuffing my computer or smartphone with unused programs or apps, my approach instead should be summarized in the phrase "Skinny Footprint." That is, my device should only have installed that software that is used and needed; everything else should be removed, like cleaning out a closet.
Consider the ubiquitous PDF reader program.
PDF (Portable Document Format) is a very popular file format for electronic documents. Almost all users have some type of PDF viewer software that allows them to read a PDF document; one of the popular viewers is Adobe Reader. And because PDFs are so popular with users, PDFs are also popular with attackers to deliver malware to a victim’s computer.
Most users overlook that Adobe Reader is not just a program to read PDF documents. Adobe Reader is a massive program, with many of the same components as its cousin Adobe Acrobat, which is used to create PDF documents. Some of the components of Adobe Acrobat include an embedded email server, a document lifecycle management system, a digital rights management (DRM) client, a document tracking system, a form generation tool, and audio and video playback capabilities, along with the ability to display other formats like CAD in its viewer. With all those functions, it's easy to see how vulnerabilities are routinely exposed in Adobe Acrobat and Adobe Reader by attackers.
Let's go back to our Skinny Footprint idea for a moment.
If all you need is the means to read a PDF document, do you need Adobe Acrobat or Adobe Reader, with their multitude of embedded features? The answer is almost certainly no, you do not. There are now many lightweight and free PDF readers that do not have these unused features. You could use one of them instead. And some are so slim that they do not even have to be installed but will run off a USB flash drive.
Yet we can even go further than that. Do we even need a separate PDF reader on our computers anymore? All modern web browsers, like Google Chrome and Microsoft Edge, already have built-in PDF readers. All you do is drag your PDF file onto a tab in the browser and it automatically is displayed. By using the web browser instead of a separate PDF reader we have reduced our attack surface. We have started down the road to our Skinny Footprint.
The fewer programs and apps we have, the less of an attack surface we give to attackers. A Skinny Footprint is just another way that we can keep attackers out and keep our devices safe.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.