1.1 Meaning of Terms

Every technician who installs, secures or audits software must first speak the same language as vendors, auditors and security teams. A term such as "patch", "licence" or "vulnerability" has a precise meaning, and mixing them up leads to wrong decisions. For example, a county revenue office that confuses an update with a licence renewal may leave its billing system unprotected while believing it is fully covered. This topic defines the key terms used throughout the unit, and later topics apply them in detail.

Core computing terms

These terms describe what software is and how it relates to the machine that runs it. Understanding them separates the physical equipment from the instructions that make it useful. For example, when a hotel front desk computer fails to boot, the technician must decide whether the fault lies in the hardware, the firmware or the software.

• Software: The set of instructions, programs and related data that tell a computer what to do. It is intangible: it cannot be touched, but it can be stored, copied and executed.
• Computer program: A complete set of instructions written to perform a specific task, such as calculating payroll or printing a receipt. A program is one piece of software, and several programs together often form a software package.
• Source code: The human-readable instructions written by a programmer in a programming language. A developer at a software company writes source code before it is converted into a form the computer can run.
• Executable: The machine-readable form of a program that the computer can run directly, for example a file ending in .exe on Windows. Users normally receive the executable and not the source code.
• Hardware: The physical parts of a computer system, such as the processor, memory, storage drive, keyboard and monitor. Hardware does nothing useful without software to direct it.
• Firmware: Permanent or semi-permanent software stored on a hardware device, such as the program inside a router or a printer. It sits between hardware and ordinary software and is updated less often.
• Version: A numbered release of a software product, for example 2.4.1. Version numbers show which features and fixes a given installation contains, which is essential when checking whether a system is up to date.

Software ownership and licensing terms

Software is intellectual property, and the person who writes it keeps rights over how it may be used. A licence is the legal permission that sets those conditions. Organisations such as farms, banks and contractors must understand these terms so that every installed program is used legally and can be supported or updated by its owner.

• Licence: A legal agreement that grants a user the right to install and use software under stated conditions. The conditions may limit the number of users, the number of computers or the period of use.
• End User Licence Agreement (EULA): The licence text that a user accepts during installation. Ignoring it is risky, because it may restrict copying, sharing or commercial use.
• Proprietary software: Software whose source code is kept private by the owner and which is normally sold or leased. Example: a contractor buys a licence for a design program and may not copy it to other computers.
• Open-source software: Software whose source code is published and may be studied, modified and shared under the terms of its licence. Open source does not always mean free of conditions, because each licence sets its own rules.
• Freeware: Software offered at no cost but still protected by copyright, so the user cannot freely modify or resell it.
• Shareware: Software offered on a trial basis, after which the user must pay to continue using it.
• Software piracy: The unauthorised copying, sharing or use of licensed software. A clinic running one purchased licence on ten computers is pirating software, and it also loses access to official updates.

Software security terms

Software security is the practice of protecting programs and the data they handle from misuse, damage or unauthorised access. The terms below describe how weaknesses in software lead to harm. For example, if a hospital records system has a flaw that an attacker can reach through the network, the flaw is the vulnerability, the attacker is the threat, and the possible loss of patient data is the risk.

• Vulnerability: A weakness in software design, code or configuration that could be used to cause harm. A program that accepts a password of any length without checking it may contain such a weakness.
• Threat: Any person, program or event that could take advantage of a vulnerability, for example a criminal or a malicious program.
• Exploit: A method, tool or piece of code that uses a vulnerability to gain access or cause damage.
• Risk: The likelihood that a threat will use a vulnerability, combined with the damage that would follow. A weakness in a rarely used, offline program carries less risk than the same weakness in an internet-facing banking system.
• Malware: Malicious software designed to damage systems, steal data or disrupt operations, such as viruses, worms and ransomware.
• Patch: A small piece of software released by the vendor to correct a specific fault or close a security weakness.
• Update: A newer release of installed software that may include patches, bug fixes and improved features. The process of checking for and applying them is covered in the topic on security updates.
• CVE (Common Vulnerabilities and Exposures): A public catalogue of known security weaknesses, in which each entry has a unique identifier in the form CVE-year-number. Using the identifier, a technician at a county office can look up the same weakness that a vendor or auditor describes. Researching these entries is covered in the topic on CVE vulnerabilities.

Chapter Summary

This chapter began by clarifying key terms related to software and security, establishing a foundation for understanding the subject. It then explored various types of software, highlighting their distinct roles and functionalities. The classification of software and their specific applications were examined to provide insight into how different software serves diverse operational needs. Factors that influence software selection were discussed, emphasizing considerations such as compatibility, functionality, and security requirements. The chapter proceeded to outline methods for identifying software that requires security measures, stressing the importance of safeguarding critical applications. It also covered approaches to compiling an existing list of installed software within an organization to maintain visibility and control. The necessity of regularly checking for software security updates was underscored as a vital practice to mitigate vulnerabilities. Finally, the chapter detailed the process of researching Common Vulnerabilities and Exposures (CVE) for the listed software, enabling proactive identification and management of security risks.