If the attacker can complete successful Reconnaissance, Weaponisation and delivery of an attack, then they’ll move on to the Exploitation phase, closely followed by Installation. CyberSecurity training is one of the prime user-defence methods we employ to prevent exploitation and installation. Likewise, the Essential Eight topic of controlling Administrator Privileges in our previous module also helps prevent exploitation and installation of the weaponised exploit package.

Some Exploitation preventative habbits include:

1. Watch for suspicious download prompts

Your computer shouldn't suddenly ask to install something while you're browsing
Don't click "Yes" or "Allow" without understanding what's happening
When in doubt, close the browser and report it to IT

2. Be wary of unexpected software updates

Real updates usually come through your IT department or official update mechanisms
Pop-ups claiming "Your Flash Player needs updating" or "Your computer is running slow - click here to repair" are often fake

3. Report suspicious activity immediately

If something seems off - weird pop-ups, unexpected behavior, strange requests - tell your IT person right away
It's better to report a false alarm than let an attack continue - You're not being paranoid; you're being protective

While much of the Exploitation and Installation topic is really technical and well outside of our user focus, all digital device users have a role to play in preventing Installation:

1. Never ignore security warnings

If your antivirus alerts you, don't dismiss it
If Windows User Account Control asks "Do you want to allow this app to make changes?" and you didn't start anything - say NO

2. Don't run files from untrusted sources

Downloaded something and not sure about it? Don't double-click it - ask IT to check it first
Be especially careful with .exe, .bat, .scr, .vbs, or other executable file types
Files can masquerade as PDFs or documents but actually be programs

3. Watch for requests for Administrative Privileges

Normal activities shouldn't need admin rights
If something asks for Administrative permissions unexpectedly, that's a red flag

4. Be suspicious of "helpful" tech support

Never let someone remotely access your computer unless YOU initiated contact through official channels
Scammers often call claiming to be tech support and ask to install "fix" software

5. Notice unusual computer behavior

Computer running much slower than normal?
Programs opening on their own?
New toolbars or icons you didn't install?
These could be signs something was installed - report immediately

The reason we’ve kept our Scam and Phishing module free and accessible is so people can refresh their skills on a regular basis – If you can intercept an attack before Exploitation and Installation, then the attack is over, finished and unsuccessful.

Lesson 4. Exploitation and Installation