TechKnowSurge
CompTIA A+ Core 2 1.7 CompTIA Tech+ 3.3 CompTIA A+ Core 2 2.1 CompTIA Tech+ 6.6 CompTIA Server+ 3.2
VideoComputeFree

Software Distribution Methods

Software can be obtained and installed through multiple sources, including websites, app stores, package repositories, removable media, file sharing, and centralized management systems such as MDM solutions and Windows Update Services. Understanding the available distribution methods and how to verify software legitimacy is essential for safe and effective software deployment.

Complete this video to capture a CTF flag worth 1 point.

About this video

Software can be distributed and installed through a wide range of sources, including vendor websites, app stores, operating system update mechanisms, package repositories, removable media such as flash drives, shared network locations, and centralized management systems. On enterprise networks, tools like Windows Server Update Services, Group Policy, and Mobile Device Management platforms allow administrators to push software and updates to multiple devices from a single point of control. App stores, long standard on mobile devices, have become increasingly common on desktop and laptop operating systems as well, offering a streamlined installation experience directly from a curated platform. When downloading software from the web, files may arrive in several formats depending on the platform and the publisher. Executable files such as .exe and .msi installers run directly on Windows systems, while .pkg files serve a similar purpose on macOS. Disk images in ISO or DMG format must be mounted before installation can proceed. Scripts such as .bat or .ps1 files depend on a host environment — Command Prompt or PowerShell, respectively — to execute. Large applications or multi-component packages are often delivered in compressed archive formats that must be extracted before use. Regardless of the distribution method or file format, verifying software integrity and authenticity is a critical step before installation. Sourcing software directly from the original equipment manufacturer or official publisher, rather than third-party sites, is the most reliable way to avoid tampered or malicious files. Code signing certificates provide a publisher-verified digital signature that can be inspected during installation, while cryptographic hashes allow users to confirm that a downloaded file has not been altered. Both mechanisms serve as a fingerprint that validates the software matches what the legitimate publisher originally released.

What you'll learn

What's covered

Software Installation Sources

Aligned to

CompTIA A+ Core 2
1.7 Given a scenario, apply application installation and configuration concepts.
2.1 Summarize various security measures and their purposes.
CompTIA Tech+
3.3 Explain the purpose and proper use of software.
6.6 Explain common uses of encryption.
CompTIA Server+
3.2 Given a scenario, apply server hardening methods.

Key terms

App Store
A digital marketplace that allows users to browse, download, and install software applications on desktop, tablet, or mobile devices.
Package Repository
A centralized storage location from which software packages can be retrieved and installed, commonly used in Linux environments.
Removable Media
Portable storage devices such as USB flash drives, SD cards, and optical discs that can be detached from a computer and used to transport, distribute, or back up data.
Mobile Device Management
MDM
Mobile Device Management is a software solution that enables organizations to remotely enroll, configure, monitor, and enforce security policies on employee mobile devices, including the ability to wipe lost or compromised devices.
Original Equipment Manufacturer
OEM
A company that produces hardware or software components that are purchased by another company and sold under that company's brand name. In IT, OEM refers to bundled or licensed versions of software (such as Windows) sold with new hardware.
Code Signing
A process in which software is digitally signed by its publisher using a certificate to verify its authenticity and integrity.
Hash Function
A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
Digital Certificate
An electronic document that uses a digital signature to bind a public key with an identity.

Topics

Software Distribution Package Management Code Signing Hash Validation Mdm Endpoint Security Operating Systems

Transcript

Where software comes from

Of course, to install software we first of all need to have access to the software. But how do we gain access to software? There are a lot of sources where we can download different distributions of software.

  • Websites are a very common one. We'll go to a website, download software, and then install that software.
  • An app store, which is becoming more and more popular on our desktop machines and our laptops, but has always been very popular on tablets and phones. On our phone we can go to the app store and then use that app store to really easily install software from it.
  • Updates within different software. We can get into the software and do an update from there.
  • In-software updates, like for your Windows machine, where you'll get software that gets installed off of that.
  • Package repositories. If you go onto a Linux machine, you can add a repository and then you can install from that repository.
  • Removable media, things like flash drives that we can plug in and install software from.
  • File sharing, where I create a shared file and then share it out to other machines so that it can install off of that. I'll actually do a lesson on that.
  • Managed systems, things like Windows update services that we could use.
  • Group policies, that we can push out software from.
  • Mobile device management, or MDM. Mobile device management would be a solution that we could implement to actually push out updates.

All of this is just to say that there are things that we could install on a system that manages other devices and allows us to push out software to other devices. So there are lots of options on how we distribute or download these from these different sources, and how we distribute it amongst our machine or other machines on our network.

Installing from the app store

Let's take a look at the app store on Windows. I'm going to click the start button here, and we've got the Microsoft Store. I'm going to open that up, and let's say I want to install Firefox. So what I'm going to do is up here I'm just going to do a search for Firefox, and then there's Mozilla Firefox. I'm going to hit that and I'm going to get that. So it's going to go through the process of installing it through here. It's nice, slick and easy when you install it through the store. Same thing if I'm doing it on a tablet or my phone: it's just really easy to install and it goes through the process. I'm going to pin that to the taskbar, because that's where I like it. And then I'm going to skip the step, I'm not going to save anything at this point. So there it is, that's how to install something through the app store on the Microsoft machines.

Websites, OEMs and third parties

When it comes to websites, there is an OEM, which is the original equipment manufacturer. We also have other distributors, and then there's third parties. So for instance, if I buy a Dell laptop, I might buy it from another company. I might buy it on Amazon or CDW, so I buy it from this other company, and that other company might have software and distribute software that way. Or I could go directly to Dell to do that. Or perhaps I'm looking at the components inside of this computer. For instance, Intel chips a lot of times are within these Dell laptops, and so I could go to Intel and download a driver for that. Or perhaps there are other third-party sites that will have the same software as well.

I really am careful about installing something from a third-party site. I really try to go directly to more official sources to get whatever software I'm downloading, especially when it comes to things like drivers or operating systems, or that type of stuff. I would be very careful about going to these third-party sites.

Original equipment manufacturer is whoever originally created the equipment. So for instance, let's say I buy a thumb drive and I buy it from a certain company. The original equipment manufacturer is that company. So if I wanted to get a driver or certain software that is compatible with whatever device I bought, going to that source, that's the original equipment manufacturer. As much as possible, that's what I try to use when I'm getting software.

File formats software arrives in

When I go to a site and download something, it can come in lots of different formats. Perhaps it's an ISO or DMG image, that's a disk image, and so maybe it's set up to be this other format in which I need to figure out then how to mount that ISO image in order to install off of that. A lot of times it's an EXE or MSI or PKG, or these other formats that we can download from the site, and a lot of times they're just directly executable. We can execute them and that installs the program. So a lot of them would be like install.exe, and then we double click on it and it installs that software.

There's also cis.imp.dll, that can have different components to install parts and functionality onto our systems.

There are also scripts. Scripts can be launched, and they're like little tiny programs, just a few lines of code. I guess we could consider them like little mini programs, but they use other software, whereas an .exe is standalone. A .bat would require something like a command prompt in order to launch and do this, or a .ps1 would require PowerShell. So we've got these scripts that we can use, and what it does is it helps go through the install process and install things.

We also have some of these programs that can get quite large, or maybe there's lots of components to it and we need to group it all into one. And so they get zipped into a file, or compressed into a file. So here are some file formats that have to do with compressing. We might compress a program, or like I say a bundle of this software, in order to be able to ship it across or download it or get it onto our machine.

Making sure the software is legitimate

We should also make sure that this software is legitimate. That would be like going to the original equipment manufacturer to download a driver, so that we're not getting it from some third party that we're not aware of, that we don't know is necessarily trustworthy.

But another component to that is also checking the software for its compatibility. Most of the legitimate software is going to have some sort of code signing that is going to do a verification to make sure that it's the proper code. Or a lot of times, especially with Linux, they'll have hashes that will compare the hash to that software to make sure that it's legitimate. Essentially, both of these are like a fingerprint that says, "Okay, is this the software that I really was truly wanting, from a legitimate source?" And so the fingerprint helps validate that.

Downloading software from the source

Let's take a look at downloading some software. What I'm going to do is open up Edge. This is a fresh install of this machine, and I'm not a big fan of Edge, so what I'm going to do is download Chrome. I'm going to say Chrome download and then hit enter here. This is where Google comes up at the top, and this is where I say go directly to the source. So this is going directly to google.com. A lot of times there are advertisements at the top; I'll skip all the advertisements or promotions that they have, and then I won't get anything down here that could be other people's sites. I like to go straight to the source. So this is straight to the source, there's no third party here, and I'm going to download Chrome today.

So I'm going to click on that, and this is where I'm going to get the source from. Then I will download Chrome, so I'm going to say download Chrome. What many of these software companies have done is they're starting to get like little tricky stuff that's in here. So, help make Google Chrome better by automatically sending usage data. I typically don't do the usage data, and it's something that you select usually when you're installing the program, but they're putting it here instead, because a lot of users aren't paying attention to this. And so since they're not paying attention to it, they can get you to install this. So what I'm going to do is uncheck that. Another thing I've noticed is that a lot of these sites will also have third-party stuff that they will install with it, so I would watch out for any of these check boxes that make you check box it here.

I'm going to click on download Chrome and it's going to download it. Then let's see what kind of file it is. It says chrome setup.exe. I'm going to actually open this folder location. I don't need Edge at this point in time. So here's the Google Chrome setup right here, and as I mentioned, it's an .exe file.

Just to show you that this is an .exe, what I'm going to do is actually get into settings and we're going to change the extensions part of this. So, extension, and I'm going to show file extensions. We'll click on that, and then let's go ahead and show it, so we're going to say turn that on. As you can see, this is an .exe. So that's one of the file formats that will do the installs.

Code signing at install time

I'm going to now double click this to do the install. This window pops up. It's the user account control, and one of the reasons why it pops up is to allow us to verify who is the publisher here. This is what I mentioned about that fingerprint, this is what I mentioned about the code signing. This is a certificate showing the code signing, and I can show more detail and look at some of the details of this. But the biggest thing I'm concerned with is, who's this coming from? And it's Google LLC. So I have a certain amount of confidence now that this is coming from the right source. I'm going to accept this to do the install. This is just one example of that fingerprint that we have of the software, to make sure we have the right software.

In fact, I could even see the certificate if I wanted to. I could click on this, show information about the publisher certificate. If you want to see the actual fingerprint that I mentioned, the thumbprint that I mentioned, here's the thumbprint right here. Well, this is the thumbprint of the certificate, but essentially this is what helps validate that this is the proper code, the proper executable program to install, based off of that publisher.

So I'm going to accept this and get the install going. Now that I've got Google installed, one thing that I like to do is, well, I don't like it on my desktop, so I'm going to erase the desktop version of this. I can close that out, and Chrome is now installed.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →