Software can be obtained and installed through multiple sources, including websites, app stores, package repositories, removable media, file sharing, and centralized management systems such as MDM solutions and Windows Update Services. Understanding the available distribution methods and how to verify software legitimacy is essential for safe and effective software deployment.
Software Installation Sources
Of course, to install software we first of all need to have access to the software. But how do we gain access to software? There are a lot of sources where we can download different distributions of software.
All of this is just to say that there are things that we could install on a system that manages other devices and allows us to push out software to other devices. So there are lots of options on how we distribute or download these from these different sources, and how we distribute it amongst our machine or other machines on our network.
Let's take a look at the app store on Windows. I'm going to click the start button here, and we've got the Microsoft Store. I'm going to open that up, and let's say I want to install Firefox. So what I'm going to do is up here I'm just going to do a search for Firefox, and then there's Mozilla Firefox. I'm going to hit that and I'm going to get that. So it's going to go through the process of installing it through here. It's nice, slick and easy when you install it through the store. Same thing if I'm doing it on a tablet or my phone: it's just really easy to install and it goes through the process. I'm going to pin that to the taskbar, because that's where I like it. And then I'm going to skip the step, I'm not going to save anything at this point. So there it is, that's how to install something through the app store on the Microsoft machines.
When it comes to websites, there is an OEM, which is the original equipment manufacturer. We also have other distributors, and then there's third parties. So for instance, if I buy a Dell laptop, I might buy it from another company. I might buy it on Amazon or CDW, so I buy it from this other company, and that other company might have software and distribute software that way. Or I could go directly to Dell to do that. Or perhaps I'm looking at the components inside of this computer. For instance, Intel chips a lot of times are within these Dell laptops, and so I could go to Intel and download a driver for that. Or perhaps there are other third-party sites that will have the same software as well.
I really am careful about installing something from a third-party site. I really try to go directly to more official sources to get whatever software I'm downloading, especially when it comes to things like drivers or operating systems, or that type of stuff. I would be very careful about going to these third-party sites.
Original equipment manufacturer is whoever originally created the equipment. So for instance, let's say I buy a thumb drive and I buy it from a certain company. The original equipment manufacturer is that company. So if I wanted to get a driver or certain software that is compatible with whatever device I bought, going to that source, that's the original equipment manufacturer. As much as possible, that's what I try to use when I'm getting software.
When I go to a site and download something, it can come in lots of different formats. Perhaps it's an ISO or DMG image, that's a disk image, and so maybe it's set up to be this other format in which I need to figure out then how to mount that ISO image in order to install off of that. A lot of times it's an EXE or MSI or PKG, or these other formats that we can download from the site, and a lot of times they're just directly executable. We can execute them and that installs the program. So a lot of them would be like install.exe, and then we double click on it and it installs that software.
There's also cis.imp.dll, that can have different components to install parts and functionality onto our systems.
There are also scripts. Scripts can be launched, and they're like little tiny programs, just a few lines of code. I guess we could consider them like little mini programs, but they use other software, whereas an .exe is standalone. A .bat would require something like a command prompt in order to launch and do this, or a .ps1 would require PowerShell. So we've got these scripts that we can use, and what it does is it helps go through the install process and install things.
We also have some of these programs that can get quite large, or maybe there's lots of components to it and we need to group it all into one. And so they get zipped into a file, or compressed into a file. So here are some file formats that have to do with compressing. We might compress a program, or like I say a bundle of this software, in order to be able to ship it across or download it or get it onto our machine.
We should also make sure that this software is legitimate. That would be like going to the original equipment manufacturer to download a driver, so that we're not getting it from some third party that we're not aware of, that we don't know is necessarily trustworthy.
But another component to that is also checking the software for its compatibility. Most of the legitimate software is going to have some sort of code signing that is going to do a verification to make sure that it's the proper code. Or a lot of times, especially with Linux, they'll have hashes that will compare the hash to that software to make sure that it's legitimate. Essentially, both of these are like a fingerprint that says, "Okay, is this the software that I really was truly wanting, from a legitimate source?" And so the fingerprint helps validate that.
Let's take a look at downloading some software. What I'm going to do is open up Edge. This is a fresh install of this machine, and I'm not a big fan of Edge, so what I'm going to do is download Chrome. I'm going to say Chrome download and then hit enter here. This is where Google comes up at the top, and this is where I say go directly to the source. So this is going directly to google.com. A lot of times there are advertisements at the top; I'll skip all the advertisements or promotions that they have, and then I won't get anything down here that could be other people's sites. I like to go straight to the source. So this is straight to the source, there's no third party here, and I'm going to download Chrome today.
So I'm going to click on that, and this is where I'm going to get the source from. Then I will download Chrome, so I'm going to say download Chrome. What many of these software companies have done is they're starting to get like little tricky stuff that's in here. So, help make Google Chrome better by automatically sending usage data. I typically don't do the usage data, and it's something that you select usually when you're installing the program, but they're putting it here instead, because a lot of users aren't paying attention to this. And so since they're not paying attention to it, they can get you to install this. So what I'm going to do is uncheck that. Another thing I've noticed is that a lot of these sites will also have third-party stuff that they will install with it, so I would watch out for any of these check boxes that make you check box it here.
I'm going to click on download Chrome and it's going to download it. Then let's see what kind of file it is. It says chrome setup.exe. I'm going to actually open this folder location. I don't need Edge at this point in time. So here's the Google Chrome setup right here, and as I mentioned, it's an .exe file.
Just to show you that this is an .exe, what I'm going to do is actually get into settings and we're going to change the extensions part of this. So, extension, and I'm going to show file extensions. We'll click on that, and then let's go ahead and show it, so we're going to say turn that on. As you can see, this is an .exe. So that's one of the file formats that will do the installs.
I'm going to now double click this to do the install. This window pops up. It's the user account control, and one of the reasons why it pops up is to allow us to verify who is the publisher here. This is what I mentioned about that fingerprint, this is what I mentioned about the code signing. This is a certificate showing the code signing, and I can show more detail and look at some of the details of this. But the biggest thing I'm concerned with is, who's this coming from? And it's Google LLC. So I have a certain amount of confidence now that this is coming from the right source. I'm going to accept this to do the install. This is just one example of that fingerprint that we have of the software, to make sure we have the right software.
In fact, I could even see the certificate if I wanted to. I could click on this, show information about the publisher certificate. If you want to see the actual fingerprint that I mentioned, the thumbprint that I mentioned, here's the thumbprint right here. Well, this is the thumbprint of the certificate, but essentially this is what helps validate that this is the proper code, the proper executable program to install, based off of that publisher.
So I'm going to accept this and get the install going. Now that I've got Google installed, one thing that I like to do is, well, I don't like it on my desktop, so I'm going to erase the desktop version of this. I can close that out, and Chrome is now installed.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →