03 — Software Deployment & Integrity Verification — Safe and Guided Software Installation - rafaelribeiro-s/it-support-sysadmin-portfolio GitHub Wiki

📋 Case Study: Software Deployment & Integrity Verification — Safe and Guided Software Installation

🏢 Enterprise Environment Context

Company Name: NexaCorp Solutions Ltd.
Industry: Cloud Financial Services
Ticket ID: INC-804512
Department: Creative & Brand
Requester: Creative & Brand Operations Team

👤 Employee Profile

Full Name: Olivia Bennett
Username: o.bennett
Employee ID: NX-9134
Job Title: Graphic Designer
Department: Creative & Brand
Assigned Workstation: NX-WS-CRT03

🛠️ IT Support Assignment

Assigned Analyst: Rafael Ribeiro
Role: IT Support & Systems Administrator

Software Request

The employee requires an approved image-editing application for legitimate work-related activities.

The requested software must be deployed using a controlled installation process that follows the organization's endpoint security requirements.

The IT Support team must:

Obtain the installer from an official and trusted software source.
Verify the identity and version of the software package.
Validate the installer integrity using SHA-256.
Perform an additional malware/security scan before installation.
Review installation scope and privilege requirements.
Install only the required software components.
Validate the application after installation.
Document the deployment and verification evidence.

The software selected for this lab is GIMP (GNU Image Manipulation Program).

📩 Help Desk Ticket Description

Ticket: INC-804512
Subject: Approved Software Installation — GIMP for Creative & Brand

Request

The Creative & Brand team has requested the installation of an approved image-editing application on workstation NX-WS-CRT03 for Olivia Bennett, a Graphic Designer.

The requested application is GIMP (GNU Image Manipulation Program).

In accordance with the organization's software deployment and endpoint security procedures, the installer must be obtained from an official vendor source and verified before installation.

The IT Support team must validate the installer integrity, perform a security scan, review the installation options, and install only the required software components.

The completed deployment must be validated and documented for audit purposes.

🎯 Key Technical Objectives for the Lab

The purpose of this lab is to demonstrate a controlled and security-conscious software deployment process on a Windows endpoint.

The following objectives must be completed:

Obtain the approved GIMP installer from the official GIMP distribution source.
Record the installer filename, version, architecture, and file size.
Calculate the installer's SHA-256 hash using Windows tooling.
Compare the calculated hash against the vendor-published SHA-256 value.
Perform an additional malware/security scan of the installer.
Review the software installation scope before deployment.
Review the software license agreement.
Select only the required installation components.
Complete the software installation.
Verify that the application was installed successfully.
Document the security verification and deployment evidence.
Record troubleshooting activities and lessons learned.

🧪 Lab Environment

The endpoint security control was implemented and validated on a virtualized Windows workstation representing a corporate Creative & Brand endpoint.

Component	Configuration
Virtualization Platform	Oracle VirtualBox
Guest Operating System	Windows 11 Enterprise
Architecture	x64
CPU	4 vCPUs
Memory	8 GB
Storage	80 GB VDI
Firmware	UEFI
Secure Boot	Enabled
TPM	2.0
Network	NAT
Workstation Name	`NX-WS-CRT03`
Test User	`o.bennett`
User Role	`Standard User`
Administrative Account	`NexaAdmin`

🛠️ Implementation & Evidence Documentation

The software deployment was performed on workstation NX-WS-CRT03 using the standard user account o.bennett.

The implementation followed a controlled software deployment workflow:

Workstation & User Validation
        ↓ 
Trusted Software Source
        ↓ 
Installer Acquisition
        ↓ 
SHA-256 Integrity Verification
        ↓ 
Malware Security Screening
        ↓
Installation Scope Review
        ↓
License & Installation Options
        ↓
Component Selection
        ↓
Installation
        ↓
Post-Installation Validation

The following evidence documents the implementation from the initial workstation and user validation through successful execution of GIMP 3.2.6.

EV-01 — Workstation and User Identity

The workstation identity and active user session were validated before beginning the software deployment.

The following Windows commands were executed:

hostname
whoami

Observed results:

hostname
NX-WS-CRT03

whoami
nx-ws-crt03\o.bennett

The results confirm that the lab was performed on workstation NX-WS-CRT03 using the o.bennett account assigned to Olivia Bennett.

Evidence File:

Validation Result: PASS

EV-02 — Test User Account and Local Group Membership

The o.bennett account was inspected using:

net user o.bennett

The command output showed that the account is a member of the local Users group.

This established the user context before software installation.

Evidence File:

Validation Result: PASS

EV-03 — Administrative Privilege Boundary

The local Administrators group was inspected using:

net localgroup Administrators

The command output showed:

NexaAdmin

The o.bennett account was not listed as a member of the local Administrators group.

This confirms that the software deployment was performed from a standard-user context rather than from a local administrative account.

Evidence File:

Validation Result: PASS

EV-04 — Official GIMP Download Source

Microsoft Edge was opened and the official GIMP website was accessed:

https://www.gimp.org/

The GIMP Downloads page was then opened:

https://www.gimp.org/downloads/

The Windows download section identified GIMP 3.2.6 as the current stable release and provided the official Windows installer for x86_64 and ARM64.

The installer was obtained directly from the official GIMP distribution page rather than from a third-party software repository.

Evidence File:

Validation Result: PASS

EV-05 — Official Windows Installer Selection

From the official GIMP Downloads page, the following Windows download option was selected:

Download GIMP 3.2.6 for x86_64 and ARM64 directly

This action initiated the download of the official Windows installer.

Evidence File:

Validation Result: PASS

EV-06 — Installer Download

The download completed successfully in Microsoft Edge.

The downloaded installer was identified as:

gimp-3.2.6-setup.exe

The installer was then located in the Windows Downloads folder.

Evidence Files:

Validation Result: PASS

EV-07 — Vendor-Published SHA-256 Reference

The official GIMP Downloads page publishes the following SHA-256 hash for:

gimp-3.2.6-setup.exe

Vendor-published SHA-256:

9337cccbc01d4098ee7a3dab215b3afbe6ece99c5287c92441d6f12cf541ebca

This value was used as the reference for local installer integrity verification.

Evidence File:

Validation Result: DOCUMENTED

EV-08 — Local SHA-256 Integrity Calculation

PowerShell was opened and the Downloads directory was accessed:

cd "$env:USERPROFILE\Downloads"

The installer was then confirmed in the directory:

Get-ChildItem .\gimp-3.2.6-setup.exe

The local SHA-256 value was calculated using the Windows Get-FileHash command:

Get-FileHash .\gimp-3.2.6-setup.exe -Algorithm SHA256

Observed result:

Algorithm       Hash
---------       ----
SHA256          9337CCCBC01D4098EE7A3DAB215B3AFBE6ECE99C5287C92441D6F12CF541EBCA

Evidence File:

Validation Result: PASS

EV-09 — SHA-256 Integrity Comparison

The locally calculated SHA-256 value was compared against the value published by GIMP.

Verification Item	Result
Installer	`gimp-3.2.6-setup.exe`
Algorithm	SHA-256
Local	`9337cccbc01d4098ee7a3dab215b3afbe6ece99c5287c92441d6f12cf541ebca`
Vendor Hash	`9337cccbc01d4098ee7a3dab215b3afbe6ece99c5287c92441d6f12cf541ebca`
Comparison	Exact Match
Result	`PASS`

The matching hashes provide evidence that the downloaded installer matched the vendor-published integrity value.

Validation Result: PASS

EV-10 — VirusTotal Security Screening

As an additional security screening step, the downloaded installer was submitted to VirusTotal.

The scan result reported:

0 / 69 detections

The VirusTotal result also displayed the hash associated with the submitted file.

This screening was treated as an additional security check rather than as a replacement for the SHA-256 integrity verification.

Evidence File:

Validation Result: PASS — 0/69 detections reported

EV-11 — Installation Scope Selection

The gimp-3.2.6-setup.exe installer was launched from the Downloads folder.

The setup wizard displayed two installation scope options:

Install for me only (recommended)
Install for all users

The Install for me only (recommended) option was selected.

This was appropriate for the simulated deployment because the requested application was being installed for the specific user o.bennett, who does not have local administrative privileges.

Evidence File:

Validation Result: PASS

EV-12 — Controlled Installation Options

After selecting the per-user installation scope, the GIMP setup wizard displayed:

Customize
Install
Cancel

The Customize option was selected so that the installation configuration could be reviewed before installation.

This avoided immediately accepting the installation without reviewing the available configuration options.

Evidence File:

Validation Result: PASS

EV-13 — License Agreement Review

The GIMP setup wizard displayed the License Agreement.

The license information was reviewed and the setup process was continued using Next.

Evidence File:

Validation Result: DOCUMENTED

EV-14 — Installation Directory

The setup wizard displayed the destination directory:

C:\Users\o.bennett\AppData\Local\Programs\GIMP 3

The default per-user installation directory was retained.

This location is within the o.bennett user profile and is consistent with the previously selected Install for me only installation scope.

Evidence File:

Validation Result: PASS

EV-15 — Custom Component Selection

The setup wizard provided the following component options:

* GIMP
* Run-time libraries
* Debug symbols
* Resource development files
* PostScript support
* Python scripting
* Translations
* MyPaint brushes

Custom installation was selected to allow the available components to be reviewed individually.

Components not required for the simulated standard image-editing use case were deselected, including development-oriented components and additional functionality not required for the requested deployment.

The core application and required runtime libraries were retained.

Evidence File:

Validation Result: PASS

EV-16 — Final Component Selection

The final component configuration was reviewed before continuing with the installation.

The deployment retained the core GIMP application and required runtime libraries while removing unnecessary development and optional functionality for this specific use case.

This demonstrates a controlled installation approach rather than automatically installing every available component.

Evidence File:

Validation Result: PASS

EV-17 — Desktop Shortcut Configuration

The setup wizard displayed an option to create a desktop icon.

The desktop icon option was left unselected because a desktop shortcut was not required for the software deployment.

This avoided an unnecessary desktop modification while still allowing the application to be launched from Windows.

Evidence File:

Validation Result: PASS

EV-18 — Ready-to-Install Configuration Review

The setup wizard displayed the final Ready to Install screen.

At this point, the installation configuration had been reviewed, including:

Per-user installation scope
License agreement
Installation directory
Component selection
Desktop shortcut preference

The configuration was then approved by selecting Install.

Evidence File:

Validation Result: PASS

EV-19 — Installation Completion

The setup wizard displayed:

Completing the GIMP Setup Wizard

Setup has finished installing GIMP on your computer.

The Launch GIMP option remained unchecked on the completion screen.

The installation completed without an installation error being observed.

Evidence File:

Validation Result: PASS

EV-20 — Installed Application Files

After completing the setup wizard, the installation directory was inspected:

C:\Users\o.bennett\AppData\Local\Programs\GIMP 3

The directory contained the installed application structure, including:

* bin
* etc
* lib
* share
* uninst

The presence of the installed application files confirmed that the deployment created the expected GIMP installation directory under the o.bennett user profile.

Evidence File:

Validation Result: PASS

EV-21 — GIMP Launch and Version Validation

GIMP was launched normally from Windows using the o.bennett user context.

The application displayed a welcome message confirming:

You installed GIMP 3.2.6!

This confirmed that the installed application version matched the version that was downloaded and verified before installation.

Evidence File:

Validation Result: PASS

EV-22 — Application Functional Validation

The GIMP main application interface loaded successfully after installation.

No installation error was observed, and the application was available for use by the intended user.

The lab did not perform advanced image-editing tests because the objective was to validate the secure acquisition, integrity verification, controlled installation, and successful deployment of the application.

Evidence File:

Validation Result: PASS

Evidence Methodology

The evidence collection followed the same principle used throughout the portfolio: establish the initial state, document each relevant configuration decision, validate the security controls, and confirm the final operational state.

The most important security evidence was not limited to screenshots of the installer. The deployment was supported by multiple independent checks:

User / Endpoint Identity
        ↓
Official Vendor Source
        ↓
Installer Identification
        ↓
Vendor SHA-256
        ↓
Local SHA-256
        ↓
Exact Hash Match
        ↓
Additional Security Screening
        ↓
Controlled Installation Scope
        ↓
Component Review
        ↓
Installation Completion
        ↓
Post-Installation Validation

The SHA-256 comparison provided the primary installer integrity check, while the VirusTotal result provided an additional malware-screening layer. The installation configuration then demonstrated controlled deployment under the intended standard-user context.

🔐 Security Validation

The software deployment was validated against the security and operational requirements defined for ticket INC-804512.

The validation focused on four main areas: software authenticity and integrity, security screening, controlled installation, and post-installation verification.

Software Source Validation

The GIMP installer was obtained directly from the official GIMP distribution website.

This reduced the risk associated with obtaining software from untrusted or third-party download sources.

Result: PASS

Installer Integrity Validation

The SHA-256 hash of gimp-3.2.6-setup.exe was calculated locally using Windows PowerShell.

The locally calculated value exactly matched the SHA-256 value published by the GIMP project.

Local SHA-256:
9337cccbc01d4098ee7a3dab215b3afbe6ece99c5287c92441d6f12cf541ebca

Vendor SHA-256:
9337cccbc01d4098ee7a3dab215b3afbe6ece99c5287c92441d6f12cf541ebca

Result: PASS — Exact hash match

The matching hash provides evidence that the downloaded installer matched the vendor-published integrity value.

Additional Security Screening

The installer was submitted to VirusTotal as an additional malware/security screening step.

The result observed during the lab was:

0 / 69 detections

No security vendor flagged the submitted file during the scan performed for this lab.

Result: PASS — 0/69 detections reported

VirusTotal was treated as an additional security control and not as a replacement for vendor-source verification or SHA-256 integrity validation.

Installation Scope Validation

The installer provided two deployment scopes:

Install for me only
Install for all users

The Install for me only option was selected because the intended user, o.bennett, is a Standard User and is not a member of the local Administrators group.

Result: PASS

This demonstrated that the installation scope was aligned with the intended user context and did not require a system-wide deployment.

Installation Configuration Validation

The installation configuration was reviewed before deployment.

The following items were validated:

License Agreement
Per-user installation scope
Installation directory
Available installation components
Custom component selection
Desktop shortcut preference
Final installation configuration

Unnecessary development-oriented and optional components were deselected for this specific use case.

Result: PASS

Post-Installation Validation

After installation, the GIMP installation directory was inspected and the application was launched normally.

The application displayed:

You installed GIMP 3.2.6!

The main GIMP interface loaded successfully without an installation error.

Result: PASS

Overall Security Validation

The deployment successfully demonstrated a layered software installation process:

Official Vendor Source
        ↓
Installer Identification
        ↓
SHA-256 Integrity Verification
        ↓
Additional Security Screening
        ↓
Controlled Installation Scope
        ↓
Component Review
        ↓
Installation Completion
        ↓
Post-Installation Validation

The evidence collected during the lab demonstrates that the requested software was acquired, verified, installed, and validated using a controlled deployment process.

🛠️ Troubleshooting

No installation errors or software failures were encountered during the deployment.

Although no corrective troubleshooting was required, several configuration points were explicitly reviewed during the installation process to prevent unnecessary changes and ensure that the deployment matched the intended user context.

Installation Scope Decision

The installer provided two installation scopes:

Install for me only
Install for all users

The per-user installation option was selected because o.bennett was confirmed as a Standard User and was not a member of the local Administrators group.

Component Selection Review

The installer provided multiple optional components, including development files, debug symbols, scripting support, PostScript support, translations, and additional resources.

The installation was changed from a broader component selection to a custom configuration so that unnecessary components could be excluded.

Integrity Verification

No hash mismatch was encountered.

The locally calculated SHA-256 value matched the vendor-published value exactly, allowing the deployment process to continue.

Final Outcome

No corrective action was required during the installation.

The troubleshooting focus was therefore limited to validating configuration decisions and confirming that the software deployment proceeded as expected.

🧠 Lessons Learned

This lab demonstrated that software deployment should be treated as a controlled IT support and security process rather than simply downloading and installing an application.

1. Trusted Software Sources Matter

Software should be obtained from the official vendor or another organization-approved source whenever possible.

Using the official GIMP distribution page provided a clear source for the application version and the vendor-published integrity information.

2. Integrity Verification Adds an Important Security Control

Calculating the SHA-256 hash locally and comparing it with the vendor-published value provided evidence that the downloaded installer matched the expected file integrity value.

The hash comparison was performed before executing the installer.

3. Security Screening Provides an Additional Layer

VirusTotal was used as an additional security screening mechanism.

The 0/69 result observed during the lab provided additional evidence that the submitted installer was not flagged by the participating security engines at the time of testing.

However, the scan result was not treated as a guarantee that the software is completely free of security risk.

4. Installation Scope Should Match the User Context

The distinction between installing software for the current user and installing it for all users demonstrated the importance of considering privilege requirements during software deployment.

The per-user installation was appropriate for the Standard User account used in this lab.

5. Custom Installation Can Reduce Unnecessary Components

Reviewing the available installation components allowed unnecessary development-oriented and optional functionality to be excluded.

This demonstrated a more controlled approach than automatically accepting every available component.

6. Post-Installation Validation Is Necessary

Successful completion of the installer alone is not sufficient to demonstrate a successful deployment.

The installation directory was inspected, GIMP 3.2.6 was launched, and the main application interface was confirmed to load successfully.

7. Evidence Makes IT Work Auditable

Documenting the workstation identity, installer source, hash verification, security screening, installation decisions, and final validation creates a traceable record of the deployment process.

This evidence-based approach can be applied to future software deployment and endpoint support scenarios.

✅ Final Result

The software deployment requested under ticket INC-804512 was completed successfully.

GIMP 3.2.6 was obtained from the official GIMP distribution source and identified as the approved application for the Creative & Brand workstation NX-WS-CRT03.

Before installation, the installer was validated using multiple security controls:

The installer was obtained from the official vendor source.
The vendor-published SHA-256 value was recorded.
The local SHA-256 hash was calculated using Windows PowerShell.
The local and vendor-published hashes matched exactly.
An additional VirusTotal security screening reported 0/69 detections during the lab.
The installation scope was configured for the intended user.
Installation components were reviewed and unnecessary components were excluded.

The installation completed successfully under the o.bennett user profile.

Post-installation validation confirmed that:

The expected GIMP installation directory was created.
GIMP 3.2.6 was installed successfully.
The application launched without an observed installation error.
The main GIMP interface loaded successfully.

Final Deployment Status

Requirement	Status
Official software source	`PASS`
Installer identification	`PASS`
SHA-256 integrity verification	`PASS`
Additional security screening	`PASS`
Installation scope review	`PASS`
Component selection	`PASS`
Installation completion	`PASS`
Post-installation validation	`PASS`
Evidence documentation	`PASS`

Final Result: PASS — Software successfully deployed and validated.

The completed case demonstrates an evidence-based approach to secure software acquisition, installer integrity verification, controlled endpoint deployment, and post-installation validation.