System Security 1.6

System Security 1.6

1. Forms Of Attack

   • Malware
     • Software written to infect, damage or gain unauthorized access to computer systems
     • Used to commit crimes such as fraud and identity theft
     • Exploits vulnerabilities in the OS and browsers to seem safe
     • Types of Malware: 'Trojans', Worms, Viruses and other malicious programs
   • Phishing
     • Online fraud technique used to entice people to disclose personal information
     • Used to try and steal personal information such as usernames, passwords credit card details etc.
     • One way is by spamming people messages which have been seen to have come from a trustworthy company to trick people into giving away information
   • Brute Force
     • A trial and error method used by programs to decode encrypted data such as passwords and pin numbers etc.
     • Normally done through exhausted effort with a lot of generated guesses instead of employing forms of intellect
   • Denial of Service (DoS)
     • Floods a sever with useless traffic, overloading it so it cannot respond to legitimate requests by the user
     • Some forms of DoS attacks (Teardrop Attacks, Ping of Death) exploit limitations in the TCP/IP (Transmission Control Protocol/Internet Protocol)
     • DDoS (Distributed DoS) is where multiple systems, already infected with 'Trojans', are used to infect a singular system; this causes a DDoS to occur
   • Data Interception and Theft
     • The unauthorised act of stealing and obtaining confidential information and compromising privacy in computer systems
     • Data streams and packets are 'eavesdropped' into in order to obtain plain text passwords, configuration information or data itself
   • SQL Injection
     • A code injection technique used to attack data-driven applications
     • Insecure code in the database programs can be 'injected' (changed) with new coding that could do harmful things when executed by the server
     • Used to create different search strings which can deliver any input done in the text box to the creator, obtaining usernames and passwords etc.
   • Network Policies
     • Outlines rules for network access
       • Most common for is acceptable use policy (AUP)
     • A poor network policy could:
       • Expose a network to numerous threats
         • Users are at risk when they are using software, opening emails and turning off firewall etc...

2. Identifying and preventing vulnerabilities

   • Network Forensics
     • A branch of digital forensics
     • Covers the forensic investigation of networks and their devices attached to them
     • Primarily involves the examination of data sent over a network
     • May involve the use of various forensic techniques such as 'Packet sniffing'
     • 'Packet Sniffing' involves the interception of packets across a network
       • It can help users understand what is being sent across the network at that time
   • Penetration Testing
     • Tests performed in a controlled environment by a qualified person
     • Checks for current vulnerabilities and explores potential ones in order to expose weakness' in the system
     • Uses tools such as a 'penetration tester' to help them in their duties
   • Anti-Malware software
     • Software with the aim of preventing malware from entering the system
     • Software that performs a 'barrier' between a potential attacker and the computer system
       • Firewall
     • Can be held on a server or a standalone computer
     • Is a feature of many anti-virus packages
     • Not 100% effective - an attacker could exploit a vulnerability
   • User access levels
     • Allows the system administrator to set up a hierarchy of users
     • Lower level users would have access to limited information and settings while higher level users could have access to the most sensitive data on the system
     • This is also known as system access rights