Learning Aim B: Cyber security

Learning Aim B: Cyber security

1. Key Terms

   • CYEBER SECURITY
     • The range if measures that can be taken to protect computer systems, Networks and data from unauthorised access or cyberattack
   • THREAT
     • An incideant or action which is deliberate or unintended that results in disruption, down time or loss.
       • Internal
         • Caused by an incident inside an organisation
       • External
         • Caused Outside the Organisation
   • ATTACK
     • Is a deliberate action, targeting an organisation's digital system or data
   • UNAUTHORISED ACCESS
     • Reffers to someone which gains access without permission to an organisations system, software or data. This is achieved by exploiting a security vunrablity
       • HACKER
         • 3 Types of Hackers
           • White
             • Working with organisations to strengthen the security of a system
           • Grey
             • Do it for fun and not with malicious intent
           • Black
             • They try to inflict damage by compromising security systems

2. Why are Systems Hacked?

   • Fun / Challenge
     • - Hacking Systems can be fun or a challange
       • - There is a sense of Achievement
         • - Friends may give resoect of Hacking Achievements
   • Financial Gain
     • - Ransoms can be made to prevent attacks from happening
       • - Ransomware can be used to encrypt a computer until you pay
         • - A payment is given to carry out an attack on a organization
   • Disruption
     • - Attacks such as Denial-of-Service stop websites working
       • - Viruses can slow down Computers and Delete Files
   • Industrial Espionage
     • - The aim is to find interllectual property such as designs or blueprints for products, business strategies or software source code
   • Personal Attack
     • - Employees that are unhappy may attack the company
       • - Friends / Family may attack each other if upset over something
   • Information / Data Theft
     • - Credit card and financial details are stolen to gain money
       • - Company information may also be stolen

3. Malware

   • Malware= Malicious Software
     • This is an umbrella term given to software that is designed to harm a digital system, damage data or harvest sensitive information.
   • Virus
     • A piece of malicious code that attachesto a legitimate program. It is capable of reproducing itself and usually capable of causing greta harm to files or other programs on the same computer
   • Worm
     • Similar to virus but unlike a virus it is a self contained program. it is capable of spreading on it own, without help from humans. Worms get around by exploiting vunrabliltes in operating systems and attaching themselves to emails. They self replicate at a tremendous rate, using up hard drive space and bandwidth, overloading servers.
   • Trojans Horse
     • Is a type of malware that is often disguised as legitimate software. users tricked into downloading it to their computer. once installed the trojan works undercover to carry out a predetermined task.
       • -Backdoor for Hackers to use - Installing harmful programmes -Harvesting sensitive data
         • It is named after the wooden horse used by the ancient greeks to ilfiltrate the city of Troy.
   • Rootkit:
     • Is a set of tools that give a hacker a high level administrative control, of a computer.
       • They can then tell us this privileged position to: Encrypt files, install programes, change system configuration, steal data
         • Much like a trojan, rootkits often come bundled with legitimate software
   • Ransome
     • Encrypts files stored on a computer to extort or steal money from organisations
       • Victims must then pay a ransom to have the encrypted files unlocked. There is normally a deadline for the transction to happen.
         • Bitcoin is usually asked for as a form of payment as its difficult to trace.
           • If the payment is not made then the amount demanded may increase or the files are permanently locked.
             • Ransomeware is usually spread through e-mails or through infected websites.
   • Spyware
     • Malicious software installed to collect information from someone else's computer.
       • Cyber criminals harvest personal information
         • Such as: Passwords, Credit card numbers and other details, E-mail addresses
           • With this information they can steal somone's identity, making purchases on their credit card etc.
             • Spyware works in the background on someones computer without being noticed
   • Keyloggers:
     • Spyware that records every keystroke made on a computer to steal personal information
   • Botnet
     • Botnet is an army of 'Zombie' devices. They are used to carry out mass attacks such as emailing spam to millions of users.
     • Distrubuted Denial-of-Service attack (DDoS attack)-

4. Social Engineering

   • Involves tricking people into divulgling valuable information about themselves
     • -Passwords -Pin numbers -Credit card details
   • Phishing:
     • A way of attempting to acquire information, by pretending to be from a trustworthy source. Examples are email spoofing, fake websites, spoof phone calls.
   • Spear Phishing
     • Involves bespoke emails being sent to well-researched victims. E.g. where somebody who holds a senior position whithin an organisation with access to highly valuable information uses it to target victims.
   • Blagging
     • A blagger invents a scenario to engage a targeted victim in a manner that increaes the chance the victim will divulge information
   • Shoulder Surfing
     • Acquiring sensitive information by someone by peeping over a users shoulder when they are using a device. It can also be done from a distance with the use of technology such as video cameras, drones etc.
   • Pharming
     • Involves redirecting people to bogus, look-a-like websites without realising it has happened.
   • Man in the middle attack
     • A form of eavesdropping where the attacker makes an independant connection between two victims and steals information to use fraudulently.