Cyber Security

Cyber Security

1. Key terms

   • Attack
     • An attack is a deliberate action targeting an organisations digital system or data.
   • Threat
     • Internal
       • Caused by an incident inside an organisation
     • External
       • Caused outside the organisation
     • Is an incident or action which is deliberate or unintended that results in disruption, down time or data loss.
   • Cyber Security
     • Refers to the range of measures that can be taken to protect computer systems, networks and data from unauthorised access or cyber attack.
   • Unauthorised access
     • This refers to someone gaining entry without permission to an organisation’s system, software or data. This achieved by exploiting a security vulnerability.

2. Hacker

   • Is someone who seeks out and exploits these vulnerabilities.
   • Black hat hacker
     • Is someone who tries to inflict damage by compromising security systems.
   • Grey hat hacker
     • Is someone who does it for fun and not with malicious intent.
   • White hat hacker
     • Is someone who works with organizations to strengthen the security of a system.

3. Types of threats

   • Malware
     • This is an umbrella term given to software that is designed to harm a digital system, damage data or harvest sensitive information.
     • Virus
       • A piece of malicious code that attaches to a legitimate program. It is capable of reproducing itself and usually capable of causing great harm to files or other programs on the same computer.
     • Worm
       • Worms get around by exploiting vulnerabilities in operating systems and attaching themselves to emails. They self replicate at a tremendous rate, using up hard drive space and bandwidth, overloading servers.
     • Trojan horse
       • Users are tricked into downloading it to their computer. Once installed the Trojan works undercover to carry out a predetermined task.
     • Rootkit
       • Designed to remotely access and control a computer system without being detected by security software or the user.
     • Ransomware
       • Encrypts files stored on a computer to extort/demand or steal money from organisations.
     • Spyware
       • Is secretly installed to collect information from someone else's computer.
     • Keyloggers
       • Spyware that records every keystroke made on a computer to steal personal information.
     • Adware
       • Automatically shows adverts such as popups. Most adware is harmless but some contain spyware such as keyloggers.
     • Botnet
       • Bots take control of a computer system, without the user’s knowledge. A botnet is a large collection of malware-infected devices (zombies). An attacker (‘bot herder’) chooses when to ‘wake’ the zombies to perform an attack.
     • Distributed Denial-of-Service attack (DDoS attack)
       • Flooding a website with useless traffic to inundate and overwhelm the network .

4. Social Engineering

   • Is a set of methods used by cybercriminals to deceive individuals into handing over information that they can use for fraudulent purposes.
   • Shouldering
     • It involves the attacker watching the victim while they provide sensitive information.
   • Phishing
     • Is an attack in which the victim receives an email disguised to look as if it has come from a reputable source, in order to trick them into giving up valuable data.
   • Pharming
     • Is when a victim redirects the user from a genuine website to a fake one.
   • Blagging
     • Is an attack in which the perpetrator invents a scenario in order to convince the victim to give them data or money.
   • Tailgating
     • Trying to gain access to a secure room or building.
   • Baiting
     • Cyber criminals make a promise of goods to get the information that they need.
   • Quid pro quo
     • Cyber criminals make a promise of a service to get the information that they need.