Threats and Security

Threats and Security

1. System Security

   • System security is concerned with the protection of computer systems, computer networks and data. Its purpose is to:
     • to protect computers and networks from cyberattacks
     • to prevent unauthorised access to computers
     • to protect computers against damage caused by malicious software
     • to prevent data from being stolen
     • to protect against the disruption of services running on the computer

2. Forms of attack

   • Passive Attack – data is monitored e.g. wiretap
     • Passive attacks can be detected and prevented by:
       • Using penetration testing
       • Using network forensics
       • Using encryption
   • Active Attack - data is modified e.g. malware
   • Inside Attack– by someone within the organisation
   • Outside Attack – by an illegitimate, external user

3. System security threats

   • Brute-force Attack – when all possible password combinations are systematically tried, with the hope of getting it right.
     • Brute-force Attack can be prevented by:
       • Using strong passwords
       • Locking accounts after a certain number of login attempts
       • Using 2 step verification (e.g. a code sent to mobile phone to confirm identity)
   • Denial-of-Service Attack (DoS) - when a network resource becomes deliberately overloaded (‘flooded’) with unnecessary requests, preventing it from responding normally.
     • Denial-of-Service Attack (DoS) - can be prevented by:
       • Using a firewall to control which programs can send and receive data packets, so that only authorised users & trusted programs can access the network.
   • Distributed-Denial-of-Service Attack (DDoS) – when the requests come from many sources so you cannot just block a single IP address.
     • Distributed Denial-of-Service Attack (DDoS) - can be prevented by:
       • Using a firewall to control which programs can send and receive data packets, so that only authorised users & trusted programs can access the network.
   • Structure Query Language (SQL) Injection – when a website is linked to a database and allows a user to enter information, it makes it possible for malicious code to be entered into a website form, in order to modify the SQL statement being executed. This will result in unauthorised access to the SQL database and the hacker will able to modify, delete or add data.
     • Structure Query Language (SQL) Injection - can be detected and prevented by:
       • Using penetration testing to check for vulnerabilities in the SQL code and report back
       • Validating user input so that the website form will not accept SQL statements or characters
       • Escaping input strings so that any SQL characters are ignored when processing the input from a website form
       • Using only prepared statements to restrict the SQL that can be executed. The input data from a website form can only be used by previously prepared SQL statements, which are processed separately to the input data
   • Malware is software that has been purposely developed to damage, disrupt or take control of computer systems.
     • Malware can be detected and prevented by:
       • Running anti-malware software regularly
       • NOT downloading software from unknown sources
       • NOT clicking on unknown links
       • Scanning downloaded files before opening them
       • NOT using removable media (e.g. a USB drive) as they may contain malware
       • Using automatic software updates: up-to-date software will include patches for known vulnerabilities and up-to-date anti-malware uses the most current database of threats
   • Social engineering techniques manipulate people into giving away confidential and personal information.
     • Social engineering threats can be detected and prevented by:
       • Creating user access levels
       • Using an effective network policy
       • Ensuring users have strong passwords
       • Using biometric identification measures
       • Installing physical security (e.g. locked rooms)
       • Ensuring user privacy settings on any social media are set to maximum so that attackers cannot find information about users (e.g. date of birth, address)

4. Types of malware

   • Computer viruses – insert themselves in normal programs. Viruses can replicate themselves and transfer from one computer to another. They are activated by a user often as email attachments and attachment to other files and programs.
   • Trojan gains access to a computer by pretending to be legitimate software. The trojan allows unauthorised backdoor access to a computer without the user being aware.
   • Spyware records the activity on your computer such as your keystrokes, thereby logging your passwords for instance and then sending the data back over the network to the attack instigator. Spyware can also be used to control your webcam and microphone.
   • Adware includes banners and popups that are automatically installed onto a computer. Whilst this does not cause any damage, adware is undesirable and can slow down the performance of a computer.
   • Worms spread like viruses but do not require human intervention. They attach themselves to network tools to spread automatically around a network very quickly.

5. Types of Social Engineering

   • Blagging (Pretexting) Fraudsters make up a scenario to con victims into revealing something they would not ordinarily do. They may have found out some personal information about you from social media sites, to pretend they already know you.
   • Phishing Normally an email or text messaging scam where victims are conned into believing that they are being contacted by an authentic organisation (e.g. by their bank) and can give sensitive personal details (such as bank account passwords).
   • Pharming Users are redirected to a fraudulent website that they believe to be genuine because it looks like the real site. For instance, you could be directed to a site that pretends to be an online store which asks you for your credit card information.
   • Shoulder surfing Fraudsters look over the shoulder of users to see what passwords or PIN numbers are being typed into the device. This can easily occur at computer terminals and at ATMs that are out in the street.

6. What is Network Forensics?

   • Network forensics is the capturing, recording and analysis of network traffic to discover attacks. This can be done using packet sniffing software and web server logs which show when data was accessed.