1.6 System Security

1.6 System Security

1. THREATS POSED TO NETWORKS

   • Malware
     • a program designed to cause some form of harm to a computer or network
     • EG viruses, worms, trojans ect.
       • Viruses
         • programs hidden within other files
         • can replicate and become parts of other programs
         • cause damage by deleting and modifying data
       • Worms
         • similiar to viruses but don't hide within other programs
         • often spread through emails
       • Trojans
         • programs that pretend to be legitimate but are malware
         • often disguised as email attactments
         • cannot spread by themselves - deceive a user to install them
       • Spyware
         • program that monitors users activites
         • sends info back to hacker
       • Ransomware
         • programs that blackmail a user to pay a fee to the hacker
         • EG encrypting documents and refusing to decrypt them until a payment is made
   • Phishing
     • emails or messages that pretend to be legitimate
     • aim to steal money, login details, personal details ect.
   • People
     • biggest threat to computer systems
     • poor training and/or human error tend to create the weakest points
     • criminals have methods to take advantage
   • Brute Force Attack
     • attempting to gain unauthorised access by trying every passcode
     • EG trying every four digit pin code
   • Denial of Service (DoS) Attacks
     • preventing legitimate access to a website by bombarding it with too much traffic
     • too much traffic causes server to slow down or even crash
   • Data Interception and Theft
     • where data is intercepted during transmission
       • done using software called a 'packet sniffer'
     • the information gathered is sent back to the hacker
   • SQL Injection
     • websites have databases which are created, searched and accessed using SQL
     • poorly written SQL can allow hackers to add in their own SQL statements or alter existing ones
     • gains access to data that should be hidden or protected
   • Poor Network Policy
     • where a network doesn't have security rules in place for users to follow

2. IDENTIFYING AND PREVENTING VULNERABILITIES

   • Penetration Testing
     • purpose is to determine how resilient a network is against an attack
     • used to identify weaknesses in a program
   • Network Forensics
     • involves monitoring the traffic on a network
     • data packets are copied for analysing
       • usually processed in batches
     • help identify invasive traffic from hackers
     • identify data leaks and communications
   • Anti-Malware software
     • THREE PURPOSES:
       • to detect malware that has been installed
       • to prevent malware from being installed
       • to remove malware from the system
     • must be up-to-date to be effective
   • Firewalls
     • monitors traffic going in and out of a computer/network
     • prevents unauthorised access to a computer/network
     • hardware or software based (hardware more effective but more expensive)
   • User Access Levels
     • determines what facilities a user has access to
     • only allows users access to the areas they need in order to complete their tasks
     • limits the actions a user can take
   • Secure Passwords
     • to verify who a user is
     • cannot sign into the network without correct password
     • locking users out after a certain number of failed attempts
   • Encryption
     • process of disguising data so that it cannot be understood
     • uses a cipher or key to scramble data
     • uncomprehensive to anyone without key
   • Network Policies