System Security

System Security

1. Malware

   • Malicious software
     • e.g. Viruses, trojan horses, worms, spyware, backdoors, root kits
   • Anti-malware software
     • Identifies, quarantines and deletes infected files

2. Phishing

   • Emails trick users into giving away information
     • Often with links to fake websites
   • Awareness
     • Ensuring people recognise signs
   • Don't click on links - go directly to the website
   • Don't give away any information unless you are sure it is absolutely necessary

3. Social engineering

   • Manipulating people into handing over information
     • e.g. passwords, email addresses etc.
   • User access levels
     • Certain people can access certain data
       • Hackers can not access all data even if they gain access
   • Awareness
     • Teaching people to recognise the signs
     • Ensure people don't give out any information

4. Brute force

   • Strong passwords
     • Capitals, numbers, symbols etc.
   • Trial and error attempts to gain access
     • e.g. attempting to guess passwords
   • Limited number of attempts

5. Denial of service

   • Flooding server with requests to cause errors
     • Could be accidental or intentional and malicious
   • Distributed denial of service
     • On a larger scale - hundreds/thousands of computers rather than just a few
   • Improve system to be able to handle more requests
     • Could improve it at certain times when more requests are expected e.g. Black Friday

6. Data interception

   • Intercepting data during transmission
     • Examine data packets. Gathers information and sends back to hacker.
   • Encryption
     • Encodes data
     • Even if they steal data, they can't read it

7. SQL injection

   • Some systems use SQL to interrogate data
   • Entering SQL as a data input.
     • Can cause errors or unintended operations
       • e.g. gaining unauthorised access. deleting files, changing data etc.
     • Inserts code into existing code to change the purpose
   • Ensure program is robust
     • e.g. does not allow certain characters to be input
     • Penetration testing

8. Poor network policy

   • When a network does not have security rules in place for users to follow