System Security 2

System Security 2

1. Attacks

   • Social Engineering
     • Exploiting the weakest part of a system: People
     • Doesn't require any virus or malware to do so
   • DDOS (Denial of Service)
     • Overloading a website with traffic
       • Used as botnet
     • Done by infecting lots of computers over a network to bring down the site
   • Malware
     • Viruses
       • Requires human Interaction
         • Attaches to files
     • Worms
       • Doesnt require human interaction
         • Replicates itself to spread
     • Trojan Horses
       • Disguises as real software
         • Gives unauthorized access
     • Ransomware
       • Locking down of files demanding payment
         • Not as discreet
     • Spyware
       • TO gain information without a persons knowledge
         • Are ab,le to see your screen and even webcam
           • Also they use keyloggers
   • SQL Injection
     • exploiting the vulnerablilities of SQL attackers could access systems about customer data, intellectual property and other info
     • Attackers execute malicious SQL statements
     • Companies such as Google, Youtube, Paypal, Ebay, Cisco
     • Used on database management systems
   • Brute force attacks
     • Runs through all possible passwords
     • Trial and error
     • Works for password based computer systems
   • Poor Network Policy
     • Outlineing rules for networks
       • To protect network from attacks
         • Restrictions such as Filters, not able to install or even run software from external devices
       • Acceptable Use policy (AUP)
   • Data interception and theft
     • Being in a public place and intercepting packets
       • Data travels across networks as packets
         • Tends to be unencrypted
       • Could involve physical theft of external hard drives
   • Phishing
     • Telephone Phising
       • Posing as banks asking for card info
     • Computer Phising
       • Mostly done via email
       • Social Engineering

2. Ways of preventing

   • Encryption
   • Firewalls
   • Anti-malware softwares
   • User access levels
   • Passwords
   • Network forensics
   • Network policies
   • Penetration testing