Cyber Security

Cyber Security

1. Key terms

   • Threat
     • External
       • Caused outside the organisation.
     • Internal
       • Caused by an incident inside an organisation.
     • An incident or action which is deliberate or unintended, that results in disruption, down time or data loss.
   • Attack
     • An attack is a deliberate action, targeting an organisations digital system or data.
   • Unauthorised access
   • Cyber security

2. Hackers

   • Someone who seeks out and exploits these vulnerabilities.
   • Black hat hackers
     • Someone who tries to inflict damage by compromising security systems.
   • Grey hat hackers
     • Someone who does it for fun and not in malicious intent.
   • White hat hackers
     • someone who works with organizations to strengthn the security of the system.

3. Types of threats

   • Malware
     • This is an umbrella term given to software that is designed to harm a digital system, damage data or harvest sensitive information.
     • Malicious software
     • Trojan horse.
       • Users are tricked into downloading it to their computer. Once installed the Trojan works undercover to carry out a predetermined task.
     • Rootkit.
       • Designed to remotely access and control a computer system without being detected by security software or the user.
     • Ransomware.
       • Encrypts files stored on a computer to extort/demand or steal money from organisations.
     • Spyware.
       • Is secretly installed to collect information for someone else's computer.
     • Keyloggers.
       • Spyware that records every keystroke made on a computer to steal personal information.
     • Adware
       • Automatically shows adverts such as popups.
         • Most adware is harmless but some contain spyware such as key loggers.
   • Virus
     • A piece of malicious code that attaches to a legitimate program. It is capable of reproducing itself, and usually capable of causing great harm to files or other programs on the same computer.
   • Worm
     • Worms get around by exploiting vulnerabilities in operating systems and attaching themselves to emails. They self replicate at a tremendous rate, using up hard drive space and bandwidth, overloading servers.

4. Social engineering

   • A set of methods used by cybercriminals to deceive individuals to handing over information that can be used for fraudulent purposes.
   • Shoulder surfing/Shouldering
     • It involves the attacker watching the victim while they provide sensitive information. (e.g. watching someone put in their pin at a cash point).
   • Phishing
     • Is an attack in which the victim receives an email disguised to look as if it has come from a reputable source, in order to trick them to giving up valuable data. The email usually provides a link to another website where the information can be inputted.
   • Pharming
     • Is when a victim redirects the user from a genuine website to a fake one.
   • Blagging/Pretexting
     • An attack in which the perpetrator invents a scenario in order to convince the victim to give them data or money.
     • Blagging and pretexting does not just happen on an email, it happens on the phone too.
   • Tailgating/Piggybacking
     • Try to gain access to a secure room or building.
       • E.g A common example is someone pretends to be a delivery driver and asking an authorised person to hold the door so they can enter the building.
   • Baiting
     • Cyber criminals to make a promise of goods to get the information that they need
       • E.g promise free downloads to a film for login details.