systems software and security

systems software and security

1. Networks Threat

   • Malware
   • Social engineering
     • Humans are often the weakest point in security Social engineering is the art of manipulating or ‘conning’ individuals into giving away private information or login IDs and passwords Two common techniques are: Phishing, Shoulder surfing
       • Phishing
         • A phishing email is one that tricks you into handing over sensitive or personal information (login details, bank details, etc.)
           • You receive what looks like a legitimate email, for example from a bank or an organisation such as PayPal or eBay
           • The email urges you to visit a bogus website and enter your personal details, which are then captured by the phishers
         • A successful phishing campaign has around a 5% response rate – meaning 5% of recipients are conned!
         • look out for the greeting, the sender address, forged links, requests for personal info, sense of urgency and poor spelling and grammer
   • Brute force attacks
     • In a brute force attack, a hacker may go through a list of different passwords until access to an account is gained
     • Alternatively, the attacker may try every combination of characters until the correct password is found
   • Denial of service attacks
   • Data interception and theft
   • SQL injection
   • Poor network policy

2. the prevention of vulnerabilities

   • penetration testing
     • ‘Pen’ testing is the practice of deliberately trying to find security holes in your own systems
       • goal is; identify the targets of potential attacks identify possible entry points attempt to break in report back the findings
   • network forensics
     • Similar to police forensics, network administrators can use audit trail data to solve data mysteries This can identify data leaks and prevent security attacks An intrusion detection system can and alert administrators in real-time
       • network policies
         • Network security compromised by employee behaviour, can be addressed with correct user policy Most organisations have an Acceptable Use Policy which employees (or students) are required to sign and agree to before using the network system
   • anti-malware
   • firewalls
   • user access levels
   • passwords
   • encrypition