System Threats

System Threats

1. Malware

   • Software written to infect computers and commit crimes such as fraud and identify theft.
     • Can cause computer crashing, rebooting or slow down. The internet connection can become slow due to searches online. Files can be lost through becoming corrupt or encrypted and key presses recorded being sent to a hacker giving them passwords and personal information>
       • Can be prevented with strong updated anti-virus and firewalls. Also enable OS updates and back up files. People can be taught to be careful when opening attachments.

2. Phishing

   • A fraud technique that entices you into giving away personal information such as passwords or bank details.
     • Effects of phishing: Accessing a victim’s account and withdraw money or purchase merchandise or services; Open new bank or credit-card accounts in a victim’s names, and use the new account to cash illegitimate checks or purchase merchandise; Gaining access high-value corporate data; Financial services can blacklist institutions, resulting in reputational damage.
       • Can be prevented with strong security software and staff training to spot fake websites and emails, not giving away details and disabling pop-ups.

3. Brute Force attack

   • A brute force attack is a trial and error method used by programs to decode encrypted data such as passwords or Data Encryption Standard (DES) keys, through exhaustive effort rather than employing intellectual strategies.
     • Effects: Theft of data; access to corporate and private computer systems
       • Can be prevented with a network lockout policy, staff training (using passwords with letters symbols and numbers), Challenge response tests (i.e. reCAPTCHA)

4. Denial of service attack (DDoS)

   • Flooding a server with useless traffic causing it to crash and deny legitimate requests from users
     • Effects: revenue loss from downtime; loss of productivity; reputation damage
       • Can be prevented by strong security software, packet filters, configuration of the webserver, good network policy; audits, logs and monitoring

5. Data interception and theft

6. SQL Injection

   • SQL injection is a code injection technique, used to attack data-driven applications. If a database application has not been coded in a secure way, code can be entered into text boxes, and will be executed by the server.
     • Contents of the database can be output, revealing data that otherwise would be hidden. Data in the database can be amended and deleted. New rogue records can be added.
       • Validation of input fields. Using parameterised queries. Using database permissions. Penetration testing.

Imágenes y archivos del mapa