System Threats

System Threats

1. Malware

   • software written to infect computers and commit crimes such as fraud and identity theft.
     • computer may crash, reboot or slow down. Files may be deleted, corrupted or encrypted
       • Install security software(Anti-virus) back up files regularly, train Staff, enable OS updates

2. Phishing

   • An online fraud technique used by criminals to entice you to disclose personal information such as usernames, passwords and credit card detail
     • They might withdraw money or purchase merchandise or services.• Open new bank or credit-card accounts in a victim’s names, and use the new account to cash illegitimate checks or purchase merchandise.
       • • Strong security software (firewall, spam filter, anti-virus, anti-spam). • Staff training: awareness of spotting fake websites & emails. • Staff training: never disclose personal or financial information. • Staff training

3. Brute Force Attack

   • A trial and error method used by programs to decode encrypted data such as passwords
     • • Theft of data. • Access to corporate and private computer systems
       • Network lockout policy,Staff training, Challenge response tests

4. Denial of Service Attack

   • Flooding a server with useless traffic causes servers to become overloaded preventing them responding to legitimate client-server requests from users
     • Reputation Damage, Productivity Loss, Revenue losses
       • Strong security software (firewall), Packet filters on routers,Configuration of the webserver, Good network policy: audits, logs, monitoring.

5. Data Interception

   • An attacker monitors data streams to or from a target, in order to gather sensitive information
     • Discovering username and password credentials, Gaining access to systems, Disclosure of corporate data, Theft of data.
       • Strong encryption, Using virtual networks, Staff training: use of passwords, locking and portable storage devices, Network forensics.

6. SQL Injection

   • A code injection technique, used to attack data-driven applications
     • Contents of the database can be output, revealing data that otherwise would be hidden, Data in the database can be amended and deleted, New rogue records can be added.
       • Validation of input fields, Using parameterised queries, Using database permissions, Penetration testing.