system security

system security

1. IDENTIFYING AND PREVENTING

   • Penetration testing
     • Penetration testing (also called pen testing) is the practice of testing a computer system, network or Web application to find vulnerabilities that an attacker could exploit.
   • Network forensics
     • Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics,network investigations deal with volatile and dynamic information.
   • Network policies
     • A network security policy, or NSP, is a generic document that outlines rules for computer network access, determines how policies are enforced and lays out some of the basic architecture of the company security/ network security environment. The document itself is usually several pages long and written by a committee.
   • Firewalls
     • protect (a network or system) from unauthorized access with a firewall.
   • Anti-malwre software
     • A good antivirus suite is an excellent first line of defence for your PC, but it's often a good idea to install additional anti-malware software to boost your protection from a more diverse range of threats. Alternatively, you could replace your existing security software with a whole new suite designed to protect against all kinds of malware.
   • User access level
     • Part of an access control procedure for computer systems, which allows a system administrator to set up a hierarchy of users. Thus, the low level user scan access only a limited set of information, whereas the highest level users can access the most sensitive data on the system. Also called accessrights.
   • Passwords
     • a string of characters that allows access to a computer, interface, or system. "each user has a password in order to log on to the network"
   • Encryption
     • Encryption is the most effective way to achieve data security. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it. Unencrypted data is called plain text ; encrypted data is referred to as cipher text.

2. FORMS OF ATTACKS

   • phishing
     • Phishing is the attempt to obtain sensitive information such as usernames, passwords, and credit card details (and, indirectly, money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication.
   • malware
     • software which is specifically designed to disrupt, damage or gain authorized access to a computer.
   • Social engineering
     • Social engineering is an attack vector that relies heavily on human interaction and often involves tricking people into breaking normal security procedures.
   • Brute force attacks
     • Brute force is a trial and error method used by application programs to decode encrypted data such as passwords or Data Encryption Standard (DES) keys, through exhaustive effort (using brute force) rather than employing intellectual strategies.
   • DDOS
     • DDoS is a type of DOS attack where multiple compromised systems, which are often infected with a Trojan, are used to target a single system causing a Denial of Service (DoS) attack.
   • Data interception and theft
     • Data Theft Definition. The unauthorized taking or interception of computer-based information. Data theft is the act of stealing computer-based information from an unknowing victim with the intent of compromising privacy or obtaining confidential information.
   • SQL injection
     • SQL injection is a code injection technique, used to attack data-driven applications, in which nefariousSQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).
   • Poor network policy
     •  network security policy, or NSP, is a generic document that outlines rules for computer network access, determines how policies are enforced and lays out some of the basic architecture of the company security/ network security environment.