System Security 1.6 (V1)

System Security 1.6 (V1)

1. Different types of attack; Malware, phishing, Brute force, Denial of service, Data interception and theft, SQL injection

   • Malware is malicious software that causes things like identity theft, financial loss, and permanent file deletion.
     • Threats posed to computing, Malware, phishing, Brute force, Denial of service, data interception theft, SQL injection and Poor network policy
       • Key words: Malware, Phishing, Viruses, Worms, Trojan horses, Social engineering, Data interception, Network policies
         • Viruses is a malicious software designed to cause harm to a network or computer system. It attaches itself to programs or files on a computer or server. It can affect all components of an operating system. Around 82,000 viruses are made each day.
       • Worms replicates itself in order to spread to other computers, often using a computer network. in order to achieve this, the worm exploits vulnerabilities across the computer network. Unlike a virus it does not need to attach to a program.
         • Trojan horses is a malicious computer program designed to access a computer by misleading users of its intent. Example; Email appearing to have been sent from a bank asking to download a security software which would improve security where in fact the software intention is to give unauthorised access to the system.
           • Computer phishing is a form of social engineering designed to acquire sensitive information such as usernames, passwords, card details etc. Most common phishing attacks are sent through email.
             • Poor network policy could expose a network to numerous threats, the user could be unaware of the risks of; using software, opening emails, turning of firewalls etc. Most networks restrict users to what they can/cannot do; Can you install software on your school PC?, Do you have filters on your email and internet browser?
       • Social engineering relies on human interaction (social skills), it commonly involves tricking users into breaking normal security procedures, the method does not revolve around technical cracking techniques such as worms or viruses.
         • Network policies outlines rules for network access, the most common is acceptable use policy(AUP), You may have been asked to agree ta an AUP when joining your school. Other policies are more suitable for contractors and those in charge of maintaining the network.
   • Data information and theft is when data travels across networks in packets, packets can be intercepted. if packets are encrypted they cannot be read without a key. Un-encrypted can be re-assembled using signatures. Data can also be intercepted physically, for example potable hard drives and other external hardware can be stolen
     • Telephone (IVR) phishing is telephone system mirroring - direct phone calls that pretend to be an official service, for example, a telephone phishing system would request similar prompts to a bank if the exploit was to gain banking information. User could be asked to enter their bank number, expiry, CCV, PIN and system may reject or ask for re-entry to ensure original digits are correct.