1.6 System Security V2

1.6 System Security V2

1. Types of attack

   • Malware
     • Crashes computers and when reboots, slows down, deletes files, slows down internet connections and logs keyboard input and sends it to hackers.
     • Software specifically designed to damage, disrupt or gain unauthorised access to a Computer System
     • To protect you need to; Strong security software, Enable OS and security software updates, being aware of potential threats and backup files regularly onto movable media.
   • Phishing
     • The fraudulent practice of sending emails pretending to be from reputable companies in order to induce people to reveal personal information.
     • To prevent you need to: Strong security software, be aware of fake mails and websites, not disclose personal/corporate info and disable browser pop-ups
     • It allows access to withdraw money or purchase things, open bank accounts and credit cards, high value corporate data and could lead to being blacklisted by the financial services
   • Brute force attack
     • A trial and error method to attempt to access passwords, usernames and other info similar to this
     • To protect you need to: have a network lockout policy, use progressive delays, use effective, unobvious passwords and have a challenge response
     • Can lead to data theft and access to corporate systems
   • Denial of Service attack
     • An attempt by hackers to block legitimate users from accessing their device/network
     • To protect you need to: have a strong firewall, have packet filters on routers, configure the web server and have a good network ploicy
     • Can lead to access to customer service, a loss of revenue, lower productivity and reputational damage
   • Data theft/interception
     • The unauthorised access to data with the intent of comprimising privacy or obtain info
     • To prtotect you need to: Encrypt, use virtual netwroks, lock computers, log out of sites and be concious of your networking forensics
     • Can lead to data being comprimised/stolen
   • SQL injection
     • The adding of code which allows hacker to view or change the database
       • You would do this to:
         • Access sensitive data
         • Steal/retrieve personal data
         • Access/steal/retrieve financial data
         • Destroy data
         • Create/read/update/modify/delete data
         • Take control of data
     • To protect you need to: have validation on input boxes, use parameter queries, set database queries and use penetration testing
     • Can lead to databases being changed/deleted/viewed and rogue records can be included

2. People as a weak point

   • We don't always install OS updates, keep anti-malware up to date, we leave computers logged in, leave printouts on desks, write data on sticky notes, share and lose passwords, don't encrypt data and we don't apply security to wireless networks

3. How to avoid a poor network policy

   • Follow the data protection policy
   • Have acceptable usage agreements
   • Have permissions set to access data
   • Ensure your network managers understand, identify and actively protect against vulnerabilities

4. Features of a strong password

   • Uppercase letters
   • At least eight characters
   • Lowercase letters
   • Include special characters
   • Include numbers
   • Does not include a name, company name or user name
   • Does not contain a complete word
   • Relates to an acronym

5. A network manager should be able to

   • Change system settings
   • Add/delete network users
   • Install software

6. A student should be able to

   • Access a shared area for students
   • Access a student's file and change it

7. A tutor should be able to

   • Access a shared area for tutors

8. How penetration testing helps

   • Penetration testing looks for vulnerabilities.
   • It attempts to exploit the vulnerabilities that it finds.
   • The results of penetration testing are presented to network managers to help them to remedy the vulnerabilities
   • It helps to protect a system from cyber attacks
   • It identifies and prioritises security risks
   • It helps to save money/resources
   • It helps to avoid down time
   • It helps to protect a company’s reputation