8.3 Security of data

8.3 Security of data

1. Hacking

   • The act of gaining unauthorised access to a computer system
   • Leads to identity theft or misuse of personal data. May cause corruption, changes or deletion of data
   • To prevent hacking, use strong passwords and user IDS that are changed frequently, install firewalls and use an intrusion detection software.

2. Phishing

   • The creator sends legitimate-looking emails that seem to come from a trusted source (e.g. a bank) to target users. When the recipient clicks on the link or attachment in the email, they are redirected to a fake website or are fooled into giving out personal data in replying to the email.
   • The creator of the email can gain access to personal data (bank account details and credit card number). Leads to fraud or identity theft
   • Many isps and web browsers filter out phishing emails. Be cautious when opening emails or attachments. Don't click on executable attachments (ending in .com or .bat)

3. Malicious use of data refers to the deletion, fraud, identity theft and selling of personal data.

   • Online Forums: interactive websites where people can take part in discussions. Forums allow users to post their own comments to the website.
     • Moderated and unmoderated forums
       • Moderated forum: online discussion forum in which all posts are checked by an administrator before they are allowed to be posted. Moderator can prevent spam, prevent phishing attempts and filter posts that are rude/offensive or off the main topic.
       • Unmoderated forum (e.g. internet): not policed, only real safeguards are voluntary cooperation between users and network operators. Most social forums/networking groups on internet have set of protocols members must follow or they will be deleted.
         • Since no rules, used for inappropriate purposes:
           • Spamming users with adverts
           • Phishing: tricking people into giving personal data

4. Smishing

   • Short for SMS phishing : uses the SMS system of mobile phones to send out fake text messages that seem to come from a trusted source. Text contains a URL or telephone number the recipient is instructed to log on to/call. If they do, they will be asked to supply personal details e.g. credit card number and passwords.

5. Pharming

   • Malicious code installed on the user's computer or web server. It redirects the user to a fake website without them knowing
   • Creator of malicious code can gain access to personal data (credit/debit card numbers) when the user visits the fake website that appears to be of a trusted source. Can lead to fraud or identity theft.
   • Some anti-spyware software can identify and remove the pharming code from a user's computer. Users always be alert and look out for clues that they are being redirected to another website (e.g. look out for https in URL or padlock symbol)

6. Viruses

   • A program code or software that can replicate itself with the intention of deleting or corrupting files on a computer. They often cause the computer to malfunction.
   • Viruses can cause the computer to crash (become unresponsive or stop functioning normally), delete files or data on a computer and corrupt operating system files making the computer run slowly or crash.
   • Install anti-virus software and update it regularly, don't use software from unknown sources, be careful when opening emails or attachments from unknown senders
     • Backing up files won't guard against the effects of a virus as the files being copied to the backup system may already have been infected by the virus, thus when the files are copied back to the computer the virus is reinstalled.

7. Spam

   • Junk email usually sent automatically to recipients on a mailing list or mailing group.
     • Email harvesting: the way spammers get your email address from a range of sources e.g. mailing lists, social networking sites, chat rooms
   • Can lead to denial of services: an attack on a network that is designed to slow the network down by flooding it with useless traffic. Spam also linked to phishing attacks, spread of computer viruses and advertising of low quality products/asking for money.
   • Many ISPs filter out spam mail. Set protection level of junk email filter to high, block images in HTML messages that spammers use as web beacons, don't sign up to commercial mailing lists
   • Recognising spam: unknown sender, asked to give personal info (bank details), asked to buy something or pay cash, full of spelling/grammar errors

8. Firewalls

   • Can either be hardware (gateway) or software. Sits between a user's computer and external network. Filters information coming in and out of computer.
   • Checks whether incoming or outgoing data fits a certain criteria, if data fails, firewall will block traffic and give user a warning that there maybe a security issue. Prevents access to certain undesirable sites. Prevents hackers (blocking IP addresses) and viruses from entering a user's computer network.
     • Cannot prevent individuals on internal networks using own modems to bypass firewall, employee misconduct or carelessness cannot be controlled by firewalls, users on standalone computers can choose to disable the firewall leaving computer open to harmful traffic on internet

9. Secure Sockets Layer (SSL)

   • Security protocol: sets of rules used by computers to communicate with each other across a network
     • Type of protocol that allows data to be sent and received securely over the internet
     • When user logs on to a website, SSL encrypts the data. User will know SSL is being applied when there is https or small padlock.

10. Encryption

    • Used to protect data in case it has been hacked or illegally accessed (cannot be read or used). Uses a secret key that has capability of altering characters in a message. If key is applied to message, content is changed and is unreadable unless recipient has same secret key.
      • Key used to encrypt message: encryption key. Key used to decrypt message: decryption key. When message undergoes encryption: cypher script. Original message: plain text
        • Encryption useful for: any files containing bank account/credit card data, when buying items online using credit cards, keep emails private, any data containing confidential medical records

11. Authentication

    • Used to verify that data comes from a secure and trusted source. Works with encryption to strengthen internet security.
    • Digital Certificate
      • A pair of files stored on a user's computer used in the security of data sent over the internet.
        • Each pair of files divided into a public key (known by anyone) and a private key (known to computer user only)
          • Recipient can verify a message/email comes from a trusted source by viewing public key information. Protects recipient from harmful emails.
            • Digital certificate made up of 6 parts: sender's email address, name of digital certificate owner, serial numberm expiry date, public key, digital signature of cetrificate authority (CA)
              • Operating systems and web browsers maintain lists of trusted CAs.
    • Biometrics
      • Relies on certain unique characteristics of human beings (fingerprint scans, retina scans, face recognition, voice recognition)
      • Used in a number of applications as a security device e.g. mobile phones use fingerprint matching before they can be operated.

12. Online Credit Fraud

    • Causes
      • Hackers gain access to a user's computer through spyware, phishing or pharming: trick users into giving personal data and financial details. Hacker can gain full access to user's credit card/bank account: leads to unauthorised purchases or removal of money.
      • Breaking of passwords (easy if passwords are weak or no encryption used)
      • Physically type in URL rather than copy and paste it from email or other website (could be altered slightly and user visits fake website).
      • Relatively easy to tap into wireless networks without password protection
      • User may log into an account or website using a public Wi-Fi hotspot that someone is monitoring the internet usage of. Risk of someone tapping into data going to and from a computer using this wireless link.
    • Precautions
      • Use varied and complex passwords for all accounts
      • Check accuracy of bank accounts regularly and immediately resolve and descrepancies
      • Don't open emails or attachments from unknown senders
      • Only provide personal info on sites that have https in URL or padlock icon

13. Cloud Security

    • Data security
      • Companies that transfer confidential data from own systems to a cloud service provider relinquish control of own data security. Concerns over physical security in building where data is housed, resistance to natural disasters and powercuts, safeguards regarding personnel who work for cloud service company (access confidential data for monetary purposes)
    • Data loss
      • Risk that important and irreplacable data could be lost from cloud storage facilities due to actions from hackers, backup issues, problems in the hypervisor (creates and runs virtual machines).