System Threats

System Threats

1. Malware

   • Malware = malicious software, software written to infect computers and commit crimes such as fraud and identity theft. Malware has become big business in the cyber underworld.
     • As a result, if you use a computer for web surfing, shopping, banking, email, instant messaging, and gaming without proper protection, you are putting yourself at high risk of being victimized.
   • By exploiting vulnerabilities in operating systems and browsers, malware can sneak malicious Trojan horse programs onto unsecured PCs. Unsuspecting and unprotected users can also download Trojans, thinking they are legitimate game, music player, movie, and greeting card files. Trojans can also lurk in files shared between friends, family, and coworkers using peer-to-peer file sharing networks.
     • Trojans have traditionally hidden in worms and viruses spread by email, but they’re increasingly showing up in instant messages and mobile phones. Organized crime rings have devised new ways of delivering Trojans, and consumers must stay informed of the latest tricks.
   • Effects of malware:
     • • The computer may crash, reboot spontaneously or slow down without any logical explanation.
     • • When a worm infects a computer, the internet connection may become slow as the worm searches online for other computers to infect.
     • • Files may be deleted, become corrupt or encrypted. However, the worst symptoms of malware are often the ones that you do not see. Malware might be designed to record the keys that you press on your keyboard, for example, creating a text log that your computer sends to a hacker periodically. The hacker then scans the text log, looking for passwords that he can use to access your email or bank accounts.

2. Phishing

   • Phishing is an online fraud technique used by criminals to entice you to disclose personal information such as usernames, passwords and credit card details by disguising as a trustworthy entity in an electronic communication. It is the fastest rising online crime method used for stealing personal financial information and perpetrating identity theft.
     • Phishers use many different tactics to lure you, including email and web sites that resemble well-known, trusted institutions.
       • A common phishing practice involves spamming recipients with a fake message under the name of a trusted institution. The purpose of this fake message is to trick you into providing personal information.
   • The effects of phishing
     • • Accessing a victim’s account and withdraw money or purchase merchandise or services.
       • • Open new bank or credit-card accounts in a victim’s names, and use the new account to cash illegitimate checks or purchase merchandise.
         • • Gaining access high-value corporate data.
           • • Financial services can blacklist institutions, resulting in reputational damage.
   • Preventing phishing
     • • Strong security software (firewall, spam filter, anti-virus, anti-spam).
       • • Staff training: awareness of spotting fake websites & emails.
         • • Staff training: never disclose personal or financial information.
           • • Staff training: disable pop-ups.

3. Brute Force Attack

   • A brute force attack is a trial and error method used by programs to decode encrypted data such as passwords or Data Encryption Standard (DES) keys, through exhaustive effort rather than employing intellectual strategies.
   • The effects of brute force:
     • • Theft of data
       • • Access to corporate and private computer systems.
   • Preventing brute force attacks:
     • • Network lockout policy: locks out after a number of tries.
       • • Staff training: using effective passwords that contain symbols and numbers.
         • • Challenge response tests e.g. reCAPTCHA – user has to look at a picture and answer a question.

4. SQL injection

   • SQL injection is a code injection technique, used to attack data-driven applications. If a database application has not been coded in a secure way, code can be entered into text boxes, and will be executed by the server.
   • Effects of SQL injection:
     • • Contents of the database can be output, revealing data that otherwise would be hidden.
       • • Data in the database can be amended and deleted.
         • • New rogue records can be added.
   • |Preventing SQL injection:
     • - Validation of input fields.
       • - Using parameterised queries.
         • - Using database permissions.
           • - Penetration testing.

Imagens e arquivos do mapa