System Threats

System Threats

1. Malware

   • Software written to infect computers to commit crimes such as fraud and identity theft. By exploiting vulnerabilities in systems and browsers, malware can sneak malicious Trojan horse programs onto unprotected PCs. Trojans have traditionally hidden in viruses sent by email, but are increasingly popping up in messages on mobile phones.
     • The computer may crash or slow down without any logical explanation. Files may be deleted or become corrupt and encrypted.Malware could be designed to record the keys pressed on a keyboard. The hacker can scan the log for usernames and passwords for bank and other accounts.
       • Enable OS updates, back up files regularly, caution opening attachments, strong security software.
         • Prevention.
       • Effects
     • Definition

2. Phishing

   • Fishing is an online fraud technique used by criminals to entice you to disclose personal information, passwords, and credit card details by disguising as a trustworthy entity in an electronic communication. Phishers use many luring techniques including emails resembling trusted institutions.
     • Accessing a victim's account and withdrawing money. They can gain access to high value corporate data. They open new bank accounts in the victim's name and use the new account to cash illegitimate cheques.
       • Strong security software. Staff training, awareness of spotting fake websites and emails, never disclose personal or financial information, and disable pop ups.
         • Prevention
       • Effects
     • Definition

3. Brute Force Attack

   • A brute force attack is a trail and error method used by programs to decode encrypted data such as passwords, through exhaustive methods rather tan intellectual strategies.
     • Theft of data, access to corporate and private computer systems.
       • Network lockout policy, locks out after a number of tries, use effective passwords that contain symbols and numbers. Challenge response tests, user has to look at a picture and answer a question
         • Prevention
       • Effects
     • Definition

4. SQL injection

   • A code injection technique, used to attack data driven applications. If a data application has not been coded in a secure way, code can be entered into text boxes and will be executed by the server.
     • Contents of the database can be output, revealing data that would otherwise be hidden, data in the database can be deleted. New rouge records can be added
       • Validation of input fields. Using database permission, penetration testing.
         • Prevention
       • Effects
     • Definition

5. Denial of service attack

   • Flooding a server with useless traffic, causing it to overload preventing them from responding to legitimate client server requests. Many of these attacks such as the ping of death,exploit limitations in the TCP protocols. It is a type of attack where multiple compromised systems are used to target a single system.
     • Revenue losses, the average cost of downtime is £4000/minute. Productivity loss, workforce's come to a halt. Reputation damage, brands suffer when clients can't reach your website.
       • Strong security software, packet filters on routers, configuration of the webserver, good network policy.
         • Prevention
       • Effects
     • Definition

6. Data interception and theft

   • An attacker monitors data streams to or from a target in order to gather sensitive information. Sniffing and eavesdropping is the act of monitoring traffic on the network such as data like passwords and user information
     • Discovering username and passwords, gaining access to systems, disclosure of corporate data, theft of data
       • Strong encryption, using virtual networks, network forensics
         • Prevention
       • Effects
     • Definition