System Threats

System Threats

1. SQL Injection

   • SQL injection is a code injection technique, used to attack data-driven applications. If a database application has not been coded in a secure way, code can be entered into text boxes, and will be executed by the server.
   • Contents of the database can be output, revealing data that otherwise would be hidden. Data in the database can be amended and deleted. New rogue records can be added.
   • Validation of input fields. Using parameterised queries. Using database permissions. Penetration testing.

2. Brute Force Attacks

   • Brute force attacks are a method of hacking in which a bot is made to input millions of combinations to a password to try and find the right one
   • The effects can either be theft of data or access to corporate and private computer systems.
   • Network lockout policy: locks out after a number of tries. Staff training: using effective passwords that contain symbols and numbers. Challenge response tests e.g. reCAPTCHA – user has to look at a picture and answer a question.

3. Data Interception

   • An attacker monitors data streams to or from a target, in order to gather sensitive information. This attack usually involves sniffing network traffic. Sniffing or eavesdropping is the act of monitoring traffic on the network for data such as plaintext passwords or configuration information. With a simple packet sniffer program, an attacker can easily read all plaintext traffic.
   • Discovering username and password credentials. Gaining access to systems. Disclosure of corporate data. Theft of data.
   • Strong encryption. Using virtual networks. Staff training: use of passwords, locking and portable storage devices. Network forensics.

4. Denial of Service (DDOS,DOS)

   • Flooding a server with useless traffic causes servers to become overloaded preventing them responding to legitimate client-server requests from users. Many DoS attacks, such as the Ping of Death and Teardrop attacks, exploit limitations in the TCP/IP protocols. DDoS is a type of attack where multiple compromised systems, which are often infected with a Trojan, are used to target a single system causing a Denial of Service attack.
   • Revenue losses: downtime affects profits. Based on industry surveys, the average cost of downtime is over £4000/minute Productivity Loss: when critical network systems are shut down, your workforce’s productivity comes to a halt. Reputation Damage: your brand suffers if customers can’t access your site or become casualties of a data breach.
   • • Strong security software (firewall). Packet filters on routers. Configuration of the webserver. Good network policy: audits, logs, monitoring.

5. Phishing

   • Phishing is an online fraud technique used by criminals to entice you to disclose personal information such as usernames, passwords and credit card details
   • Accessing a victim’s account and withdraw money or purchase merchandise or services. Open new bank or credit-card accounts in a victim’s names, and use the new account to cash illegitimate checks or purchase merchandise. Gaining access high-value corporate data. Financial services can blacklist institutions, resulting in reputational damage.
   • Make sure to have strong security software and make sure to train your staff to notice a fake email or website

6. Malware

   • Malware is any type of software created to infect a computer harmfully
   • To protect yourself from malware you not only need to have strong anti-virus software but you must keep it updated since new malware is developed every day
   • its made to cause damage or install other harmful programs

Imagens e arquivos do mapa