1.4 Network security

Question 1

Forms of attack

Answer 1

-Malware
-Phishing
-Brute-force attack
-Denial of service attack
-Data interception and theft
-SQL interjection

Question 2

Malware

Answer 2

Any type of harmful program that seeks to damage or gain unauthorized access to your computer system
-e.g. viruses, trojans, ransomware, spyware, adware

Question 3

Method of prevention - Malware

Answer 3

-strong security software - firewall, antivirus, antispyware, antispam
-enabling security software updates
-backup files regularly onto removable data

Question 4

Phishing

Answer 4

-The fraudulent practice of sending emails pretending to be from reputable companies in order to trick individuals in revealing personal information
-e.g. usernames, passwords, credit card details
-e.g. an e-mail has a link that when clicked directs the users to a fake website that collects personal data

Question 5

Method of prevention - phishing

Answer 5

-Network policies
-staff training: awareness of spotting fake emails and websites, not disclosing personal or corporate information, disabling browser pop-ups

Question 6

Brute force attack

Answer 6

-A trail and error method of attempting passwords and pin numbers. Automated software is used to generate a large number of consecutive guesses

Question 7

Method of prevention - brute force attack

Answer 7

-network lockout policy - lock accounts after 3 passwords
-staff training: using effective passwords with symbols, letters, numbers, mixed case
-challenge response ‘I am not a robot’ - reCAPTCHA

Question 8

Denial of service attack

Answer 8

Flooding a server with useless traffic causing the server to become overloaded and unavailable

Question 9

Method of prevention - DOS attack

Answer 9

-strong firewall
-packet filters on routers
-auditing, logging, monitoring systems

Question 10

Data interception

Answer 10

When data packets on a network are intercepted by a third party and copied to a different location that the intended destination
-e.g. monitoring traffic on the network to pick out encrypted passwords, configuration information

Question 11

Method of prevention - data interception

Answer 11

-encryption
-staff training: use of passwords, locking computers, logging off

Question 12

SQL injection

Answer 12

When a malicious SQL query is entered into a data input box on a website to trick it into giving unauthorized access to its database

Question 13

Method of prevention - SQL injection

Answer 13

-validation on input boxes
-using parameters queries
-setting database permissions
-penetration testing

Question 14

Methods of physical security

Answer 14

-lock used to prevent access to server rooms
-biometric devices the require the input of human characteristics (fingerprint)
-CCTV cameras
-keycards
-alarms

Question 15

Penetration testing

Answer 15

Ethical hacking to find any risks or weaknesses and fix them
-internal testing by somebody within the company
-external testing - white hat hackers try to infiltrate a system from outside the company

Question 16

Anti-malware software

Answer 16

Used to locate and delete malware on a computer system
-scans each file, compares it against a database of known malware
-files with similar features to malware in the database are identified and deleted

Question 17

Firewall

Answer 17

Manages incoming and outgoing network traffic
-each data packet is processed to check whether it should be given access to the network by examining the source and destination address