1.4 Network Security

Question 1

Encryption

Answer 1

The process of scrambling data so that it cannot be understood by anyone, but its intended recipient. It requires the use of a secret key to covert encrypted messages (Ciphertext) into unencrypted messages (Plaintext).

Question 2

Symmetric Encryption

Answer 2

Uses just one key to hide and read a message. If this key becomes public then all messages can be unlocked.

Question 3

Asymmetric Encryption - Public & Private Keys

Answer 3

Generates two keys – a public key and a private key. A public key can be given to anyone, but cannot decrypt a message - only the private key can do that. So long as the private key is never given out, messages will stay safely encrypted.

Question 4

Malware

Answer 4

Hostile/intrusive software used to infect computers and commit crimes (fraud, identity theft).
E.g. Viruses: Programs that are installed on computers designed to replicate itself, causing harm to data.

Identifying and Preventing:
Anti-malware software.
Firewalls.
Enabling software updates.

Question 5

Social Engineering

Answer 5

Exploiting the fact that people are weak points in secure systems.
E.g. Phishing: Emails that redirect a user to a fake website to trick the reader into giving confidential information( passwords) that can be used fraudulently.

Identifying and Preventing:
Staff training – awareness of spotting fake emails and websites/not disclosing personal information.

Question 6

Brute-force attacks

Answer 6

Trial an error methods used to decode encrypted data such as passwords and keys. It uses exhaustive effort to attempt to discover these sensitive details.

Identifying and Preventing:
Network lockout policy – locks account after 3 password attempts.
Strong passwords.

Question 7

SQL (Structured Query Language) Injection

Answer 7

A code injection technique used to attack data driven applications. Makes use of vulnerabilities in poorly coded database applications.

Identifying and Preventing:
Penetration testing – running a ‘fake’ hack to discover and exploit any vulnerabilities.
User access levels.

Question 8

Data interception and thef

Answer 8

An attacker monitoring data streams to and from a target in order to gather sensitive information.

Identifying and Preventing:
Encryption.
Physical security e.g. biometrics, locks.

Question 9

Distributed denial of service attacks (DDoS)

Answer 9

Flooding a network with useless traffic causing it to become overloaded and not respond normally.

Identifying and Preventing:
Firewalls – Software that monitors and filters traffic of a network.