1.4.2 Identifying and Preventing Vulnerabilities Flashcards
1
Q
What is Penetration Testing?
A
- Carried out as part of ethical hacking
- Purpose to find weaknesses and fix them
- Used to help prevent SQL injections
2
Q
What are the 4 types of Penetration Testing?
A
- Internal Test
- External Test
- Blind Tests
- Targeted Test
3
Q
What is an Internal Test?
A
- To see how much damage can be done by someone in the company with a registered account
4
Q
What is an External Test?
A
- Completed by white hat hackers to try and infiltrate from the outside of a company
5
Q
What are Blind Tests?
A
- Are done with no inside information to try and simulate what a real attacker has to do to infiltrate.
6
Q
What is a Targeted Test?
A
- Conducted by IT and penetration team to find faults in the system
7
Q
What is Anti-Malware Software?
A
- Used to locate and delete malicious software on a computer.
- Scans files and compares to a database of known software.
- If malware found it quarantines the file and user can delete it.
- Anti-malware must be kept updated so any new malware can be added to database.
8
Q
What is Firewall?
A
- Manages incoming and outgoing network traffic
- Each data packet is checked if it should be given access to the network by examining the source and destination address
- Unexpected packets can be filtered out and not accepted to the network.
9
Q
What are some examples of Firewalls?
A
- Blocking access to insecure/malicious websites
- Blocking unexpected/unauthorised downloads
- Blocking certain programs from accessing the internet
- Preventing specific users on a network from accessing certain files.
10
Q
What should a Secure Password have?
A
- At least 10 characters
- Made up of uppercase and lowercase letters, numbers and punctuation
- Regularly changed
- Don’t use the same password for multiple accounts
- Never share passwords or write them down
11
Q
What are User Access Levels?
A
- Usually set by Admin or IT manager
- Only allow certain users to access/edit particular files or folders.
- Read - only, a user can only view a file and is not allowed to change data in the file
- Read and Write, a user can read and edit the data in the file
- Important that access levels are set to reduce the files becoming compromised.
- Some users will have no access to the file
12
Q
What is Encryption?
A
- Process of scrambling data into an unreadable format so that attackers can’t understand the data if it is intercepted.
- Original data is converted using an encryption key and only at the correct destination will the encryption key unscramble the data.
13
Q
What is an example of Encryption?
A
- Caesar Cypher
14
Q
What is Physical Security?
A
- Locks
- Biometric devices
- Keycards
- Security staff
- CCTV cameras
- Alarms
