25-30 Flashcards
Cyberattack
Cyberattacks are malicious acts in which a computer system comes under attack by unauthorised persons (hackers).
What is malware?
Malware is any software that is hostile, malicious or intrusive.
Types of malware
Ransomware Adware Spyware
Keyloggers Bots Worms Virus Trojans
anti malware
- This is software designed to detect, quarantine and destroy potentially dangerous programs.
- When a file enters the system, anti- malware software will scan the file for known malicious code.
- If it finds a problem, the malicious program is quarantined so that it cannot affect the system.
- The user is then notified and can decide where to let it in or delete it.
ransomware
- Form of malware that encrypts a victims files.
- The attacker demands money to restore access to the data.
- Users are shown instructions on how to pay a fee to get the decryption key.
Explain why it is important to keep anti-malware up to date.
-New antimalware is being created all the time, so it must be kept up to date to recognise the malicious code.
Describe how anti-malware works with signature databases.
- Any file coming into the computer is scanned.
- The file contents are compared to a database of virus signatures.
- If any of the signature patterns are found in the file, it’s identified as a virus.
Static heuristic analysis
This involves reverse engineering (decompiling) the code and inspecting the source code.
- This is compared to the code of known viruses.
- If enough of the code matches, it’s identified as a virus.
Dynamic heuristic analysis
- The program is run in an isolated, controlled environment known as ‘SANDBOX’.
- The analysis looks at each command that the program runs.
- It it identified as suspicious behaviour common to viruses, then the program is identified as a virus.
Explain why heuristic analysis is so valuable for the identification of viruses
Heuristic analysis can catch very new viruses because it does not rely on updating a signature database.
Heuristic analysis may not be 100% reliable
May identify a false positive or may not identify a threat at all.
In static heuristic analysis:
- A valid program may contain binary code that just happens to match part of the virus.
- The valid program will be identified as a virus.
In dynamic heuristic analysis
- A virus may delay actioning its malicious intent.
- It may therefore be let out of the sandbox before it has executed the part of its code that infects the machine.
hacker
A hacker is a person who attempts to gain or gains unauthorized access to a computer system.
Patches
Patches are security fixes for existing software. The vulnerabilities that are fixed are often common knowledge or easily discovered.
firewalls
Firewalls are software.
They are designed to monitor and block incoming and outgoing connections to a network.
Firewalls protect a system from hackers.
If a hacker is already inside the system, they may be prevented from doing extra damage by the firewall blocking outgoing traffic
ethical hacking and penetration testing
Ethical hacking
Hacking in order to help organisations protect themselves from malicious hackers.
Penetration testing
Ethical hackers may be employed to break into systems in order to identify security weaknesses..
social engineering
Social engineering is practised on people, not computers.
Hackers (social engineers) exploit human behaviour, fallibility and goodwill to gain confidential information.
AUPs
AUP - Acceptable Use Policy
An AUP is a collection of rules and procedures that employees are required to follow in order to protect their organisation’s system and networks.
Common AUPs
limits on access to the internet
preventing user downloading files or installing software
preventing user plugging in external devices (USB sticks )
training users to recognise phishing emails
multi-factor authentication
training users not to give out confidential information over the phone
preventing user from removing files from the premises.
Phishing
Phishing uses an email and fake website to trick users into giving away personal data. A phishing email pretends to be a real message from a known business or organisation.
It entices the recipient to visit a fake website. Once on the website, they’ll be asked to enter their personal details.
pretexting
The attacker invents a pretext for contacting an employee over the phone, pretending to be from a known organisation.
They will engage the employee in conversation in order to find out personal information about them or sensitive information about a customer.
They later use this information to gain something or sell it on to other criminals. These types of attack may be targeted using research done through social networking sites.
baiting
Baiting attacks exploit people’s natural curiosity to gain information.
They may offer something free or exclusive to manipulate the user.
Often, the attack results in the user
downloading malware that is then run on their machine.
Quid pro quo
A quid pro quo attack exploits a person’s belief that they can get something of value for free.
Malware is presented as a freebie, a giveaway, or as some other kind of reward.
Encryption
Encryption is the process of converting data into an illegible, scramble format so that it cannot be understood by unauthorised parties.
Data may still be accessed and read by the hacker, but will be understandable.
backup and recovery
Backing up involves taking a copy of the data and storing it in a different location.
Recovery is the process of using a back-up copy of data to restore a database or system to the correct state when a failure occurs.
Describe how backup and recovery procedures protect against data loss
- Backup is effective only if completed regularly.
- Incremental and full backups can be used to create copies of data that can be restored later if the original is lost or damaged.
Encryption
Scrambling or changing the original data so that only the
intended recipient can decode and read it.
