3.6 Fundamentals Of Cyber Security

Question 1

Cyber security definition:

Answer 1

= the technologies, practices and processes used to protect networks, data, programs & computers against damage, cyber attacks & unauthorised access

Question 2

List the cyber security threats:

Answer 2

• social engineering techniques
• malicious code
• weak and default passwords
• misconfigured access rights
• removable media
• unpatched and/or outdated software

Question 3

Social engineering techniques:

Answer 3

-

Question 4

Malicious code

Answer 4

web scripts designed to create system vulnerabilities in order to upload malware
(leading to back doors, security breaches, information and data theft, and other potential damages to files and computing systems)

Question 5

Weak and default passwords

Answer 5

• big security risk as can be easily cracked
  hackers use:
• brute force attacks to get past short/simple passwords easily
• social engineering to figure out commonly used passwords (birthdays/addresses)

Question 6

Misconfigured access rights

Answer 6

Users being given access to info they should not have access to

Question 7

Explain removable media:

Answer 7

• malware can get onto device by being hidden in removable media

Question 8

Unpatched and/or outdated software

Answer 8

• could be more easily exploited by hackers, malware, viruses

Question 9

Penetration testing definition:

Answer 9

= process of attempting to gain access to resources without knowledge of usernames, passwords and other normal means of access
= when organisations employ specialists to stimulate potential attacks to their system to identify possible weaknesses in their cyber security

Question 10

what does White-box penetration testing do?

Answer 10

= simulates a malicious insider who has knowledge of the target system (employee)
(Given some credentials)

Question 11

what does Black-box penetration testing do?

Answer 11

= simulates an external hacking/cyber warfare attack, (not given any credentials)

Question 12

Social engineering definition:

Answer 12

= art of manipulating people so they give up confidential information (of networks)

Question 13

List the forms of social engineering:

Answer 13

• pharming
• phishing
• shouldering (shoulder surfing)
• blagging

Question 14

What is pharming?

Answer 14

Cyber attack intended to redirect a websites traffic to another, fake site using malware

• fake site designed to look the exact same
• user will enter personal info which will be taken by the criminal

Reduce risk by ensuring anti-malware software up-to-date

Question 15

What is Phishing?

Answer 15

Technique of fraudulently obtaining private info, often using email/SMS
- criminals send emails/texts to people claiming to be a well-known business (bank), often lead to fake websites

Reduce risk = many email programs, browsers, firewalls have anti-phishing features (reduces amount of phishing emails received),
other giveaways = poor grammar, urgency, unknown email address,
Be cautious around emails asking to follow links/update personal details

Question 16

What is Shouldering (shoulder surfing)?

Answer 16

Observing a person’s private info over their shoulder (cashpoint machine PIN numbers)

Reduce risk = be discreet/careful

Question 17

What is Blagging?

Answer 17

Act of creating & using invented scenario to engage targeted victim in a manner that increases the chance victim will reveal info or perform actions unlikely in ordinary circumstances (money for friend)

• someone makes up story/pretends to be someone they aren’t
• someone phones the victim , trying to gain their trust

Reduce risk = use security measures that can’t be given away (biometrics)

Question 18

Malware (malicious software) definition

Answer 18

= refers to a variety of forms of hostile/intrusive software, designed to cause harm/gain unauthorised access to computer system

Question 19

Types of malware:

Answer 19

• computer virus
• Trojan
• spyware
• adware

Question 20

What is a computer virus?

Answer 20

• attach (by copying themselves) to certain files

- users spreads them by copying infected files & activate them by opening infected files

Question 21

What is a Trojan?

Answer 21

• malware disguised as legitimate software
• don’t replicate themselves, unlike viruses/worms
• users install them not realising they have a hidden purpose

Question 22

What is Spyware?

Answer 22

• secretly tracks actions (key presses) and sends info to hacker (who might be able to work out things like passwords/bank details

Question 23

What is Adware?

Answer 23

• can cause pop-up ads that can’t be closed

Question 24

How can you protect against malware?

Answer 24

-

Question 25

List the types of security measures/user authentication:

Answer 25

• biometrics
• passwords
• CAPTCHA
• email confirmation
• automatic software updates

Question 26

Explain biometric measures:

Answer 26

• use scanners to identify people by unique part of their body (fingerprint, retina)
• many different uses (smartphones contain fingerprint scanners to prevent unauthorised access)
• usually quite secure/convenient for users (don’t have to remember password) - but often more expensive to implement as require special hardware

Question 27

Explain password systems:

Answer 27

• simple method of checking someone’s identity
• should be strong (many characters long, combination of letters /numbers / symbols) and changed regularly
• weak/default passwords = big security risk as can be easily cracked
• hackers can use brute force attacks to get past short/simple passwords easily & social engineering to figure out commonly used passwords (birthdays/addresses)

Question 28

Explain CAPTCHA

Answer 28

= ‘Completely Automated Public Turing test to tell Computers and Humans Apart’

• designed to prevent programs automatically doing certain things (creating user account on website)
• usually consists of simple task (recognising animals, typing blurred/distorted words)
• tests rely on computers not being able to read images as well as human can
• but as image recognition software & artificial intelligence developing, machines becoming more capable of passing these tests

Question 29

Explain email confirmation:

Answer 29

• used by most web services that require account registration to confirm email address belongs to person registering
• used to stop people from using fake email addresses to sign up
• however as lots of webmail services free, people can usually sign up for new email address whenever they want, so not always effective for confirming someone’s identity

Question 30

Explain automatic software updates:

Answer 30

• used to patch/fix any identified security holes in piece of software
• so software is less easily exploited by hackers, malware, viruses