Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Yr 10/B Cp1 > 6 Fundamentals Of Cyber Security > Flashcards

6 Fundamentals Of Cyber Security Flashcards

1
Q

What are the different forms of attacks?

A

Insider attack
Active attack
Passive attack
Social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Social engineering?

A

When a person is exploited into giving away critical information that gives access to the network or accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is an insider attack?

A

When someone in an organisation gives away access details or sensitive information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an active attack?

A

When someone uses malware or other technical methods to compromise a network’s security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a passive attack?

A

When a hacker eavesdrops on a network by ‘sniffing’ the data packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What do hackers do to overcome authentication mechanisms?

A

Hackers mainly crack passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is cracking the password?

A

Finding people’s passwords to overcome authentication is called cracking the password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the brute force attack?

A

A brute force attack tries to crack a password by trying every single combination of letters and numbers until the correct one is found.
This can take a very long time, although special software is used to do this which makes it possible to make millions of attempts per second

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the Dictionary attack?

A

A quicker form of the brute force attack is the dictionary attack.
Rather than attempting every single combination, a dictionary attack tries words from a predetermined list:
A common dictionary to use would be a list of common passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How do you protect against cracking?

A

Writing a network policy which enforces strong passwords can protect against dictionary attacks.
Using two-factor authentication can prevent the hacker from logging in, even if they have the password.
Restricting the number of failed password attempts before an account is ‘locked’ for a fixed period of time can deter hackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a Denial of Service attack?

A

A denial of service (DoS) attack tries to bring down a server by flooding it with useless traffic
The attack aims to overload the server. This stops the server responding to legitimate traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you protect against Denial of Service (DoS) attacks?

A

To protect against DoS attacks, a server’s firewall can blacklist (ban) any traffic from an IP address which is known to perform DoS attacks.
Firewalls can also monitor traffic in real time. So if a new IP address starts to send too much traffic then traffic limits can be set.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Distributed DoS attacks?

A

Distributed DoS (DDos) attacks are commonly used to overcome the blacklisting of an IP address because of a high number of requests
In a DDoS attack, the requests are sent from an army of compromised machines, known as a botnet
Botnet machines are infected with malware which allows a hacker to send requests from their computer
The botnet can launch a huge number of simultaneous requests. The owners of the devices in the botnet might not even realise they are taking part

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Authentication?

A

Authentication is the name for any methods which allow users to prove that an account is theirs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Penetration testing?

A

Penetration testing identifies vulnerabilities in a network’s security by attempting a controlled attack on the network
This usually involves carrying out multiple types of attack to see which is most successful
Penetration testing is done by the organisation itself, or an external organisation or contractor they have hired

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a good penetration test?

A

A good penetration test will check:
Technical vulnerabilities
Likelihood of social engineering
A test of damage recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Why do organisations perform penetration tests?

A

Organisations choose to perform penetration testing to try to find vulnerabilities before criminals do
If an organisation can find and fix a bug before it is exploited, it can save time and money

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the two types of Penetration testing?

A

Black-box penetration testing

White-box penetration testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is black-box penetration testing?

A

A black box penetration test is done outside of an organisation
A system administrator might pay an outside organisation to attempt to gain access to their systems in a controlled way
This will allow the system administrators to experience a ‘practice’ attack which is very similar to a real attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is White-box penetration testing?

A

A white box penetration test is done inside an organisation
In a white box penetration test, system administrators will test how vulnerable the system is against someone with knowledge of the system, and possibly a user account with low access rights
This will help to prevent insider attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Cold calling?

A

Social engineers often cold call victims and pretend to be from an organisation such as a bank
The social engineer will then ask a victim to confirm their details, so that they can use these details to access their account later

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Why do social engineers use fear?

A

Fear is often used to put people off-guard and make them more likely to comply
Social engineers know that people will make irrational decisions when panicked

A common attack would be to call someone pretending to be a bank, and ask why they have emptied out their account:
This would panic the victim, who would then want to sign into their account straight away over the phone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the weakest point in most networks?

A

People

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the tactics used to help prevent Social Engineering?

A

Education and Training
Public Awareness Campaigns
Company Security Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the types of Social engineering attacks?

A

Pharming
Shouldering
Blagging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is Pharming?

A

Pharming is where an attacker will set up a fake website, and try to redirect people to it
This is often done through attacks on DNS servers, or by using common misspellings of links

27
Q

What is Shouldering?

A

Shouldering is where an attacker will gain information by physically watching a user.
Shouldering can be done in two ways:
Watching someone in person, e.g. someone entering a password.
Using screen capture software

28
Q

What is Blagging?

A

Blagging is where an attacker will pretend to be involved with an organisation in order to gain information
For example, an attacker may pretend to be an employee and ask a fellow employee what a code for a door is because they are new and have forgotten

29
Q

What is Phishing?

A

Phishing uses fake emails and websites to trick people into giving away their sensitive data
Emails are sent to thousands of people, claiming to be from a known service such as a bank or utility provider
Victims are taken to a realistic looking but fake version of the site where they log in. This gives their details to the attackers

30
Q

How do you protect yourself against phishing?

A

Never click a link in an email that asks you to update or enter your account details.
Check that the sender’s email address is correct.
Look for clues that the email is not legitimate such as spelling mistakes or generic greetings

31
Q

What is Malware?

A

Malware is any kind of malicious software that is installed without your knowledge or intent

32
Q

What are Viruses?

A

Small pieces of code injected into other programs which spread from computer to computer

33
Q

What are Worms?

A

Small pieces of code which spread across a network, similar to viruses but without a host program

34
Q

What are Trojan horses?

A

Any form of malware which tricks the user into installing it by pretending to be a different program

35
Q

What is Ransomware?

A

Ransomware encrypts files on an infected system and only decrypts files once a payment has been made to the hacker

36
Q

What is Spyware?

A

Gathers information about a user by tracking their activity

37
Q

What are Rootkits/

A

Rootkits:

Malware which modifies the computer’s operating system to avoid detection by antivirus software

38
Q

What are Backdoors?

A

Malware which opens up an access channel to a computer that other malware can use to take over the machine

39
Q

What techniques are used by malware to spread across a network as fast as possible?

A

Installations
Replication
Attachments

40
Q

How do Installations help spread Malware across a network?

A

Users often willingly install malware if they are tricked into thinking that they are installing a different piece of software
Common ‘disguises’ for malware include:
Security updates
Software drivers

41
Q

How does Replication help spread Malware across a network as fast as possible?

A

Once one device on a network has been infected with a worm or a virus, then it becomes very easy for it to spread to other devices on the network
The process of spreading to other computers is called self-replication

42
Q

How do Attachments help spread Malware across a network?

A

Opening attachments in emails such as Word and Excel documents can include ‘macros’
A macro is a small program that is given permission to run on the computer
The macros can be set up to install malware

43
Q

What is a Macro?

A

A macro is a small program that is given permission to run on the computer

44
Q

Why do we use Anti Virus/Malware Software?

A

These pieces of software can help to identify and quarantine malware.
Quarantining a piece of software prevents it from running and allows users to decide whether to:
Attempt to remove a virus from the software.
Destroy the software

45
Q

What is Anti-Virus Software?

A

Anti-virus software provides real-time ‘on-access’ scans of files to detect if they have been infected by a virus
That means that when a file is opened, the anti-virus checks that it has not been infected

46
Q

Waht is Anti-Malware Software?

A

Anti-malware software performs periodic scans of the system

Anti-malware software detects unknown pieces of malware, and removes them from the computer

47
Q

What are Firewalls?

A

A firewall is either a hardware device or a piece of software which sits between a device and the Internet
Firewalls inspect and filter incoming and outgoing data packets
They try to stop hackers gaining access to the network and stop malware getting into the network

48
Q

What is IP-address Filtering?

A

The firewall only allows traffic from certain known sources

This can be used to prevent denial of service attacks

49
Q

What is Port-Blocking?

A

Firewalls can block access to certain ports
One important port is port 22, which allows remote access via the Internet. By blocking this port, we can prevent hackers trying to take over the server

50
Q

How methods are used to prevent Cyber Attacks?

A

Email Verification
Biometric authentication
Automatic Updates
CAPTCHA

51
Q

What is Email Verfication?

A

Email verification is a tool used on many websites to ensure that a certain email address really does belong to a user
This is usually done during registration, where a user will sign up and then have to click a special verification link in an email to confirm their email
This prevents people from using other people’s email addresses to create accounts

52
Q

What is Biometric Authentication?

A

Biometric devices are a method of authentication which scan a part of the user’s body to authenticate them
Biometric devices include:
Fingerprint scanners
Retina scanners
Facial recognition
Biometric devices can sometimes be inaccurate, and either allow an attacker into the system, or not allow a valid user to access their system
Biometric devices do not require anything to be memorised

53
Q

How do Automatic Updates help prevent Cyber Attacks?

A

Automatic updates can either be for software or security definitions
Security definitions are used by antimalware and antivirus software to identify specific pieces of malware.
These updates are usually automated to make sure that as many users as possible are protected at all times

54
Q

How does CAPTCHA help prevent Cyber Attacks?

A

CAPTCHA is a computer program designed to determine if a user of a system is a human or a machine
It usually does this by asking the user to solve a problem such as selecting images where a certain item appears from different angles
CAPTCHA is often used on websites to avoid spam content by bots

55
Q

What are Access rights?

A

Users of a computer system can be given different access rights for different files on the system
For example, for each file on the system we might keep a record of whether each user can:
Read the file
Write to the file
Execute the file

56
Q

What are User Access Levels?

A

Network users can be arranged into user groups
Each group can then be given different access rights
This makes it easy to manage the access rights of a large group of people (e.g. employees)

57
Q

What are the advantages of User Access Levels?

A

We can limit the access rights of ‘normal’ users on the network. For example:
Not allowing them to install software
Not allowing them to create new user accounts
Not allowing them access to confidential information
These rights can be limited to the administrators only

58
Q

When are passwords effective?

A

Passwords are effective when:
They are kept secret
The password is strong enough against Brute Force attacks

59
Q

What is the purpose of passwords?

A

Passwords help to prevent unauthorised users from accessing a device or network
Passwords are one of the simplest authentication methods

60
Q

What should a strong paaword be like?

A 
A strong password should:
Be long
Use letters, numbers, and symbols
Be changed regularly
Never be written down
61
Q

What is Encryption?

A

Encrypting data is the process of scrambling data according to a specific algorithm so that it cannot be read by third parties
Only the intended recipient will know how to decode the data

62
Q

What are keys for encryption?

A

A lot of encryption depends upon keys, which are shared secrets
Keys are made up of a pair of very large prime numbers, either 256 or 1,024 bits long
It would take an impractical amount of time to guess the key. So we say that the encryption is secure

63
Q

What are the first three sections of a URL?

A

Protocol
Path
Domain

64
Q

What does CAPTCHA stand for?

A

Completely Automated Public Turing test to tell Computers and Humans Apart.

Yr 10/B Cp1 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions