9. Security and Data management Flashcards
Methods of identifying vulnerabilities (3)
🔎footprinting
🔎ethical hacking
🔎penetration testing
Footprinting definition and purpose
Gathering all available information about the network/system
Enables a tester to see how much information a hacker could find and allows company to remove it
Ethical hacking definition
Hacking carried out with systems permission (to search for weak points)
Penetration testing definition
A subset of ethical hacking
Testing system to find vulnerabilities done by software or manually
Penetration testing types
Targeted testing
External testing
Internal testing
Blind testing
Targeted testing definition (done by who)
Done by IT and pen testing team together
External testing definition/purpose
See how far in an attacker can get
Blind testing definition/purpose
Limit information available to tester to simulate a real hacker’s actions
Different forms of attack based on technical weakness (3)
DoS attack, password attack, IP address spoofing
Different forms of attack based on user behaviour (2)
Social engineering, phishing
DoS attack definition
Computer system becomes unavailable to intended users. Sometimes caused by bombarding System with emails/requests
Brute force password attack definition
Hacking algorithm tries all combinations until one fits
Dictionary password attack definition
Systematically trying every word in dictionary until it finds a password
IP address spoofing definition
A false IP address is put into a data packet to hide the senders real identity
Social engineering definition
Manipulation of someone to divulge confidential information e.g. password
Phishing definition
Attempting to gain confidential/personal information by pretending to be an official site
Malicious software/malware definition
Any software that could be used to disrupt a computer’ operation/compromise a user
Virus definition
Computer programs that copy themselves onto other programs, often with malicious intent (e.g. damage data, fill the hard drive, shut down the computer unexpectedly)
Worm definition
Like viruses but replicate in order to spread to other computers in a network
Key loggers definition
Capture user’s keystrokes and sends to a 3rd party
Trojan definition
Appears to perform a useful function but provides a ‘backdoor’ for data to be stolen & sent to third party
Methods of protection against dangers that arise from use of networks (other than firewalls, antivirus programs) (3)
- Keeping software updated regularly
- Using security tools (e.g. password strength checkers)
- Training personnel to take sensible precautions (e.g. not inserting flash memory given by a stranger)
Disaster recovery policy purpose
So everyone knows how to cope in the event of a disaster where all work is potentially lost (e.g. fire)
Disaster recovery policy aims (4)
- Minimise interruptions to normal operations
- Limit extent of disruption and damage
- Establish alternative means of working so staff know how to proceed
- Provide for smooth and rapid restoration of service
