Data security and integrity processes Flashcards
paper 2
what do cyber attack vectors do
deliver malware/effect a malicious outcome eg obtaining personal data
is a pathway by which a hacker can gain access to computer network
virus
software which will attempt to spread over the network via infecting emails, removable storage devices etc.
trojans
similar to virus but hidden in files or programs - when files open trojan is activated
spyware
tracks key presses and software use to send back to hacker
commonly used of identification fraud
ransom ware
software that will delete, collect or encrypt files which they will ransom back
botnets
creates a back door to your computer allowing a hacker to use it without your permission
they can then use your computer to launch further attacks
phishing
cybercrime in which target is contacted by someone posing as legitimate institution to lure them into providing sensitive data.
accidental damage
when employees move, delete or update files which they weren’t supposed to
as they are not predictable they are hard to protect against
tends to happen due to lack of training, insufficient security on key files and fatigue
black hat hackers
break into systems for their own purpose eg financial gain
white hat hackers
use skills to break into system to expose flaws and advise on how to fix them (employed by company)
grey hat hackers
white hat hackers that aren’t directly hired by company but perform penetration testing anyway to expose flaws (often for hopes of being hired)
what is a contingency plan
plan to be enacted should a disaster happen
needs to be created, tested and maintained
needs to consider:
- what data is important
- frequency of backup needed
-can backups be automated
- can operations be moved to cloud
components of a contingency plan
frequency of backup of systems
data stored off-site in secure location
alternative means of communication just in case
plan for retrieval of data
data security
techniques and technology intended to keep data safe from theft/deliberate corruption
data integrity
keeping data intact and consistent even in a situation when some data is lost -done by keeping copies of data
security risks to modern systems
outside access of files
corruption of data
unauthorised reading/duplication
loss/deliberate deleting
symmetric encyrption
single key used for both encryption and decryption of data
only trusted parties must know shared secret key
symmetric encryption pros
quick to set up and easy to execute
faster
symmetric encryption con
very easy for modern computers to crack using brute force
asymmetric encryption
2 different keys:
public encryption key to send messages but only recipient has private decryption key to read messages
asymmetric pros
much more secure as even if message is intercepted it cannot be read + harder to crack key
asymmetric cons
very complex
much slower than symmetric
keys are harder to generate
protection for systems often used
-clerical procedures eg removing USB ports to prevent theft of data and virus implantation
- levels of permitted access
- passwords
cryptography (encryption)
techniques that render data unreadable to anyone beside intended recipient.
biometrics
the use of unique characteristics of a human body to generate biometric authentication and protect data security
eg facial recognition
finger prints etc
fingerprint recognition pros
low rate of errors using fingerprint scanner compared to other biometrics
fingerprint unique to each person so good at IDing people
modern tech detects blood flow so fake fingerprints won’t work
fingerprint recognition con
false negative could come from age, dirt etc
iris vs retinal scanners
iris reads surface of the iris while retina reads layer of blood vessels behind the eye
retina considered to be more effective as can authenticate those who are blind (or have lack of pigment in iris)
retina is also more invasive as requires person to be very close to scanner
voice print recognition
measures pauses, accents as well as what they say
used with few authenticated users
errors arise from factors eg background noise
biometric pros
very hard to replicate data
biometrics cannot be lost, stolen or forgotten like conventional passwords
no one can trick you into revealing your biometric info
faster and easy to identify
biometric cons
people change over time (aging, illness, injury)
privacy concerns on use of the data
if data is compromised user cannot replace it (eg get new finger)
large amounts of data must be processed and stored for each use
penetration testing stages
involves trying to break into system by finding vulnerabilities
1. reconnaissance (finding info about system)
2. scanning
3. gaining access
4. maintaining access
5. clearing tracks
