Outcome 4 Flashcards
Reasons for Implementing Physical Controls
Minimizes or removes the risk of:
- harm to people
- information being accessed inappropriately
Ways to Physically Secure the Building
- CCTV
- Motion Sensors
- Physical Barriers to stop entry
- Security passes to authorize access to secure areas
- Biometric Authentication
- Alarm systems
- Security Guards
Ways of Protecting Development
- Version Control
- User Authentication
- Encryption
- Software Updates
Version Control
The practice of tracking and managing changes to source control.
Protects the integrity of the source code. Can also be used as a logging system - allows developers to check who added code to a solution
Single Factor Authentication
simplest method of authentication, just something you know
e.g. password
Two Factor Authentication
involves something you know, and something you have
e.g. a password AND an access token
Multi Factor Authentication
most complex form,
involves something you know, something you have, and something you are
e.g. a password, an access token and a biometric scan
Software Auditing
Designed to reduce the risks to software.
Not testing - instead looks at the quality of the software, not if it works etc
Software Auditing Examples
- Testing the software for security compliance (pen testing)
- Considering levels of user training required to operate the solution
- seeing if internal documentation is adequate
- identifying assets required to operate the solution
Data Breaches
Happens when personal information is accessed or disclosed without authorization
Man in the Middle Attacks
Eavesdropping attack that could occur when a transmission takes place, that causes communications and data to be exposed to unauthorized third-parties.
Causes a communication to be transmitted through a third computer system (which an attacker controls), which then forwards the data to both sides of the conversation.
Often sensitive data is harvested, such as login information, or bank details
Man in the Middle Attacks - Ways to Protect
- Reset all users passwords periodically
- Use encryption (HTTPS/VPN’s)
- Use 2FA
- Look out for unusual activity
- Such as a login from Russia
Social Engineering
Relies on the manipulation of human nature to persuade the victim to provide personal information or to initiate a transaction.
Uses basic tricks of con artists, such as flattery and friendliness to gain trust.
Social Engineering
- train users
- keep anti-virus software up to date
- Use spyware detection software
- Do not open email or SMS attachments
- refuse to give information over phone or by email
- use 2FA
XSS
Cross Site Scripting
Occurs when an web application includes user-supplied data in a page sent to the browser without properly validating or escaping the content prior to acceptance from the server.
Allows malicious scripts to be interested into other peoples web browsers
SQL Injection
When user input causes the resulting SQL query to change from its intended action
SQL Injection - can result in
- data being maliciously modified, leaked, deleted or edited
SQL Injection - to avoid
- Don’t use dynamic SQL Queries
- Prevent user supplied inputs from affecting the logic of the query
Ways to Manage Risks Posed by Third Parties
- Limit third parties access to data
- Use a confidentiality agreement to reduce the risk of the third party sharing data
- Only use third parties that are covered by Australian law - international third parties are not subject to aussie law
Accidental Threats
Threats that are made as the result of poor training or poor design of UI
e.g. deleting important data because the solution didn’t show a warning box
Event Based Threats
threats external to the organization and beyond the immediate control or influence of security planning to prevent
Deliberate Threats
Threats that are made as the result of deliberate, malicious acts
Main Characteristics of data Integrity
Correctness
Accuracy
Authenticity
Reasonableness
Relevance
Timeliness
acronym: CARART
Characteristics of Data Integrity - Accuracy
- Completeness - data is complete
- Clarity - data that isn’t ambiguous
- Consistency - data that is completely consistent
Characteristics of Data Integrity - Authenticiity
Data can be confirmed to come from a verified origin
Characteristics of Data Integrity - Reasonableness
checks if the data is plausible, makes logical sense, and satisfies common sense
Characteristics of Data Integrity - Relevance
measures how closely a resource - such as a document, database or webpage corresponds to that persons desire for information
Characteristics of Data Integrity - Timeliness
refers to the speed it takes for the data to be retrieved
Examples of Ethical Issues in Software Development
- Relationship between software developers and end users -> consider those who are put at risk as a result of the solution being built
- Acknowledging work - especially open source code
