Outcome 4 Flashcards
Reasons for Implementing Physical Controls
Minimizes or removes the risk of:
- harm to people
- information being accessed inappropriately
Ways to Physically Secure the Building
- CCTV
- Motion Sensors
- Physical Barriers to stop entry
- Security passes to authorize access to secure areas
- Biometric Authentication
- Alarm systems
- Security Guards
Ways of Protecting Development
- Version Control
- User Authentication
- Encryption
- Software Updates
Version Control
The practice of tracking and managing changes to source control.
Protects the integrity of the source code. Can also be used as a logging system - allows developers to check who added code to a solution
Single Factor Authentication
simplest method of authentication, just something you know
e.g. password
Two Factor Authentication
involves something you know, and something you have
e.g. a password AND an access token
Multi Factor Authentication
most complex form,
involves something you know, something you have, and something you are
e.g. a password, an access token and a biometric scan
Software Auditing
Designed to reduce the risks to software.
Not testing - instead looks at the quality of the software, not if it works etc
Software Auditing Examples
- Testing the software for security compliance (pen testing)
- Considering levels of user training required to operate the solution
- seeing if internal documentation is adequate
- identifying assets required to operate the solution
Data Breaches
Happens when personal information is accessed or disclosed without authorization
Man in the Middle Attacks
Eavesdropping attack that could occur when a transmission takes place, that causes communications and data to be exposed to unauthorized third-parties.
Causes a communication to be transmitted through a third computer system (which an attacker controls), which then forwards the data to both sides of the conversation.
Often sensitive data is harvested, such as login information, or bank details
Man in the Middle Attacks - Ways to Protect
- Reset all users passwords periodically
- Use encryption (HTTPS/VPN’s)
- Use 2FA
- Look out for unusual activity
- Such as a login from Russia
Social Engineering
Relies on the manipulation of human nature to persuade the victim to provide personal information or to initiate a transaction.
Uses basic tricks of con artists, such as flattery and friendliness to gain trust.
Social Engineering
- train users
- keep anti-virus software up to date
- Use spyware detection software
- Do not open email or SMS attachments
- refuse to give information over phone or by email
- use 2FA
XSS
Cross Site Scripting
Occurs when an web application includes user-supplied data in a page sent to the browser without properly validating or escaping the content prior to acceptance from the server.
Allows malicious scripts to be interested into other peoples web browsers
