Preventing Vulnerabilities Flashcards
1
Q
What is the purpose of a penetration test?
A
- To review the system’s security to find any risks or weaknesses and to fix them.
2
Q
Internal penetration tests:
A
- Done to see how much damage could be done by somebody within the company with a registered account.
3
Q
External penetration test:
A
- Are for white hat hackers to try and infiltrate a system from outside the company.
4
Q
Blind penetration tests:
A
- Are done with no inside information, to simulate what a real attacker would have to do to infiltrate the system.
5
Q
Targeted penetration tests:
A
- Conducted by the company’s IT department and the penetration team cooperating together to find faults in the system.
6
Q
What is anti-malware software used for?
A
- To locate and delete malware, like viruses, on a computer system.
7
Q
How does anti-malware software work?
A
- The software scans each file on the computer and compares it against a database of known malware.
- Files with similar features to malware in the database are identified and deleted.
8
Q
Why must anti-malware software be updated regularly?
A
- New forms of malware are created daily so we need to keep systems secure.
9
Q
Other roles of anti-malware software:
A
- Checking all incoming and outgoing emails and their attachments.
- Checking files as they are downloaded.
- Scanning the hard drive for viruses and deleting them.
10
Q
What does a firewall do?
A
- Manages incoming and outgoing network traffic.
11
Q
How do firewalls work?
A
- Each data packet is processed to check whether it should be given access to the network by examining the source and destination address.
- Unexpected data packets will be filtered out and not accepted to the network.
12
Q
Other roles of a firewall include:
A
- Blocking access to insecure / malicious web sites.
- Blocking certain programs from accessing the internet.
- Blocking unexpected / unauthorised downloads.
- Preventing specific users on a network accessing certain files.
13
Q
Secure Passwords:
A
- Usernames must be matched with a secure password to minimise the chances of unauthorised users accessing a system.
- Passwords should contain a mix of uppercase and lowercase letters, punctuation and numbers.
- Passwords should be of a substantial length (>= 8) and should be regularly changed.
14
Q
What are access levels used for?
A
- Used to only allow certain users to access and edit particular files.
15
Q
Read-Only Access:
A
- When a user can only view a file and is not allowed to change any data.
- e.g a teacher might set read-only homework instructions.
16
Q
Read and Write Access Levels:
A
- Allows a user to read and edit the data in a file.
- e.g teacher might set an online workbook as read and write for students to fill in.
17
Q
Why are user access levels important?
A
- So only authorised users can view and change the data.
- The more users who have access to a file, the more likely it is to be compromised.
18
Q
No Access:
A
- Can’t view or edit a file.
19
Q
What is encryption?
A
- The process of scrambling data into an unreadable format so that attackers cannot understand it if intercepted during transmission.
20
Q
How does encryption work?
A
- The original data (plaintext) is converted to scrambled ciphertext using an encryption key.
- Only at the correct destination will the encryption key be used to convert the ciphertext back into plaintext to be understood by the receiving computer.
21
Q
Physical Security Methods:
A
- A lock can be used to prevent access to server rooms or locations that store confidential data.
- Only authorised people with a matching key will have access.
- Biometric devices require the input of a human characteristic (like fingerprint, iris, voice).
- The biometric data is checked against previously inputted data in a database. Only a match will allow access to the user.
- Keycards, security staff, CCTV cameras, alarms
