PRV2

Question 1

Outside Attackers

Answer 1

Hackers, crackers:
Motives: challenge, self esteem, rebellion status money

Types

• > white hats (usually penetration test or the like, within legal scope)
• > grey hats (prove abilities find flaws within a system, highly skilled, publish security loopholes)
• > Black hats (criminal intent)

Script Kiddies

• Motive attention
• Often immature
• Use existing tools

Intelligence agencies (on behalf of governments)

Terrrorist (blackmail, destruction, revenge, political motives, media coverage)

Industrial espionage (competitive advantage, disruption)

Inside perpetrators (self esteem, espionage, money, revenge, accidents)

Question 2

Attacks Example

Answer 2

Eavesdropping (Key-Logger installed)

Unauthorized access to data

Password sniffing: Stealing passwords as man in the middle attack

spoofing: pretend different identity to gain advantage phishing

denial of service: Try to make server unavailable by sending too many request e.g. DDOS by bot nets

ransomware: lock the computer by a malware

social engineering: try to get information to exploit Security Questions for password resets (nowadays not that easy as then because of 2FA and notifications)

identify theft: people creating fake accounts to defame a real person

Online fraud: Selling products in advance without ever getting the product

Question 3

Disclosure and Sharing of Information Sec.

Answer 3

An increasing number of organizations disclose practices regarding information security (e.g. annual report)

• > signal activity and engagement in information security
• > Might deter hackers due to a decreased probability of a successful attack

Information sharing among firms can reduce security breaches

• > Security related information offered by multiple organizations can provide a more integrated view of relevant security risks
• > More valuable in competitive industries (high similarity, similar potential, security risk, benefit from share information)

Question 4

certifications as signals

Answer 4

organization can have there processes audited and certified

this signals information security activities to partners, customers, and other entities ( e.g Attackers)

e.g ISO270001, IT Grundschutz (BSI)

Individuals can obtain certificates as well ( certified information systems security professional)