System Security #2: Detection and Prevention

Question 1

What are Network Policies?

Answer 1

Network Policies are organisational rules for network access

Question 2

What is a Failover?

Answer 2

This means that if a piece of key hardware (like a server or router) stops working, a secondary back up device will take over the functionality to prevent network downtime.

Question 3

What is Archiving?

Answer 3

A network that keeps archives means that they keep a store of data currently not in use, but may be used at a later data.
E.G previous user information

Question 4

What is Penetration Testing?

Answer 4

Simulating an attack to find weaknesses
Attempting to gain access to resources without knowing normal means of access
E.G Like a username and password

Includes a review reporting the findings, and then countermeasures are implemented, based on any vulnerabilities found.

Question 5

What is White Box testing?

Answer 5

A white-box pen test is to simulate an inside attack, where the attacker may have some knowledge of the system and basic credentials

Question 6

What is Black Box testing?

Answer 6

A black-box pen test is to simulate an outside attack, i.e. hacking

Question 7

What is network forensics?

Answer 7

The capture, recording and analysis of traffic to discover attacks

It can be done using sniffing software (and lost of storage), and by using web server logs which show when data was accessed.

“Catch it as you can”
All packets stored, and analysed
- Lots of storage

“Stop, look and listen”
All packets quickly analysed, and only some information is stored
- Fast processor, less storage

Question 8

Other security measures

Answer 8

Email confirmations: That confirm a user’s identity
i.e. that they have access to the email accounts they state is theirs

Passwords: Memorable information, fingerprints etc

Automatic software update:
(Especially for anti-malware software). General updates will include patches for known vulnerabilities, and anti-malware will update its database with new signs of malware

User Access Levels:
Are assigned to give people different permissions
E.G basic users and administrators, meaning there are greater limits to who can perform what operations on the system/network