U9 - NETWORK SECURITY Flashcards
RISKS TO DATA
HUMAN ERROR
HACKING
VIRUSES
TECHNICAL BREAKDOWNS
INTERCEPTION
OLD DEVICES
PHYSICAL THEFT
INTERCEPTION
Data can be intercepted and altered when sent across a network
PACKET SNIFFING is when packets sent across a network are monitored
DISCARDED COMPONENTS
Old devices can contain data unless FACTORY RESET or SIM REMOVED
HACKING
Gaining unauthorised access to a computer system
White / Grey / Black Hat hacking
THREE WAYS OF BEING SECURE BY DESIGN
Buffer Overflow
Too many permissions
Parameters in functions with no validation
BUFFER OVERFLOW
When a program tries to store more data in a buffer than was intended.
Can occur intentionally in a buffer overflow attack
Can be combatted by BOUNDS TESTING, ensures data enteredis within acceptable limits
TOO MANY PERMISSIONS
Too many users have access to sensitive files. Constantly reviewing permissions
PARAMETERS IN FUNCTIONS WITH NO VALIDATION
Malicious code can be embedded within input bars on webpages.
This occurs when code is entered into functions with no validation.
Vaildation ensures data is as expected.
NAME THE THREE WAYS OF PROTECTING DATA
ACCESS LEVELS
PASSWORDS
ENCRYPTION (XOR)
ACCESS LEVELS
Not all users have access to all data
Only relevant parties have read/write access to files to minimise security risk
PASSWORDS
Passwords should be strong
Containing various different character types
Weak passwords are easier to brute force
No birthdays or names
ENCRYPTION
Data should be SCRAMBLED before being sent across a network
CYPHERTEXT cannot be understood without an ENCRYPTION KEY
XOR encryption - XOR the data with the data key to scramble
TWO WAYS TO IDENTIFY VULNERABILITIES
FOOTPRINTING
PENETRATION TESTING
FOOTPRINTING
Checking what information is available about a company and its servers online
Helps to remove and identify infromation that can aid hackers exploit there target
PENETRATION TESTING
A form of ethical hacking
A system breach is attempted in order to highlight security flaws
This means the vulnerabilties can be removed before a hacker exploits them
NAME 5 FORMS OF CYBER ATTACK
SQL INJECTION
DoS ATTACK
BRUTE FORCE ATTACK
IP SPOOFING
SOCIAL ENGINEERING
SQL INJECTION
Structured Query Language
Malicious code is injected into search bars/ forms to compromise the security of information
DoS ATTACK
Denial of Service Attack
Flooding the network with meaningless requests in order to make it crash
BRUTE FORCE ATTACK
Working through all the possible combinations in order to crack a password
IP SPOOFING
Changing the IP of a legitimate website so that if a user types in the address they are taken to a fake webpage where the hacker can steal sensitive information.
SOCIAL ENGINEERING
Phishing is a form of social engineering
Using people as the vulnerability
Manipulating people into giving away sensitive information
NAME 4 TYPES OF MALWARE
VIRUSES
WORMS
TROJANS
KEYLOGGERS & SPYWARE
VIRUSES
Programs that can REPLICATE themselves abd spread across a system
Must attach itself to a HOST FILE
WORMS
SELF-REPLICATING programs that identify vulnerabilities in the OS
Enable REMOTE CONTROL of the infected computer
SPYWARE & KEYLOGGERS
Spyware is accidentally downloaded and then COLLECTS DATA without the user’s knowledge
Keyloggers record key strokes to log passwords and account numbers
TROJANS
Programs that appear legitimate but provide a backdoor for hackers to steal data from
NAME 4 WAYS OF KEEPING A NETWORK SECURE
TWO-FACTOR AUTHENTICATION
UP TO DATE SOFTWARE
ANTIVIRUS
FIREWALLS
TWO-FACTOR AUTHENTICATION
An extra securtiy measure
The user is required to identify themselves twice
i.e. a code sent to an email address
UP TO DATE SOFTWARE
Having the latest OS means the best security
Updates remove vulnerabilities
FIREWALLS
A firewall is software that monitors outgoing and inbound network traffic. Data packets are analysed for malicious code before being allowed onto the network
ANTIVIRUS SOFTWARE
Scans data on the network flagging potential threats
Anti-virus software automatically scans and deletes malicious software
Antivirus needs to be routinely updated against new security threats
COOKIES
Small pieces of data given by a website and stored on the user’s device
Used to identify a user and give personalised webpages, targeted ads and automatic login
Used to track visitors to a webpage
Tracking cookies can reveal search history privacy breach
ACCEPTABLE USE POLICY
Terms which an employee must adhere to when on a company computer system
i.e. no obscene material, no gambling, malicious activity
DISASTER RECOVERY POLICY
Policies set out in the event of a catastrophic data loss
Details where backups can be found, how employees should work in the meantime, steps to recover data
