Unit 3 - Systems Software and Security Flashcards
What is social engineering?
the art of manipulating people so they give up confidential information
What do cyber attacks take advantage of?
1) human weakness or gullibility
2) Technical weakness in computer systems, networks or digital devices
What is a phishing email?
An email that tricks the user into handing over sensitive or personal information.
Signs of a phishing email
1) Greeting - not personalized
2) The sender’s address - a variation on a genuine address
3) Forged link
4) Request for personal information
5) Sense of urgency
6) Poor spelling and grammar
Define Shoulder Surfing
Shouldering involves direct observation of a user enter their security details.
Define a brute force attack and how can you limit the attack?
A hacker may go through a list of different passwords until access to an account is gained. Also the attacker may try every combination of characters until the correct password is found.
Ways to avoid it could be to set a limit on how many passwords can be tried at one time.
How to validate a password?
1) between 10 to 15 characters (length check)
2) mixture of numbers, lower and uppercase characters and symbols (format checks)
3) the user should never include their DOB, name or personal details
Define Malware
a malicious software intended to damage/disable computers.
Define Virus
A program which infects (embeds itself in) other programs or data files without the user’s knowledge. Can be easily spread if a user innocently sends an infected file to someone else.
It can also be used to slow down the performance of a hard disk or network
Define Worm
another type of malware. needs to attach itself to an existing file in order to spread. It may scan the internet looking for vulnerable computers to infect.
Common sources or forms of attack
1) USB devices
2) digital devices
3) eavesdropping
What two significant security issues do portable devices pose?
1) Data loss and/or theft
2) Infection from viruses
How can minimize the risk of viruses?
Scan all devices, never use a found device and disable the auto run facility for removable media
Define Eavesdropping
Method used to intercept data packets as they move across the network. Packets are inspected for useful data that could be misused or sold.
Define Digital Stalking
Type of eavesdropping. Hackers can use your mobile device to access detailed information about your daily life e.g. location, interests, apps used that day.
What threats do digital devices present?
1) Loss of a mobile phone can lead to the loss of all the data stored on it, including passwords, account numbers and credit card details
2) Malware which targets digital devices may create “back doors” to give malicious users access to your device
3) Many apparently legitimate apps are malicious and may lead to fraudulent charges on your phone bill or theft of personal information
4) Technical measures like firewalls, antivirus protection and encryption are uncommon on mobile phones
How to avoid hacking on mobile phones?
) create a strong password
2) Not following links in suspicious emails
3) Don’t install apps without researching them first - if they require extra permissions, don’t install them
4) Delete all information stored on your mobile before discarding
Define Denial of Service attacks
An attack that attempts to flood a website server with an overwhelming number of data requests.
E.g. flood the victim’s site with spam emails or disrupt access to a victim’s website or entire geographical area by re configuring software to crsh network sites.
Motives: revenge, blackmail, terrorism
Define SQL injection
takes advantage of web input forms to access or destroy data.
SQL commands can be input into web forms instead of the expected ‘real’ data. This can be interpreted by vulnerable web applications as an additional instruction to operate in the hacker’s favor
What is an example of a good network policy?
An Acceptable Use Policy details strict guidelines about what is and is not acceptable behavior on a network. All employees or students should be asked to read and sign this.
Define Penetration Testing
The practice of deliberately trying to find security holes in your own systems
What is the goal of penetration testing?
1) identify the targets of potential attacks
2) identify possible entry points
