Unit Revision Flashcards
What are 4 ways internal threats can happen?
Employee sabotage/theft (of data or machinery)
unauthorised access (into server rooms or other restricted areas)
weak cybersecurity measures (by the company)
accidental loss or disclosure of data (laptop lost on train, shoulder surfers etc)
what are 4 ways external threats can happen?
Malicious software (malware)
Hackers
Sabotage
Social engineering (manipulation of people)
what types of malware are there, and what do thy do?
Spyware/keyloggers: log inputs made by the user and sends it off, can be used to steal sensitive info.
Adware: displays unwanted adverts (often leading to more malware) (gives advertiser money)
Ransomware: encrypts everything on the hard drive and demand money for the decryption key, usually in bitcoin as it is harder to trace.
Viruses: infect files to delete, alter or corrupt them, spreads through manual intervention (user has to run the program)
worm: like a virus, but spreads via a network.
rootkits: provide unwanted admin access, often removing antivirus to allow more malware in.
Trojans: Malware that is hidden in a seemingly good program.
P.U.P: a Potentially Unwanted Program (it is a legitimate program, but some of it’s code is controversial.)
what is a zero-day attack?
Often, companies roll out patches on certain days of the week. Hackers use this time to know what system vulnerabilities are and target them immediately, which is why you update programs as soon as the patch rolls out.
what is social engineering?
Social engineering is when you deceive somebody into giving out information.
the most common form of Social engineering is Phishing, pretending to be someone you are not, E.G a bank asking you to “verify email and password”
how can you spot phishing emails?
These emails are often very poorly crafted, with spelling mistakes here and there, and the URL is often very incorrect. ALWAYS HOVER OVER THE URL TO SEE WHAT IT IS.
Most banks have a special codeword that you and the bank agree on to show above the website or email, to verify it is them or tell you something about yourself that only you will know that is between you and the bank.
If in doubt, you can always ask the company if they sent out that email, and if they didn’t, report it as a phishing email.
there are 4 types of loss after a cyber attack, what are they?
Operational loss: people can lose time whilst repairing the damage.
Financial loss: The company could lose money (there and then, and over time)
Reputation loss: The community will trust them less because they cant keep their credentials safe.
Intellectual property loss: original ideas could be lost or stolen by rival companies.
which organisation posts weekly updates on a threat landscape?
national cyber security centre.
ports are not naturally safe and secure, so what happens to prevent unwanted connections when a port isn’t in use?
The port is closed.
what are ways malware can get into a system?
external storage devices may have malware on them. (and often run automatically)
if complete access is given to a user, they can cause massive damage.
illegal software may have malware with them, and don’t get updates, so patches are not rolled out, and more malware can get in.
what year was the general data protection regulations act made and what is it?
1998 (updated in UK in 2018 to be DPA)
contains principles companies must follow when handling data, and issues fines if the are not met.
what year was the computer misuse act made and what is it?
1990
protects users of the theft of and/or damage of info on IT systems, and issues fines and/or jail time.
Expanded upon with the “police and justice act”(2006) which includes DDOS attacks and making or supplying anything that is against the CMA.
what year was the telecommunications regulation made and what is it?
2000
Allow companies to monitor what employees do on their network and systems.
what year was the Fraud act made and what is it?
2006
means fraud by failure to disclose information, by false representation (lying who you are) or abuse of power can end in a 10 year sentence.
what year was the health and safety at work act made and what is it?
1974
a set of rules both employers and employees follow to ensure a safe workplace.
