1.8.5 Information Security

Question 1

Data as a commodity

Answer 1

Data is a very valuable commodity.
Personal data can be used to impersonate individuals to gain access to their assets.
Outsiders can exploit the financial data or trade secrets of organisations to gain a competitive advantage.

Question 2

Data theft

Answer 2

Data theft is a serious concern for any organisation.
The loss of customers’ personal data can result in significant fines.
Data theft can happen as part of different methods such as:
Insider attacks.
Man-in-the-middle attacks.
Packet sniffing.

Question 3

Protection from data theft

Answer 3

Data interception and theft is best prevented by employing a range of preventative measures such as:
Encrypting data.
User access levels.
Network policies.
Educating users.

Question 4

Packet sniffing

Answer 4

Packet sniffing is where a hacker will intercept data as it is being transmitted across a network.
Sniffing software reads and displays the content of all packets being sent on a network.
Packet sniffing is a form of passive attack.
One of the best ways to protect against packet sniffing is to use encryption so that packets cannot be decoded.

Question 5

Insider attacks

Answer 5

An insider attack is where someone with privileged access to information (e.g. an employee) uses their access to steal information from the company, and gives it to others.
Attackers often have financial or ethical motivations.
The risk of insider attacks can be reduced using:
Firewalls.
User access levels.

Question 6

MITM Attacks

Answer 6

A man-in-the-middle (MITM) attack is where an attacker will intercept a device’s connection to the Internet.
This is often done by tricking users into signing into a fake WiFi hotspot.
The man-in-the-middle can then see all of the victim’s traffic, such as personal information.
This is one of the reasons why users should be very careful if they join a public WiFi network.

Question 7

SQL Attack

Answer 7

Structured Query Language (SQL) is a language used to access databases.
SQL injection is a form of active attack that exploits SQL execution on web servers.
Attackers ‘inject’ specially formatted code into fields in the website, which when run on the server allow them to bypass login screens or damage the data kept on the server.