Cyber Security

Question 1

Why is cyber security important?

Answer 1

• protects data programs and computers against damage, cyber attacks and unauthorised access
• hackers often target organisations to access lots of sensitive information

Question 2

What does penetration testing do?

Answer 2

• organisations employ specialists to stimulate potential attacks to identify vulnerabilities to fix

Question 3

Describe the 2 types of penetration testing

Answer 3

• white box - stimulates malicious insider with knowledge of system to see what they can do
• black box - external cyber attack - tries to hack organisation in any way

Question 4

What is malware?

Answer 4

• malicious software designed to cause harm to gain unauthorised access to a computer system
• without consent

Question 5

What can malware do on a computer?

Answer 5

• deletes or modifies files
• locks files
• displays unwanted adverts - adware (pop up ads that can’t be closed)
• monitors user with spyware
• alters permissions using root kits

Question 6

How can malware spread between devices?

Answer 6

• Virus = attach themself to files and spread by copying files and activate if opened
• worms= self replicate so spread quickly and exploit weakness in security systems
• Trojans = malware disguised as legitimate software and don’t replicate but users install them not realising their hidden purpose

Question 7

4 types of social engineering

Answer 7

• Pharming
• Phishing
• Shouldering
• Blagging

Question 8

Describe pharming:

Answer 8

• user directed to fake version of a website
• inputs personal details thinking they’re handing it to a legitimate account
• make sure anti malware is up to date
• use web filters to prevent fake sites

Question 9

Describe phishing:

Answer 9

• criminals email or text leading to a fake website
• sent to thousands
• anti-phishing feature (firewall), poor grammar, follow links or update personal details

Question 10

Describe shouldering:

Answer 10

• watching over a person’s activity
• watching PIN number or putting password into secured computer
• doesn’t require expertise
• be discreet such as covering the keypad when you enter PIN

Question 11

Describe blagging:

Answer 11

• makes up story or pretends to be someone they’re not
• e.g. stuck in a foreign country so to send money
• e.g. phone victim to gain their trust as they pretend to be someone important
• use safety measures that can’t be given away - e.g. biometrics

Question 12

How can networks be protected against threats?

Answer 12

• encryption
• anti-malware software
• user access levels
• automatic software updates
• MAC address filtering

Question 13

How can networks be protected with encryption?

Answer 13

• when data is translated into a code when only someone with the correct key can access
• cipher text into plain text
• needed to send data over network securely

Question 14

How can networks be protected with anti-malware software?

Answer 14

• stops malware from damaging the network
• e.g. firewall examines all data and blocks potential threats
• prevents unauthorised access into the network

Question 15

How can networks be protected with user access levels?

Answer 15

• some have higher access levels than others and access to more sensitive data
• limits the number of people with access to important data so prevents attacks within an organisation

Question 16

How can networks be protected with automatic software updates?

Answer 16

• used to fix security holes

- unpatched software can be easily exploited

Question 17

How can networks be protected with MAC address filtering?

Answer 17

• way of making sure only people on a network are trusted users
• checks unique identification so only allowed devices can join the network

Question 18

What are the ways of authentication?

Answer 18

• Passwords
• Biometrics
• Email Confirmation
• CAPTCHA

Question 19

Describe passwords;

Answer 19

• simple methods
• strong with a combination of letters, numbers and symbols and can be changed regularly
• weak or default passwords are a big security risk
• hackers can use brute force attacks to get past short/ simple passwords and social engineering

Question 20

Describe biometrics:

Answer 20

• uses scanners to identify people by a unique part of their body –> retina, fingerprint
• prevent unauthorised access
• quite secure and convenient for users
• more expensive to implement as they have special hardware

Question 21

Describe email conformation:

Answer 21

• confirms that the email belongs to them
• stops people from using fake emails to sign up but since webmails are free people can sign up for new ones so not always effective

Question 22

Describe CAPTCHA:

Answer 22

• Completely Automated Public Turing test to tell Computers and Humans Apart
• prevents programs from automatically creating accounts
• consists of simple things like typing out a blurred and distorted word from an image
• rely on computers not being able to read images as well as humans can
• image recognition software and AI is developing as machines are becoming more capable

Question 23

What is ransomware?

Answer 23

• encrypts files on an infected system and only decrypts files once payment has been made to the hacker

Question 24

What is spyware?

Answer 24

• gathers information about the use by tracking activity

Question 25

What are rootkits?

Answer 25

• malware which modifies the OS to avoid detection by antivirus software

Question 26

What are backdoors?

Answer 26

• malware which opens up an access channel to the computer so other malware can take over the machine

Question 27

What is a firewall?

Answer 27

• hardware or software between a device and the internet which inspects incoming and outgoing data packets. It tries to stop hackers from gaining access to the network and stops malware from getting into the network. It does packet-filtering, IP-address filtering, and port-blocking.

Question 28

What things should a good pen test look for?

Answer 28

• Technical vulnerability
• likelihood of social engineering
• test of damage recovery

Question 29

Three ways to protect against social engineering attacks?

Answer 29

• Education and training
• public awareness campaigns
• company security policies