LO4 Flashcards
(99 cards)
1
Q
Cyber security
A
Consists of the processes, practices and technologies designed to protect networks computers, programs and data from attack damage or unauthorised access.
2
Q
An asset
A
An asset is any device, data, or perception that has value to an organisation
3
Q
The goal of cyber security
A
to protect assets
4
Q
Give one tangible asset and one intangible asset
A
A server is tangible
Reputation is intangible
5
Q
A cyber attack seeks to what
A
Damage, steal or destroy an asset.
6
Q
What does a threat have potential for
A
To harm an asset
7
Q
What is a vunerability
A
A vulnerability is a weakness in an asset or prevention measure which can be exploited in an attack
8
Q
If we have no vulnerabilities do we have any threats
A
no but this is unrealistic
9
Q
Prevention measures
A
A prevention measure aims to reduce the risk of an asset being exploited in an attack
10
Q
Does the prevention measure destroy a threat
A
The threat will still exist but the prevention measure may prevent it from ever happening
11
Q
Mitigation of risks meaning what
A
is reducing the risk of an attack happening or reducing its impact if it does
12
Q
What should you do with data once its purpose has run its course
A
Have it be securely destroyed
13
Q
securely destroyed data definition
A
The data cannot be retrieved
14
Q
How does a magnetic wipe destroy data
A
It destroys thew magnetic patterns which store the data, making them random and unreadable.
15
Q
Overwriting advantage + what it is
A
Allows the device to keep working as normal.
It involves replacing the data which is to be destroyed with random data instead.
16
Q
Morality
A
Morality generally refers to our personal view
17
Q
Ethics
A
Ethics generally come from a group or wider society
18
Q
Legalisation
A
Some immoral or unethical actions are punishable by law, some are not.
19
Q
Defamation of character
A
Someone says something untrue about you which causes serious damage to your reputation, it may be both immoral and unethical, and also illegal.
20
Q
What law is designed to protect intellectual property (IP) from being stolen
A
Copyrights, designs and patents Act of (1988)
21
Q
Copyrights, designs and patents Act of (1988)
A
What law is designed to protect intellectual property (IP) from being stolen
22
Q
Computer misuse act (1990)
A
Unauthorised access to a computer is illegal and can be punished
23
Q
It can punish and creating malware. Law
A
Computer misuse act (1990)
24
Q
What makes it illegal to access computer systems without permission
A
The CMA
25
Health and safety at Work Act (1974)
Ensure employers make the work safe for employees
26
Designed to protect personal data from misuse. Law
Data protection act
27
Data protection act described
Designed to protect personal data from misuse. Law
28
What could the DPA help us with
Especially sensitive data includes data related to bio metrics, health, political or religious beliefs
29
4 principles the DPA implores
- Be fairly and lawfully processed
- Be processed for limited purposes
- Be adequate, relevant and not excessive
- Be accurate and up-to-date.
- Not be kept longer than is necessary
-Be processed in line with your rights
- Be kept secure
- Not be transferred to other countries outside of the European economic area that do not have adequate data protection
30
When collecting information especially from a secondary research method you need to consider what factors
Who or what the source is
Their agenda or point of view
- which could cause bias
The timeliness and how recent it is
How accurate is it
- can I verify with a second source
31
Difference between validity and reliability
Validity is how believable the information is.
Reliability refers to if it can be verified and/or the source has a reputation for accurate information
32
A virus works how (3)
is a type of malware which inserts itself into other computer programs
When the host program is run, the virus code executes too
When this happens, the virus will replicate itself and spread
33
What do you call something that does not require a host program
Stand alone
34
Worms work how (3)
Is stand alone
Replicate very quickly
Network worms are the most common, which spread over networks and slow them down
35
Trojan horse (4)
A Trojan horse is malware which is disguised as a useful program but actually contains malicious code
It make take months for a Trojan horse code to start to act maliciously
Most trojans can't self-replicate
A trojan horse may provide a backdoor
36
Spyware (1)
Collects information about you without your knowledge
37
Adware (2)
Shows lots of advertisements to the user making the developer money, a lot of popups
Are not usually malicous
38
Ransomware (3)
A ransom money is demanded for the release of something
Ransomware threatens to block access to files or release personal information unless a sum of money is paid
Often access is blocked by encrypting the files, and the ransoms are often demanded in a cryptocurrency
39
Rootkits
are usually a collection of malware
A rootkit can be used by an attacker as a backdoor to remotely control a computer, or access its files
Rootkits often work at lower levels than other malware, infiltrating the OS or hardware drivers
This makes them hard to detect
40
DoS
Denial of service attack seeks to overload a service by flooding a server with malicious requests
A DoS attack comes from once source often
Most servers can cope with a DoS attack, and that computers can be blocked from making requests
41
A DDoS
is where the serve is flooded by requests from multiple sources
42
Botnets
A bot is a type of malware which enables the attacker to control the computer remotely without the owners knowledge
A botnet is a network of all of the individual bots which the attacker can control
The attacker can use the botnet to launch attacks, like phishing emails and disinformation campaigns on social media
43
Botnet used with a DDoS attack how and the effects of it (2)
A botnet can be used to launch a DDoS attack
Is much harder to block and more likely to overload the server
44
Environmental vulnerabilities
Weaknesses related to the surroundings of a computer system, including the effect of external natural disasters
45
Copyright designs and patents Act
- The act makes it illegal to copy a work without the owners permission
-The owner is the copyright holder
- Making unauthorised copies of a work is also illegal
46
Three common ways the CD&P is broken
- Using software without the correct software licenses
- Downloading files from internet websites
- Copying music, DVDs, CDs and software.
47
CMA ACT summary
- The Act aims to protect data and information held on computer systems
- The act does not stop hacking but makes it illegal to do this,
- Hackers that charged can face a prison sentence, a fine or both
48
Social engineering
The act of manipulating humans so that they give up private information or their money (exploiting them as the weak point in the system)
49
pretexting
Using an invented scenario to trick the victim into giving up information
50
How is pretexting done
Usually involves the attacker impersonating someone else who may be real or made up
51
Phishing
Disguising yourself as a trust worthy person or organisation to obtain personal information from a victim
52
How is phishing often done
Usually done over email, and many emails will often be blindly sent
53
Baiting
Involves tempting someone with an offer which is hiding the true consequences
54
Quid pro quo
The attacker will offer something, like a favor in exchange for access to some personal information.
55
Tailgating/piggybacking
When people are authorized are followed by an attacker to gain access to a secure area
56
How may pretexting be used for tailgating
Pretexting might be used to make the tailgaiting less suspicous, like having a fake lanyard or pretending to lose keys
57
Shoulder surfing
Directly observing a person entering their private information, often by looking over their shoulder
58
Pharming
Creates a fake website which impersonates a trusted one
Victims are tricked to enter their information, thinking the website is real
Sophisticated pharming attacks involve redirecting the victim from the legitimate website to the fake website
59
Hacking
Accessing computer systems without using the normal means of access
60
Black hat hackers
Where they hack into systems with malicious intent to steal, exploit and sell data. This is illegal and unethical
61
White hat hackers
Where they are given permission by companies to hack into systems to identify vulnerabilities this is legal and ethical
62
Grey hat hackers
Where they hack into systems for fun or to troll this may be illegal and or unethical, depending on how malicious the hacker is being
63
Environmental vulnerabilities
Weaknesses related to the surroundings of a computer system, including the effect of external natural disasters
64
Physical vulnerabilities
Weaknesses related to how the physical computer systems can be interacted with in real life
65
System vulnerabilities
Weaknesses related to the running if a computer system
66
System vulnerabilities e.gs
Weak passwords can be easily guessed by brute force attack
insecure modems
A modem converts data so that it can be sent over a network. A design flaw in the modem might allow an attacker to intercept all of the data
67
Impacts of a cyber security attack
Impacts of cyber security attacks consider the immediate effects on individuals and organisations
68
Data theft
When a attacker extracts private data in an attack this is data theft
69
Identity theft
If the data is personal information, then it is considered identity theft
70
Fraud
If the hacker uses personal information it is considered fraud
71
Data destruction
If an attacker permanently deleted data, this is called data destruction
72
Data manipulation
is when an attacker indirectly changes data to meet their needs
73
Data modification
Is an attacker directly changes data to meet their needs
74
3 Consequences of a cyber attack
Loss
Disruption
Safety
75
Cyber attack consequences
Loss:
loss: Financial, data, reputation
Disruption: operational, financial, commercial
Safety: Individuals, equipment, finance
76
Loss impact of a cyber attack
Having none or less of both tangible and intangible assets following an attack
77
consequences of cyber attack
Financial loss
Money may be stolen in attack,
fines may be imposed
may cost money to recover from the attack
78
Loss of data
Data is often the most important asset an organisation has. Data may be destroyed or manipulated/modified to a point which can't be recovered
79
Loss of reputation
An organisations reputation is how they are perceived by the public. Good reputations are hard to grow but easy to destroy
80
Operational disruption
The delay of responding and recovering from a cyber security attack may affect day to day business
81
Financial disruption
A loss of customers can mean businesses have to restructure their financial commitments
82
Commercial disruption
Businesses may not be able to sell their product or service for a period of time
83
Cyber attack safety section e.gs
A cyber attack could target critical national infrastructure. like healthcare or power plants
84
Equipment after cyber attack
Critical equipment could fail life support machines
85
Finance
Individuals and business may be unable to access their money, and so can no longer pay for essentials, like food and rent
86
A physical prevention measure is what
Protects the surroundings of a computer system
87
A physical prevention measure e.gs
fingerprint
facial scan
iris
voice recognition
88
A logical prevention measure
Protects the running of the computer system
89
logical prevention measures e.gs
2fa
getting an antivirus which updates regular to mitigate against that updates malware
90
Access rights
Are given to user accounts to determine what they can access
91
Encryption
Encryption doesn't stop unauthorized users intercepting the data but it stops them understanding it. Only the intended recipient and you can understand it because you have the recipient have the key
92
read
Back ups need to be kept as secure as the primary source and should be kept separate from each-other
read
Back ups need to be kept as secure as the primary source and should be kept separate from each-othe
93
Factors when doing secondary research you need to consider
Their agenda or point of view this may cause bias
The time of it how recent it is
How accurate it is are u able to verify with a second source
94
Characteristics of information
Validity, reliability, bias
95
Validity
This refers to how believable the information is
96
Reliability
This refers to if it can be verified and the source has a reputation for accurate information
97
Bias
Information is biased when the source is only giving one perspective or letting their agenda influence the information
98
Consequences of a cyber attack
Disruption (OFC/ of course)
Disruption: operational, financial, commercial
99
Consequences of a cyber attack
Safety: (Fie)
Safety: finance,individuals, equipment
