Policies And Security

Question 1

Define SFA (single factor authentication)

Answer 1

Where the user can obtain access to an account using one factor like a password

Question 2

Give the drawbacks of single factor authentication

Answer 2

Risky if same password is used for lots of sites

Question 3

Define Two factor authentication

Answer 3

Where users obtain access by giving two separate factors to identify themselves

Question 4

Give the three different types of factors that can be used for authentication

Answer 4

Knowledge factor - knowing password/ PIN

Possession factor - Owning a membership card/mobile

Biometric factor - Human characteristic fingerprint/DNA

Question 5

Give an example of 2 factor authentication

Answer 5

Bank card reader { 1.) PIN (knowledge and 2.) Debit card(possession }

Question 6

Give an example of 2 factor authentication in progress leisure

Answer 6

Mobile transaction numbers (mTANs) as the member needs PASSWORD (knowledge) and MOBILE PHONE (possession)
I.e member enters username and password into progress leisure login page –> progress leisure receives login request from member and texts security code to members mobile phone –> member enters security code to log in

Question 7

Give the benefits and drawbacks of 2 factor authentication

Answer 7

Benefits:
Greater security than just password protection
Deterrent as hackers are less likely to hack this security system

Drawbacks:
Phone or card/reader needed to log in
Customers dislike extra log in time

Question 8

Give three examples of security methods

Answer 8

Password advice- using strong passwords with a range of upper and lowercase letters and numbers and symbols

Access rights- set up by system admin to limit network access to relevant files only for a user

Encryption- used to make stored data more secure by making it unreadable to people who don’t have a key to decode it

Question 9

Give Examples of protection against hacking

Answer 9

• Firewall: checks integrity of incoming messages and requests for service by system and suspicious messages or requests can be re routed temporarily until the legitimacy had been established
• intrusion detection systems (IDS): designed to monitor network or PC system for malicious activities and if an incident is detected a report is sent to network management. Further action is taken if necessary to prevent system risks

Question 10

Give examples of viruses protection

Answer 10

• Antivirus software: used to minimise risk of data to viruses and searches the computer system for viruses and deleted them when detected. Treat files and attached email files from unknown sources with caution to avoid viruses getting into the system
• Spyware: can be loaded into a PC system as a software virus and is important to run an anti spyware program as it prevents and detects spyware from being installed. Also removed previously installed spyware

Question 11

Describe Progress Leisure’s acceptable use policy (SUP) for those who use their wireless network

Answer 11

Purpose: ensures members know what is appropriate beeping behaviour and to specify the directives necessary to protect the IT network infrastructure
Acceptable internet usage: should include info on what members are encouraged to use wifi for and that members must comply with current legislation
Unacceptable behaviour: should be listen under the following headings: general and system activities, progress leisure interactive devices and email and communication activities
User complains: members need to sign and date that they understand the acceptable use policy before using the system