System Security and Software

Question 1

Different forms of attack

Answer 1

malware
phishing
brute force
denial of service
data interception and theft
SQL injection

Question 2

Malware def

Answer 2

Software written to infect computers and commit crimes
e.g fraud, identity theft

They xploit vulenrabilites in OS software.

Question 3

Malware examples

Answer 3

Virus
Worm
Trojan
Spyware
Adware
Ransomware
Pharming

Question 4

what are viruses and worms

Answer 4

Virus: program hidden within another program/file, designd to cause dmg to file systems

Worm: independent self replicaing program that spreads itself between multiple connected systems

Question 5

what are torjan and spyware

Answer 5

trojan: software that causes damage or allows access for criminals to use the device

Spyware: software that secretly passes info to a criminal without users knowledge.

Question 6

what is adware and ransomware

Answer 6

Adware: displays targeted adverts and redirects search requests without permission

Ransomware: software that locks access to a users system until a ransom is paid

Question 7

pharming def

Answer 7

redirecting of a users website by modfiying their DNS entries to a fraudulent site without their permission

Question 8

phishing

Answer 8

fraud technique.
designed to get you to give away personal info.

achieved by disgusinig themselves as a trustworthy source in an electronic communication e.g email, fake website

Question 9

brute force attack

Answer 9

trial by error method used by programs to decode encrypted data such as passwords and keys

Question 10

denial of service attack

Answer 10

flooding a server w/ useless traffic cuasing server o overload and crash. comes from one device.

distributed denial of service attack comes from multiple deivces. these devices are compromsed systems infected with a trojan.

dos attacks have exploited limitations in TCP/IP stack.

Question 11

data intercpetion and theft

Answer 11

an attacker monitors data streams to and from a target in order to gather sensitive info

can use technique claled ‘sniffing’ - act of monitoring traffic on network to pick out unencrypted passwords and configuration info

Question 12

SQL injection

Answer 12

code injection technique used to attack data driven apps

makes use of vulnerabilities in poorly coded database apps

code entered into text boxes and eecuted by server

Question 13

social engineering

Answer 13

using people as the ‘weak point’ in secure systems

Question 14

threats posed to networks: malware

Answer 14

files are deleted, become corrupt or are encrypted
computers crash, reboot spontaneously and slow down
internet connections become slow
keyboard inputs are logged and sent to hackers

Question 15

how do infections psread quickly on networks

Answer 15

client is infected, malware then infects the server, then all other clients

Question 16

threats posed to networks: phishing

Answer 16

accesing a victim account to withdraw money or purchase things
open bank accounts and credit cards, cashing illigitmate cheques
gai access to high value coroprate data
financial services can blacklist the company, resulting in dmg to brand reputation

Question 17

threats posed to networks: brute force atacks

Answer 17

theft of data
access to coroprate systems

Question 18

threats posed to netowrks: denail of service attacks

Answer 18

loss of access to a service for customers
lost revenue
lower productivity
damage to reputation

Question 19

threats posed to networks: data interception and theft

Answer 19

usernames and passwords compromised allowed unauthroised acccess to systems
discloure of coroprate data
theft of data

Question 20

threats posed to networks: sql injection

Answer 20

contents of databases can be output, revealing private data
data in database can be amended or deleted
new rogue records can be added 2 database

Question 21

threats posed to networks: people as a weak point

Answer 21

many system vulnarabilites caused by ppl being careless:
not installing OS updates
not keeping anti-malware up to date
not locking doors to computer rooms
not logging off or locking their comp
leaving printouts on desks
writing paswords down on sticky notes attached to comps
sharing passwrds
losing memory sticks/laptops
not appling security to wireless networks
not encrypting data