Network Security

Malicious software written to cause harm to a device or network, including loss of data, encryption of data, fraud or identity theft

Programs embedded within other files that replicate and cause damage by deleting or modifying data

Programs that pretend to be legitimate but are actually malware, deceiving the user into installing the program which might contain other forms of malware

Programs that monitor user activity and then send the data back to the hacker

Programs that attempt to blackmail the user into paying the hacker by encrypting files on their computer and not decrypting them until the ransom is paid

Programs that are similar to viruses but are not hidden within files; they often spread through email

When people are manipulated into handing over sensitive information such as passwords or PINs

When a hacker makes up a story, taking advantage of human nature, and tricks the user into revealing sensitive data or even giving them money
People are often the weak point in a system

Phishing emails are designed to steal money, data or login details by impersonating a reputable organisation. They invite a user to click a link that will download a file to their computer that may contain a virus.

A type of cyberattack that redirects a user from a genuine website to a fake one and sends their details back to the hacker when they login to the fake account

When an attacker watches as you type in sensitive information and then gains that information

When an attacker uses a trial-and-error method to try and crack the user's password by repeatedly trying large combinations of digits and common words. A higher computing power will increase the success of a brute-force attack.

When a server is flooded with so much traffic, it is unable to process legitimate requests

Same as a DoS attack but the requests come from multiple computers not just one

When computer-based information is stolen during transmission. This is done using a packet sniffer that examines data packets and sends the information back to the hacker.

A hacking technique used to view or change data in a database by inserting SQL code instead of data into a text box in a login or a form

Anti-malware software that is designed to detect and remove malicious programs and must be kept updated
Installing updates/patches to operating system or programs
Encryption that scrambles the data so it cannot be understand by the recepient unless they have a key
Install a firewall to monitor network traffic

User training to recognise/avoid threats and vulnerabilities
Using strong passwords that are changed regularly
Network policies that set out what users can and cannot do
User access levels set which files and folders users have access to
Disable browser pop-ups

Using strong passwords (minimum number of characters, upper/lowercase letters, special characters) that are changed regularly
Implementing strong network policies
Using progressive delays

Install firewall to monitor network traffic
Packet filtering
Configure the web service

Penetration testing to identify network vulnerabilities
Encryption to make sure the data is unreadable to anyone without a key
User training
Physical security (logging off, making sure to lock computer/server rooms)

Check parameters used in database queries
Set user access levels and permission to the database
Check appropriate validation is being done on any data entered into the form

Authorised users try and exploit the weaknesses in a network to test how resilient it is

A piece of software that is used in a network to prevent unauthorised users gaining access to a computer system/network by monitoring network traffic

Malware could be installed on the network
Utility programs may be used to circumvent the network policies
Data may be taken away that is not encrypted possibly leading to a breach of the Data Protection Act/GDPR

Prevents dangerous programs from being installed and run
Helps keep user files/data safe from deletion, alteration or corruption
If a virus is installed, the software helps to detect and remove it safely

Writing passwords down
Not installing updates to their operating system
Leaving printouts on shared printers to collect later
Using CC instead of BCC when sending emails to multiple people

' OR '1'='1

Fake websites and emails often use most of the HTML from real sites, only changing the hyperlinks

Using penetration testing before putting a system live

Users have to click 'I am not a robot' on data entry forms

To make data unreadable

The amount of access a user is allowed to a computer system

A sequence of characters that must be used to gain access to a system

The anti-virus software will only against known threats within its database
New viruses are being created all the time that will not be in the database
Needs to be kept up to date to protect against new malwar
If the user disables the anti-virus then it will not download the new database records which will leave the computer vulnerable to attack
Even automated processes may require some user intervention

Sense of urgency in the information
Improper use of language
False links to click or phone number to use
Impersonal
Unusual attachments
Recipient details look suspicious
Date/time zone errors
Request for login details

Unencrypted data can be read by anyone who has access to the data
Cyber criminals could steal the data and use it further
The company has a duty to protect the personal data of employees, clients and suppliers under the Data Protection Act
The company may be fined for a data breach
Allows employees to work remotely and more securely
Using encryption gains trust with suppliers and customers helping to increase reputation

Penetration testing is used find security weaknesses in a system
Black-box attempts to gain access to email and web servers as well as firewalls to see whether it is possible to gain unauthorised access
White-box checks the access levels and permissions are set correctly and finds out the potential damage a user with different access levels could do