5.3 Cybersecurity

the protection of computer systems from unauthorised access or being damaged or made inaccessible

any kind of electronic attack on a computer system, server, network or other IT device

‘malicious software’ software designed to: - disrupt the functioning of a computer system - gain unauthorised access to a computer system - gather information from the users without their knowledge

malicious program code that is hidden within other programs/files designed to replicate (make copies of themselves) and are inserted into other programs/files - these are then passeed to other computers by users have harmful effects: corrupting or deleting data on a disk

malicious software programs - do not exist inside other programs or files replicate themselves: can do this independent of a user - through a network connection or by sending themselves in emails other programs/systems may run more slowly is a worm is consuming system resources during replication and distribution - may affect network performance by consuming bandwidth have been known to create back doors into systems allowing invisible unauthorised access

malicious disguised as legitimate software do not replicate themselves or attach themselves to other files they may masquerade as legitimate software in order to convince a user to install them effects: some not malicious - changing desktop properties, adding new icons some malicious - deleting files and destroying system information can also create backdoors to computer systems

malware that blocks users from using their computer or accessing data stored on it, until a fee has been paid to release it. some ransomware encrypts data into an inacessible form, then demands payment from the victim to restore the data. there is often a time limit associated with the request, after which, all data is destroyed commonly delivered in malicious spam emails - users click on an attachment/link that causes a program to execute on the machine

are a type of spyware that record the individual keys pressed on a computer’s keyboard - done without the user’s knowledge a record of all the keys is kept in a log - this can be saved to a local file or sent over the network to another computer or person may be transmitted in trojans, infected files, instant messages, or by visiting an infected website

exploiting or taking advantage of human behaviour, usually weaknesses. the attacker will ‘engineer’ a situation where the target person/group gives away / gives access to confidential information. can not only be done on computer systems, also by telephone or face-to-face

a malicious person inventing a scenario (the pretext) to entice a victim to divulge sensitive information or act in a way they may not in other circumstances - some elaborate scenarios may be based on prior research of the target eg: - pretending to be a bank employee warning about security threats asking for passwords and PIN - pretending to be a technician asking for home network passwords and login details

an attempt to get sensitive, confidential information from the user of a computer system or service - usernames, passwords, financial details most common through email or fake websites, but can also happen via phone calls or instant messaging

urgency careless use of language impersonal - ‘dear valued customer’ false links attachments

exploits a person’s curiosity or greed - victim is enticed by the offer of something, and as part of the process must divulge sensitive information. or the download/application upgrade itself may consist of another piece of malware

‘this for that’ an attack where the victim is offered something of benefit - once the victim has accepted, the attacker may ask for access to the victim’s machine to install the required software, requesting that other security software be turned off to facilitate the installation eg: attack poses as a technician of an organisation - requires victim to disable security software in order to install update - once victim complies, attacker has access to the entire organisation’s networked systems - financial/customer/employee data at risk

security issues solved in patches as they are found these security issues discussed on the internet - now people can use this knowledge to attack unpatched software people may not update as it might have to be manually installed by a technician or an end user, and none may be available

installed to prevent infection by malware, and to search for and destroy it if it has infected the system

scanning for malware using a database of known malware definitions (signatures) - these have information on what the malware does and how it can be recognised. if the anti-malware program detects a file that matches the definition, it will flag it as potential malware requires regular updates to include newly developed malware

identifying malware by behaviours and characteristics heuristics are a set of rules used to detect malicious behaviour without having to uniquely identify the program responsible. may include programs which: - try to copy themselves into other programs - try to write directly to the disk - try to remain resident in memory after it has finished executing - decrypts itself when run - attempts to manipulate files required by OS

old version of anti-malware wont have signature of new malware in its database - wont identify the infection often anti-malware programs will try to keep signatures updated automatically - periodically when connected to internet the program will check with the anti-malware organisation to see if there is a new signature file

scrambles any data into an ununderstandable (not unreadable) form to anyone who does not have the key - protects data when it is stored in computer systems or being transmitted between them

algorithms encrypt and decrypt a message using the same key - both ends must know the exact same shared key

encrypts data using 2 different keys: - a public key known to everyone - a private key known only to themselves a message encrypted with a particular public key can only be decrypted by the corresponding private key person A sending an encrypted file to person B: A encrypts the file with B’s public key - on receipt, B then decrypts it with their private key

a set of conditions/rules a network user must agree to comply with before they are allowed to use the network required to ensure: laws are complied with, network is not harmed, security is not jeopardised, all users have fair access, users are not bullied or abused could include: must not install software, must not use their own devices (USB drives etc) on the network, must not download files from internet, must not access unauthorised programs/data, must comply with the law at all times

about the copying of programs and data stored on the network to safeguard them in case of natural or man-made disasters could include: who is responsible, which data (all data each time, or incremental backup), when, how often, how done, where kept, how long kept for