1.4

• Software designed with malicious intent • May disrupt, damage or gain unauthorised access • To commit crimes such as fraud and identity theft

• Targeting weak people • Phishing

• Attempting to gain access by targeting people using the system rather than the technical aspects • People are often the weakest security point in a computer system

• Disguising as a trustworthy entity in emails • To trick the user to reveal personal information

• Trial and error method to guess a password or a pin • Attempting every possible solution until the correct one is found • Automated software which generates a large number of consecutive guesses (not using intellectual strategy)

• Flooding a server with useless traffic that it cannot handle • Causes the server to become overloaded and unavailable to respond to actual client requests

• Unauthorised act of stealing computer-based information • Attempting to access data whilst it is being transferred between devices over a network • Intent of compromising sensitive information

• Entering SQL code into a data input field on a website or database • The code could run directly on the database, allowing the hacker to access/change/delete data

• Files are deleted, become corrupt or encrypted • Internet connection becomes slow • Keyboard inputs are logged and sent to hackers • Computers crash, reboot randomly • If client becomes infected with malware, it easily spreads across servers, which could affect the whole network

• Accessing a victim’s account to withdraw money or make purchases • Open bank accounts, credit cards • Gain access to high value corporate data

• Theft of data • Access to corporate systems

• Loss of access to service for customers • Lost revenue • Lower productivity • Damage to reputation (customers become victims of a data breach)

• Usernames and passwords compromised, allowing unauthorised access to systems • Disclosure of corporate data • Theft of data

• Contents of database could be output, sensitive data could be revealed • Data in the database can be amended or deleted • New rogue records can be added to the database

• Carelessness = network vulnerabilities • Not installing OS updates • Not keeping anti-malware up to date • Not locking doors • Not logging off/locking computers • Leaving printouts on desks • Writing passwords down on sticky notes and attached to computers • Sharing passwords • Losing memory sticks/laptops • Not applying security to wireless networks • Not encrypting data

• Strong security software (firewall, spam filter, anti-virus, anti-spyware) • Enabling software updates • Staff training (cautious of opening attachments/downloading things) • Backup files onto removable media (secondary storage) • Avoid clicking on suspicious links

• User training • Strong passwords • Biometrics • Two-factor authentication

• Recognise suspicious emails • Avoid clicking links or attachments in untrusted emails • Verify the legitimacy of requests by contacting organisations

• Strong passwords • Limit login attempts • Two-factor authentication

• Continuous analysis of network traffic • Firewalls

• Encryption • Staff training (passwords, locking computers, logging off, using portable media) • Investigating own network vulnerabilities (penetration testing)

• Validation on input boxes • Setting database permissions • Penetration testing

• Authorised hacking attempt • Aim is to find errors in the system and report them to the system’s owner • Allows security flaws to be fixed before the real hackers take advantage of them

• Attempts to detect, prevent and remove malware on a computer system