Please enable JavaScript.

Coggle requires JavaScript to display documents.

Introduction To Security, Various threats to computer security, Risk of…

- - - - stored on a storage device (like a hard drive or USB flash drive)
      - transmitted over a network (such as a local area network or the Internet)
      - microprocessor (such as on a personal computer)
  - - - and it also can be
        defined as protecting information and
        information systems from unauthorized
        access, use, disclosure, disruption,
        modification, or destruction in order to
        provide;
        
        intergrity
        
        confidentiality
        
        availability
- - - - Confidentiality
        
        Preserving authorized restrictions on access
        and disclosure, including means for protecting
        personal privacy and proprietary information.
        
        It is important that only approved individuals
        are able to access important information. For
        example, the credit card number used to make
        an online purchase must be kept secure and
        not made available to other parties.
        
        Confidentiality ensures that only authorized
        parties can view the information.
        
        Providing confidentiality can involve several
        different security tools, ranging from
        software to “scramble” the credit card
        number stored on the web server to door
        locks to prevent access to those servers.
      - Integrity
        
        Guarding against improper information
        modification or destruction, and includes
        ensuring information nonrepudiation and
        authenticity.
        
        Integrity ensures that the information is correct
        and no unauthorized person or malicious
        software has altered the data.
        
        In the example of the online purchase, an
        attacker who could change the amount of a
        purchase from RM10,000.00 to RM1.00 would
        violate the integrity of the information.
      - Availability
        
        Ensuring timely and reliable access to and use
        of information.
        
        Information has value if the authorized parties
        who are assured of its integrity can access the
        information.
        
        Availability ensures that data is accessible to
        authorized users.
        
        This means that the information cannot be
        “locked up” so tight that no one can access it.
      - which also knows as CIA
- - - - trojan horse
      - worm
      - virus
      - an external company web site is hacker, the integrity of company is damaged
      - using easily hacking tools such as shell scripts and password crackers
        
        testing and challenging a hacker's skills can still do serious damage to a company
    - - occur when someone has authorized access to the network with either an account on a server or physical access to the network
      - be a disgruntled employee, an opportunistic employee, or an unhappy past employee whose access is still active
      - past network employee, even if their account is gone, they could be using a compromised account or one they set up before leaving for just this purpose
    - - arise from individuals or organizations working outside of a company
      - do not have authorized access to the computer systems or network
      - work their way into a network mainly from the Internet or dialup access servers
    - - involved with the major fraud and theft cases
      - people know system vulnerabilities, and can understand and develop exploit-code and scripts
      - come from hacker more highly motivated and technically compenent
- - - - Reconnaissance Attack
    - - Distributed Denial of Service (DDoS) Attack
- - - - Work for themselves
        
        is one who breaks into or otherwise
        violates the system integrity of remote
        machines with malicious intent
        
        Having gained unauthorised access crackers, destroy vital data, deny legitimate users service or cause problems for their targets,
        
        Can easily be identified because their
        actions are malicious
  - - - Hired by companies
        
        Is a person intensely interested in the
        arcane and recondite working of any
        computer operating system
        
        Obtain advanced knowledge of
        operating systems and programming languages.
        
        Constantly seek further knowledge, freely share what they have discovered and never intentionally damage data.
- - - - 1.5.1 Data Wiping
        
        Deleting files from a hard drive does not remove them completely from the computer.
        
        This data is not completely removed until the hard drive stores other data in the same location, overwriting the previous data
        
        Hard drive should be fully erased to prevent the possibility of recovery using specialized software.
      - 1.5.2 Hard Drive Destruction
        
        Companies with sensitive data should always establish clear policies for hard drive disposal
        
        Important to be aware that formatting and reinstalling an operating system on a computer does not ensure that information cannot be recovered
        
        The best option for companies with sensitive data.
        
        Data can still be recovered using advanced data forensic software.
        
        The only way to fully ensure that data cannot be recovered from a hard drive is to carefully shatter the platters with a hammer and safely dispose of the pieces.
        
        To destroy software media(floppy disk and CD), use a shredding machine designed for shredding these naterials
      - 1.5.3 Hard Drive Recycling
        
        The drive can be reformatted and a new operating system can be installed
        
        Two types of formatting can be performed
        
        Standard Format
        
        Low level format