Please enable JavaScript.
Coggle requires JavaScript to display documents.
Network Security - Coggle Diagram
Network Security
Identifying and preventing vulnerabilities
Anti-malware software
Detects malware such as viruses, worms, Trojans and spyware
Compares files against a database of known malware signatures
When new malware is discovered
It is analysed by the anti-malware company
A signature is created
The signature is added to its database
Computers receive updates
Prevents: Malware infecting or damaging systems
Limitation: Must be updated regularly; new or modified viruses may avoid detection
Penetration testing
Process
Identify potential targets
Identify possible entry points
Attempt to break into the system
Report findings
Definition: Deliberately testing your own systems to identify security weaknesses
Purpose: Find vulnerabilities before malicious attackers can exploit them
Limitation: Only identifies weaknesses that are found during testing; it cannot guarantee complete security
Firewalls
Separate a trusted network from an untrusted network, usually the Internet
Examine incoming and outgoing data packets
Check where packets are coming from and going to
Drop packets that do not match filtering rules
Can:
Block malicious IP addresses
Block certain network ports
Block malicious or inappropriate websites
Can be hardware or software
Prevents: Unauthorised access to computers and networks
Limitations: Dedicated hardware firewalls can be expensive; software firewalls can slow down computers
User access levels
Set different access rights for different users
Permissions can be applied to:
Disks
Folders
Individual files
Restricts what users can view, modify or delete
Prevents: Unauthorised users accessing or changing sensitive information
How it limits attacks: If an account is compromised, the attacker may only have access to the permissions assigned to that account
Passwords
How it limits attacks: Longer and more complex passwords make brute-force attacks more difficult
Prevents: Unauthorised access to accounts
May require:
Minimum character length
At least one lowercase letter
At least one uppercase letter
At least one symbol
Regular password changes
Password policies set requirements for passwords
Encryption
Definition: Converts readable data into an encoded form that cannot be understood without the correct key
Purpose: Protect data if it is intercepted or stolen
Types of encryption
Data in transit: HTTPS encrypts communication between a browser and a web server
Individual files: Files can be encrypted using a password
Entire drives: Storage devices can be encrypted so a password is needed to access their contents
Prevents: Attackers reading stolen or intercepted data
How it limits attacks: Even if attackers obtain the encrypted data, they cannot easily understand it without the key
Physical security
Definition: Protecting hardware, software and networks using physical methods
Methods include:
CCTV
Intruder alarms
Locks on doors and cabinets
Fences and walls
Security guards
ID cards and signs
Turnstiles and gates
Security lighting
Prevents: Unauthorised people physically accessing devices, equipment and buildings
Threats to computer systems and networks
Social engineering and phishing
Social engineering
Exploits human behaviour rather than technical weaknesses
Manipulating or deceiving people into revealing confidential information
Phishing
A type of social engineering
Fake emails, texts or calls pretending to be from legitimate organisations
Attempts to steal usernames, passwords, bank details and other personal information
Common signs of phishing
Unpersonalised greetings
Suspicious or forged sender addresses
Fake links
Requests for personal information
Urgent or threatening language
Poor spelling and grammar
Shoulder surfing
Obtaining passwords or information by watching someone enter them
Could involve looking over someone's shoulder or using CCTV
Malware
Virus
Replicates its code in other programs
Spreads to other computers
Can delete, corrupt or modify files
Definition: Executable software designed to cause harm to a computer or its data
Worm
Replicates itself to spread between computers
Can slow down computers and networks
May not directly damage files
Trojan horse
Contains malicious code that can cause damage, take control or provide unauthorised access
Disguises itself as legitimate software, such as a game or program
Ransomware
Demands payment (a ransom) to restore access
Locks a computer or encrypts its data
Brute-force attacks
Can try millions of passwords per second
Usually performed using a computer program
Aims to gain unauthorised access to accounts or systems
Definition: Repeatedly trying every possible password combination until the correct one is found
Denial of Service (DoS) attacks
DoS
Attacker floods a server with requests
Server cannot respond to all requests quickly enough
Causes it to slow down or become unavailable
Distributed DoS (DDoS)
Same principle as DoS
Uses many computers to send requests simultaneously
Makes the attack more difficult to handle
Data interception and theft
Data theft
Stolen data can be used fraudulently or shared with others
Stealing confidential information, such as passwords, addresses and bank details
Man-in-the-middle (MITM) attack
Attacker intercepts communication between a user and a server
Can eavesdrop to obtain passwords and personal information
Can alter information being communicated
Unencrypted Wi-Fi makes this easier
Physical data theft
Devices such as laptops and phones can be stolen
Their stored information may then be accessed
Malicious USB devices
A USB stick containing malware may be left somewhere for someone to find
If connected, malware can install and give attackers access to data or system resources
SQL injection
SQL: Structured Query Language, used to communicate with databases
SQL injection
Attacker enters SQL commands into a website's input form instead of the expected data
A vulnerable website may interpret and execute these commands
Can reveal, modify or delete database information
Purpose: Gain unauthorised access to data or damage a database