Big Picture How many ways can a system be attacked? What can we do about it?

System Security Part 2

Learning Objectives To understand what is meant by computer system threats To understand how computer systems rely on policies to run safely

Data Interception and Theft Brute Force DoS and DDoS Data Interception and Theft SQL Injection Network Policy

Research ‘brute force attack’ TASK! Research ‘brute force attack’ Create a one page document that acts as an FAQ for brute force providing advice to system managers When a brute force attack is made on a system, the attackers try repeated combinations of passwords and usernames. On many systems and websites there are hidden files and folders. An attacker may attempt to brute force their way to these.

Denial of Service & Distributed Denial of Service TASK! Answer the following questions: 1 What is the difference between DoS and DDoS? 2 Who might launch a DoS or DDoS attack 3 Why? A system that is subject to a DoS or DDoS attack has mssive amounts of server calls made to the system website or other servers. At best they slow down the system. At worst they close the system down. Gaming website hit with a massive DNS flood, peaking at over 25 million packets per second

Data Interception and Theft 1 Theft of data eg personal information and bank details is a big problem. This can happen in a number of ways: breaking into and stealing data from a system and intercepting data are 2 ways. Ways that a site tells you is is secure is through the use of https and the lock icon. This tells you that the site is using hypertext transfer protocol secure. Clicking on the lock will show a security certificate Question in exercise books How does https protect data

Data Interception and Theft 2 Even if data is sent securely packet sniffers could capture data. On a secure network it would be encrypted (that doesn’t mean it cannot be decypted!)

SQL Injection SQL injection is normally used on database information (most data is kept in a database!). The attacker will force, ‘inject’, code into the database that will either return data eg a list of user names and passwords or ‘crack’ the access credentials so that data can be searched.

Network Policy Using the image to the right as your starting point, create a podcast that provides advice and guidance on what network policies are required and why