System security
There are various methods criminals use to attack networks in order to steal data and
information or to disrupt the work of the organisations.
These attacks pose major threats to organisations but often the greater threat is the lack of
vigilance by the people who work for it. Many organisations do not have policies in place to
deal with these threats.
1 Targeting people – social engineering
Human error is the root cause of 52 per cent of all security breaches to networks because
people fail to follow correct procedures, are careless and lack any knowledge of the threats.
Social engineering means psychologically tricking people into divulging their secret
information or doing things that they would not otherwise do.
Examples of social engineering attacks include:
Blagging
This can be done face-to-face, by telephone or by computer. The criminal invents a scenario
to try to get the victim to divulge information, for example, pretending to be a bank employee
to get people to divulge account information such as passwords and PINs.
Phishing
This is when fraudsters send emails claiming to be from a bank or e-commerce site in order
to find out your personal and financial details.
They have false links that the recipient is asked to click on to take them to a website
controlled by the criminals.
Shouldering
This is sometimes referred to as ‘shoulder-surfing’ and it involves finding login names,
passwords, credit card and PIN (personal information numbers) details by direct observation.
For example, someone in an office watching others entering passwords or watching
someone enter their PIN at a cash machine (ATM). Employees at a shop or petrol station
can watch a PIN being entered.
To prevent shoulder surfing, the keypad should be shielded from view by using your body
or cupping a hand over the keypad.
2 Malware
Malware is software designed to:
gain unauthorised access to a computer system
disrupt the functioning of a computer system
gather information from the users without their knowledge.
Types of malware include:
Virus
A virus is a computer program that is hidden within another program or file. It can replicate
itself and infect other programs or files which are then often passed by a user to other
computers. Viruses usually have a harmful effect, for example, corrupting or deleting data on
a disk.
Worm
A worm is different to a virus in that:
It has an independent existence: it does not have to exist inside another program or
file.
It does not need human action to spread it: it can travel unaided to other computers,
for example, through a network or by sending itself in emails to everyone in a user’s
address book.
As the worm is making thousands of copies of itself it will use the computer’s resources and
cause other programs to run slowly. Some worms cause damage by deleting data.
Trojan
A Trojan does not replicate or attach itself to other files.
It must be installed by a computer user who thinks they are installing legitimate software or
by opening an email attachment (that is why they are called Trojan horses).
Trojans can just be annoying, for example, by changing the desktop and adding new
icons.
They can also be malicious, for example, by deleting files and destroying system
information.
They can also create ‘back doors’ to computer systems so allowing criminals to
access your personal data, for example, they can transmit your key presses or
screen shots across the internet to the criminal’s computer.
