Identifying and preventing vulnerabilities
Penetration testing
Penetration testing is when an organisation gives security experts permission to try to break into its systems, the way a criminal would. They look for weaknesses (vulnerabilities), then report them, so the organisation can fix them before a real attacker finds them.
Tests can check how an outside attacker might get in, and what a malicious insider, such as an employee, could do with their access.
The key word is permission: penetration testers have written authorisation from the system's owner. Doing the same thing without permission is a crime under the Computer Misuse Act 1990.
Key terms
Anti-malware software and firewalls
Anti-malware software scans files, downloads and email attachments for malware. It compares them with a database of known malware, and watches for programs behaving suspiciously. Anything it finds is quarantined (isolated) or deleted. It must be updated often, as new malware appears every day.
A firewall monitors the data coming into and going out of a network or computer, and blocks anything that breaks its rules, such as traffic from suspicious addresses or to programs that aren't allowed. It sits between a network and the internet, and can be hardware, software, or both.
- Anti-malware limits malware.
- A firewall limits hacking attempts, denial of service attacks and malware trying to send data out.
Key terms
User access levels and passwords
User access levels give each user access to only the files and settings they need. A student might be able to read the school's timetable but not change it; only the network manager has full access. This limits the damage from mistakes, from a malicious insider, or from an attacker using a stolen account.
Passwords stop people getting into accounts they shouldn't. A strong password is long and mixes upper- and lower-case letters, digits and symbols. It isn't a word in the dictionary or personal information such as a pet's name, and isn't used for more than one account.
Systems can add more protection: locking an account after a few wrong attempts, and two-step verification, such as a code sent to your phone.
Key terms
Encryption and physical security
Encryption scrambles data with a key, so it can't be read without it. Data sent across a network, such as by HTTPS or encrypted Wi-Fi, is safe even if it's intercepted. Data stored on an encrypted laptop or memory stick is safe even if the device is stolen.
Physical security stops people getting near the hardware: locked doors and server rooms, key cards, biometric locks such as fingerprint scanners, CCTV and security guards. It limits theft of devices, and stops someone plugging into the network or copying data directly from a computer.
Key terms
Which method limits which threat?
| Method | What it limits |
|---|---|
| Penetration testing | Every kind of attack, by finding weaknesses before attackers do |
| Anti-malware software | Malware |
| Firewall | Hacking, denial of service attacks, and malware sending data out |
| User access levels | Damage from insiders, mistakes and stolen accounts |
| Strong passwords | Brute-force attacks and guessing |
| Encryption | Data interception, and theft of devices |
| Physical security | Theft of devices, and direct access to hardware |
| Staff training | Phishing and other social engineering |
No single method is enough: organisations use several together.
Remember
Penetration testing is always done with permission. Without it, it's an illegal attack.