Preventing Vulnerabilities

Question 1

What is the purpose of a penetration test?

Answer 1

• To review the system’s security to find any risks or weaknesses and to fix them.

Question 2

Internal penetration tests:

Answer 2

• Done to see how much damage could be done by somebody within the company with a registered account.

Question 3

External penetration test:

Answer 3

• Are for white hat hackers to try and infiltrate a system from outside the company.

Question 4

Blind penetration tests:

Answer 4

• Are done with no inside information, to simulate what a real attacker would have to do to infiltrate the system.

Question 5

Targeted penetration tests:

Answer 5

• Conducted by the company’s IT department and the penetration team cooperating together to find faults in the system.

Question 6

What is anti-malware software used for?

Answer 6

• To locate and delete malware, like viruses, on a computer system.

Question 7

How does anti-malware software work?

Answer 7

• The software scans each file on the computer and compares it against a database of known malware.
• Files with similar features to malware in the database are identified and deleted.

Question 8

Why must anti-malware software be updated regularly?

Answer 8

• New forms of malware are created daily so we need to keep systems secure.

Question 9

Other roles of anti-malware software:

Answer 9

• Checking all incoming and outgoing emails and their attachments.
• Checking files as they are downloaded.
• Scanning the hard drive for viruses and deleting them.

Question 10

What does a firewall do?

Answer 10

• Manages incoming and outgoing network traffic.

Question 11

How do firewalls work?

Answer 11

• Each data packet is processed to check whether it should be given access to the network by examining the source and destination address.
• Unexpected data packets will be filtered out and not accepted to the network.

Question 12

Other roles of a firewall include:

Answer 12

• Blocking access to insecure / malicious web sites.
• Blocking certain programs from accessing the internet.
• Blocking unexpected / unauthorised downloads.
• Preventing specific users on a network accessing certain files.

Question 13

Secure Passwords:

Answer 13

• Usernames must be matched with a secure password to minimise the chances of unauthorised users accessing a system.
• Passwords should contain a mix of uppercase and lowercase letters, punctuation and numbers.
• Passwords should be of a substantial length (>= 8) and should be regularly changed.

Question 14

What are access levels used for?

Answer 14

• Used to only allow certain users to access and edit particular files.

Question 15

Read-Only Access:

Answer 15

• When a user can only view a file and is not allowed to change any data.
• e.g a teacher might set read-only homework instructions.

Question 16

Read and Write Access Levels:

Answer 16

• Allows a user to read and edit the data in a file.
• e.g teacher might set an online workbook as read and write for students to fill in.

Question 17

Why are user access levels important?

Answer 17

• So only authorised users can view and change the data.
• The more users who have access to a file, the more likely it is to be compromised.

Question 18

No Access:

Answer 18

• Can’t view or edit a file.

Question 19

What is encryption?

Answer 19

• The process of scrambling data into an unreadable format so that attackers cannot understand it if intercepted during transmission.

Question 20

How does encryption work?

Answer 20

• The original data (plaintext) is converted to scrambled ciphertext using an encryption key.
• Only at the correct destination will the encryption key be used to convert the ciphertext back into plaintext to be understood by the receiving computer.

Question 21

Physical Security Methods:

Answer 21

• A lock can be used to prevent access to server rooms or locations that store confidential data.
• Only authorised people with a matching key will have access.
• Biometric devices require the input of a human characteristic (like fingerprint, iris, voice).
• The biometric data is checked against previously inputted data in a database. Only a match will allow access to the user.
• Keycards, security staff, CCTV cameras, alarms