Network security and threats

Overview

Recall questions on confidentiality, integrity and availability, viruses, worms and trojans, phishing, denial of service, brute force, packet sniffing, man in the middle attacks, unpatched software, insiders, and layered defences.

What you need to know

Answer each one before you reveal it.

Questions from this subtopic

Each one with the model answer underneath.

1. 1

   What are the three properties network security is trying to protect?

   Model answer

   Confidentiality: only those authorised can read the data, so it is not exposed to eavesdroppers or unauthorised users. Integrity: the data is not altered, whether accidentally in transit or deliberately by an attacker, and any alteration is detectable. Availability: the systems and data are usable by authorised people when they need them, so the service is not knocked offline or made unusably slow. A measure can protect one and do nothing for the others - encryption protects confidentiality and helps with integrity but does nothing for availability.

2. 2

   Distinguish between a virus, a worm and a trojan.

   Model answer

   A virus attaches itself to a host file or program and only runs, and only spreads, when a user runs that infected item. A worm is self-contained and self-propagating: it exploits a vulnerability to copy itself across a network with no user action at all, which is why worms spread through an organisation so quickly. A trojan disguises itself as something the user wants - a game, a utility, an attachment that appears legitimate - and the user installs it willingly; it then does something harmful such as opening a back door, and it does not replicate itself. The practical distinction is how each gets onto a machine: a virus needs an infected file to be run, a worm needs no help, a trojan needs the user to be deceived.

3. 3

   What is phishing, and why is it hard to defend against technically?

   Model answer

   Phishing is sending a message that impersonates a trusted organisation - a bank, an employer, a delivery firm - to trick the recipient into revealing credentials or personal data, or into opening a malicious attachment or link. It is hard to defend against technically because it does not exploit a flaw in the software at all; it exploits the user's trust and their willingness to act quickly under apparent pressure. The message may contain no malicious code for a scanner to detect, and the credentials, once typed in, are surrendered voluntarily by a legitimate user, so the system sees a valid login. Defences are therefore mostly non-technical: user training, verifying requests through a separate channel, and multi-factor authentication so that a stolen password alone is not enough.

4. 4

   Explain what a denial of service attack is and how a distributed one differs.

   Model answer

   A denial of service attack aims to make a service unavailable to its legitimate users, typically by flooding it with so many requests that its bandwidth, connections or processing capacity are exhausted and genuine requests are refused or time out. It attacks availability rather than trying to steal or alter anything. A distributed denial of service attack does the same thing from a very large number of compromised machines at once, often a botnet of infected computers under the attacker's control. That makes it far harder to stop, because there is no single source address to block, the combined traffic can far exceed anything one connection could produce, and the traffic can be made to resemble genuine user requests.

5. 5

   What is a brute force attack, and what defends against it?

   Model answer

   A brute force attack tries every possible password, or every entry in a list of likely passwords, until one works. It needs no cleverness, only time, so its feasibility depends entirely on how many attempts the attacker can make and how large the search space is. Defences work on both: limiting the rate of attempts and locking or delaying an account after a number of failures makes the attack take impractically long; requiring longer, less predictable passwords enormously increases the number of combinations to try; multi-factor authentication means a correct password alone is not sufficient; and storing passwords hashed with a deliberately slow function makes an offline attack on a stolen database far more expensive.

6. 6

   What is packet sniffing, and what makes it possible?

   Model answer

   Packet sniffing is intercepting and reading packets as they travel across a network, using software that puts a network interface into a mode where it accepts all traffic it can see rather than only frames addressed to it. It is possible wherever the medium is shared or the traffic passes through a device the attacker controls: an open or weakly secured wireless network, where the radio signal reaches anyone nearby; a network segment served by a hub, which broadcasts every frame to every port; or a compromised router. The defence is encryption - a sniffer on an HTTPS connection can see that a connection exists and to which address, but the contents are unreadable.

Other ways to work this

The same content, four other ways.

What is inside Levo

Six ways to work the same material.