Network Security: Threats and Prevention

1 Describe what is meant by social engineering and give one example. 3

One mark for each of the following, to a maximum of 3.

• Manipulating or tricking people rather than attacking the technology
• The aim is to obtain confidential information or access
• Gives a valid example such as phishing, blagging or shouldering

Model answer. Social engineering is the practice of manipulating people rather than attacking a system's technology, in order to obtain confidential information such as passwords or to persuade someone to grant access they should not. It works because human trust and helpfulness can be exploited in ways that technical defences cannot prevent. One example is phishing, in which an attacker sends an email that appears to come from a legitimate organisation such as a bank, containing a link to a convincing fake login page, so that the victim enters their username and password and hands them directly to the attacker.

2 Explain the difference between a computer virus and a worm. 3

One mark for each of the following, to a maximum of 3.

• A virus attaches itself to a host file or program
• A virus requires a user action such as opening the file in order to spread
• A worm replicates and spreads across a network on its own without user action

Model answer. A virus is malware that attaches itself to a host file or program, and it only spreads when a user carries out an action such as opening that file, running the program or sharing it with somebody else. A worm, by contrast, is self replicating and spreads itself across a network without needing any user action or host file at all, which means it can move between machines far faster and infect a whole network in a very short time.

3 A company's website has a login form. Explain how an SQL injection attack could be carried out against it and describe how the company could prevent this. 4

One mark for each of the following, to a maximum of 4.

• The attacker enters SQL code into an input field instead of normal data
• If the input is not checked it is passed into the database query and executed
• This could allow the attacker to bypass the login or read, change or delete data
• Prevention: validate and sanitise all user input, or use parameterised queries

Model answer. An SQL injection attack is carried out by typing SQL code into an input field on the login form rather than a normal username or password. If the website builds its database query by inserting that text directly and does not check what has been entered, the attacker's code becomes part of the query and is executed by the database. For example, entering a fragment that makes the condition always evaluate to true could allow the attacker to log in as any user without knowing a password, and further injected statements could read, modify or delete the contents of the customer table. The company can prevent this by validating and sanitising all user input so that characters and keywords used in SQL are rejected or escaped, and more reliably by using parameterised queries, which keep the user's data strictly separate from the SQL code so that it can never be executed as an instruction.

4 A school network has been affected by malware. Describe three measures the school could take to reduce the risk of this happening again. 6

One mark for each of the following, to a maximum of 6.

• Install anti malware software
• Keep it updated so new threats are recognised
• Use a firewall to filter network traffic
• Apply user access levels so students cannot install software
• Train staff and students to recognise suspicious emails and attachments
• Keep operating systems and applications patched

Model answer. First, the school should install anti malware software on every machine and configure it to update automatically. Anti malware compares files against a database of known malware signatures and monitors for suspicious behaviour, quarantining anything it detects, but new malware appears constantly so the signature database must be kept current or recent threats will pass straight through. Second, the school should use a firewall between its network and the internet. A firewall inspects all incoming and outgoing traffic and blocks anything that does not meet its rules, which prevents malware from communicating with external servers and stops many infections reaching the network in the first place. Third, the school should set user access levels so that students and most staff cannot install software or alter system files. This means that even if a user is tricked into running something malicious, the malware inherits only that account's restricted permissions and cannot spread across the whole system. Alongside these, training staff and students to recognise suspicious emails and attachments addresses the human route that most infections actually take, and keeping operating systems and applications patched closes the software vulnerabilities that malware exploits.

5 Explain why encryption is used when data is transmitted over a public wireless network. 3

One mark for each of the following, to a maximum of 3.

• Data on a wireless network travels through the air and can be intercepted
• Encryption scrambles the data using a key so it is unreadable
• Without the key an attacker who intercepts the data cannot understand it

Model answer. On a public wireless network the data travels through the air as radio waves, and anyone within range with the right software can capture that traffic without the sender being aware, which is known as packet sniffing. Encryption protects against this by scrambling the data using a key before it is transmitted, so that what is actually broadcast is meaningless. Encryption does not prevent the data from being intercepted, but an attacker who captures it has only unreadable ciphertext, and without the decryption key they cannot recover the original information such as passwords or bank details.