1. Big Picture
How many ways can a system be attacked? What can we do about it?

2. System Security Part 2

3. Learning Objectives
To understand what is meant by computer system threats
To understand how computer systems rely on policies to run safely

4. Data Interception and Theft
Brute Force
DoS and DDoS
Data Interception and Theft
SQL Injection
Network Policy

5. Research ‘brute force attack’
TASK!
Research ‘brute force attack’
Create a one page document that acts as an FAQ for brute force providing advice to system managers
When a brute force attack is made on a system, the
attackers try repeated combinations of passwords and
usernames.
On many systems and websites there are hidden files
and folders. An attacker may attempt to
brute force their way to these.

6. Denial of Service & Distributed Denial of Service
TASK!
Answer the following questions:
1 What is the difference between DoS and DDoS?
2 Who might launch a DoS or DDoS attack
3 Why?
A system that is subject to a DoS or DDoS attack has mssive amounts of server calls made to the system website or other servers.
At best they slow down the system. At worst they close the system down.
Gaming website hit with a massive DNS flood, peaking at over 25 million packets per second

7. Data Interception and Theft 1
Theft of data eg personal information and bank details is a big problem.
This can happen in a number of ways: breaking into and stealing data from a system and intercepting data are 2 ways.
Ways that a site tells you is is secure is through the use of https and the lock icon.
This tells you that the site is using hypertext transfer protocol secure. Clicking on the lock will show a security certificate
Question in exercise books
How does https protect data

8. Data Interception and Theft 2
Even if data is sent securely packet sniffers could capture data. On a secure network it would be encrypted (that doesn’t mean it cannot be decypted!)

9. SQL Injection
SQL injection is normally used on database information (most data is kept in a database!).
The attacker will force, ‘inject’, code into the database that will either return data eg a list of user names and passwords or ‘crack’ the access credentials so that data can be searched.

10. Network Policy
Using the image to the right as your starting point, create a podcast that provides advice and guidance on what network policies are required and why