- [Craig] In this sequence of videos, we explore network security and the variety of threats to computers and servers today.
What are the forms of attack, what is the threat,
and how can you identify and prevent vulnerabilities?
(uplifting piano jingle)
In this specific video, we consider preventing attacks, from malware, phishing, brute force, denial of service,
data interception and SQL injection.
A simple four-point list of each threat will be easier for you to remember for exams.
So, to protect against malware, you want strong security software.
This includes firewalls, spam filters, anti-virus, anti-spyware and anti-spam software,
all typically wrapped up in a single package.
You want to enable operating system and security software updates,
you want to train staff to be cautious of opening email attachments and downloading software,
and you want to back up files regularly onto removable media.
Malware is often transmitted by email attachments coming from unknown sources.
Quite often, it can look like it's an invoice that you would expect to be able to open,
but when you do open the attachment,
what actually happens is it downloads a piece of software onto your computer and infects it with malware.
The next thing you realise, all your files are being encrypted,
and you get a ransom note asking you to pay for the files to be decrypted.
You can prevent all of this if you're careful about which attachments you open
and just double-check the source before you open anything.
And if you back up your files, it means that in the worst-case scenario,
you can delete the encrypted files and replace them with a good copy that you've gotten from a back-up.
To protect against phishing, again, strong security software can help,
but you really want to train your staff.
You want them to be aware of spotting fake emails and websites, you want them to not disclose personal or corporate information,
and perhaps disabling browser pop-ups will reduce the temptation of clicking and ending up on a nefarious website.
To protect against a brute-force attack, having a lock-out policy can be a good idea.
Say, for example, if someone tries their password three times and they're unsuccessful, then it locks the account
and can only be unlocked by a system administrator.
You could use a progressive delay.
When you get the password wrong, you then have to wait a certain amount of time before you can retry it,
so perhaps if you made three unsuccessful attempts, it could lock you out for an hour.
Training the staff to use effective passwords with symbols, letters, numbers, mixed case and a minimum number of characters
can make passwords much harder to crack using brute-force techniques.
You could use challenge-and-response techniques.
Now, you'll probably have seen some of these on websites, where you have boxes you have to check that say I am not a robot
in order to prevent against these programs trying repetitive brute-force attacks.
There are also other methods like reCAPTCHA.
These are popular as well, where they ask you to intervene and identify all the pictures that contain traffic lights.
Denial-of-service attacks can be prevented with strong firewalls and using packet filters on routers,
configuring the web server to include additional modules that spot when denial-of-service attacks are taking place
and then prevent that additional traffic from actually getting to the servers,
and making sure that an organisation has decent auditing, logging and monitoring of its systems
so you can see what traffic is coming into the network.
Now, this last one won't actually prevent the denial of service, but it will certainly allow you to identify it and act swiftly.
With data interception and theft, encryption is the key.
Also using virtual networks and training staff in terms of using passwords, locking computers,
locking their office doors, logging off and then how they actually use portable media
and being aware that sometimes,
the permissions on portable media are not the same as the permissions that you have on secure drives on a network
and therefore sometimes, people can actually gain access to portable media
that's attached to the computer by looking for file shares on the network.
And finally, being active as a system administrator in investigating your own network for vulnerabilities.
SQL injection can be prevented with a number of techniques.
Just using simple validation on input boxes, looking for code that would not be relevant in that box
and then using a more advanced technique of coding such as one called parameter queries.
Now, you don't really need to know about these at GCSE.
Just understand that a parameter query is one approach to preventing SQL injection hacks.
You could also simply alter database permissions so not all users can perform all actions on the tables of a database.
And finally, you can carry out your own penetration testing.
This is where you actually employ people to try and hack your own systems and their databases
so that you can actually identify where vulnerabilities and loopholes lie
and then use this information to fix those flaws.
You've probably spotted that while covering the various threats posed to networks,
similar prevention methods kept cropping up.
On the screen now are the seven common prevention methods which you need to be most aware of for the GCSE exam.
One which we haven't actually discussed that much and is often overlooked is one of the most obvious,
and that's methods of physical security.
We often focus so much on software prevention methods such as passwords, encryption and firewalls
that we forget that good old-fashioned physical security can still provide some of the best prevention methods.
These cover a vast range of areas.
Some examples include installing cameras, alarms, door locks
and even more straightforward methods such as fences and security guards.
(uplifting piano jingle)