task1 4567

4.	Users have been reporting to the IT department that they have mislaid or had stolen the following portable devices, explain the implications of losing these items and relate the consequences of any sensitive data stored on them.  You may wish to mention any rules and regulations companies need to abide by.
•	USB drives - Could hold sensitive information vital to the company which could be given to the wrong people, this goes for any type of storage of data.
•	Portable hard disk drives - Something like this is much more severe to the department as it can hold much more important information. If under suspicion of stealing or damaging with intent could have serious consequences such as loss of job, fines or even criminal punishment
•	Laptops – Such devices that would be connected to the network could cause damage if used against the department causing more considerable damage than loss of data. This type of damage can be punishment severely such as time in prison.

5.	Explain what the following electronic threats are, then explain how they can damage  systems and data
•	Electrostatic discharge (ESD) -  Can short circuit the motherboard, causing whole possibilities of damage, such as frying the processor or damaging RAM.
•	Unauthorised access to data include removal/copying data or code - This can cause more harm to the owner of the data but can also cause harm to any devices dependant to this data that has been removed from the system.
•	Denial of service attacks - This is a specific technique used to shutdown servers from excessive requests and information sent to these servers.
•	Phishing - This is the act of social engineering where you get more information that should not be disclosed to you such as private information like passwords or employee details etc.
•	Weak or inadequate passwords - An example would be any string that is short in its length, contains few differing characters such as only containing letters and one that can be related or traced to some information such as a nickname or date of birth. Weak passwords are liable to being cracked by hackers and then can be used to access any online information about you.
•	Unsolicited e-mail attachments – attachments sent to people unbeknownst to them, which once downloaded could contain anything such as viruses.
•	“drive by download” attack – Visiting a website that has malicious code which then can download anything to your system which again could be anything such as viruses.
•	Failure to install operating system or program security updates – Any software can take advantage of these failed security precautions as updates will possible be much more stable and better for security. Again viruses.
•	Identity theft – This is theft of key information which makes your identity online such as banking details, address and even personal information. With these details anyone can act like they are you online and can do anything with it such as stealing money from you bank etc.

6.	Explain how the following malicious code works
•	Viruses Corrupts data while spreading throughout the storage of a device
•	Malware/Ransomware Any malicious type of code used to cause damage to a device
•	Spyware Doesn’t destroy, but instead steals any data it can or used to hack into personal information or personal devices such as webcams
•	Adware Type of virus which doesn’t necessarily take or corrupt data but displays adverts such as pop ups or sound.
•	Trojans Can do all of the above to the affected device while also hiding itself and not being tracked by anti-virus
•	Logic Bombs Code that executed when certain conditions are met to do a lot of damage at once
•	Worms Code that can spread across devices which can also do malicious harm
•	Rootkits Replaces exec files in admin restricted paths to mask its identity and its intent
•	Keylogger Virus which tracks any keystrokes made on the device to gain access to sensitive information such as passwords and id numbers

7.	Explain the security vulnerabilities associated with remote access technologies, and what security measure should we take to prevent these vulnerabilities
•	Home working – Not a secure network to work from if at home, not as secure as work. Using remote access from home is a risk as anyone who can get access to your machine at home or even remote access has access to work data. You should work locally as in it’s best not to use an unreliable network connection.
•	‘remote’ or ‘web’ e-mail access – If anyone is able to track your remote accesses from a network than they are able to compromise them. You can use secure connections and make use of VPNs to hide these connections. Use a separate email for work and make sure to use different passwords for each email you have and to change them regularly.
•	Wireless connections – By using any wireless connection such as wifi or Bluetooth, others are able to gain access to your devices through some means and can take information from you. Make sure to disable any wireless connections when you are not using them and again use secure and safe connections.
•	Mobile phones – If your phone has any access to important confidential information then it is at risk. Having a simple passcode and not encrypting the storage on the phone leaves it more vulnerable. Changing the passcode regularly, connecting to secure servers, using VPNs and disabling unnecessary services can help with security.
•	Bluetooth – Same situation as wireless connections
•	Laptops – Showing any portable devices like this to the public is a risk of it getting stolen with all the personal information. Making sure that these devices are secure physically by using a Kensington lock or any other mechanism for safekeeping. While also again using secure connections and disabling services when not needed.
•	Web page hijack – There are many vulnerabilities to web development depending on the site such as SQL injections and hacking into the CMS. Having a secure password and making sure only a limited about of people have access to the cms will lower the risk. Ensuring there is no injections server side to ensure no scripts can be put into the site.