Threats to Data, Info & Systems

Threats to Data, Info & Systems

Business Data and Information

A business’ data, information and systems are extremely important to any organisation. They’re also extremely important to individuals who keep a lot of personal information on their computer systems that could cause great harm if lost or stolen.

Unfortunately, when using IT systems there are many things that can cause harm to your data, information and systems. These are often malicious users trying to steal data and purposely cause harm, but can also happen completely accidentally.

.

Today we will learn about some of the biggest Threats to data and information.

Open Ended

Can you think of any threats to data? Write anything that springs to mind below.

Malware

There are FOUR types of Malware you need to know about:

Worms, Trojans, Viruses & Spyware

Types

• Designed to harm or gain unauthorised access to a computer system.

• Viruses are just ONE type of Malware

Malicious Software

​Malware Type	​Description
​Viruses	​A program that copies and inserts itself into programs running on your computer system. It spreads when the programs or data files it is attached to are passed to another system, such as via an email attachment or files on a USB stick.
​Worms	​Very similar to viruses in many ways, the key difference is worms do not need to attach themselves to other programs. They instead are standalone programs and spread through tunnelling through a network and exploiting security holes in systems to gain access.
​Trojans	​A harmful program that masquerades as a legitimate software application. It spreads by users downloading it thinking it is a program they want, but it hides a harmful payload. It doesn’t self-replicate like worms and viruses.
​Spyware	​A malicious program that monitors user activity for the purpose of stealing personal information. An example would be a keylogger that records every keystroke a user makes and sends it back to a malicious user. This is commonly spread as part of a Trojan.

Drag and Drop

​

Placeholder

are standalone programs that spread through holes in a network. ​

Placeholder

checks network user activity and records the information. ​

Placeholder

look like real programs but are harmful. ​

Placeholder

copy themselves into programs running on your system.

Drag these tiles and drop them in the correct blank above

worms

spyware

trojans

viruses

Multiple Choice

Trojans spread when attached data are passed to another system via an email attachment or USB stick.

• True

• False

Multiple Choice

Spyware are programs that look like real software applications. They trick you into downloading fake malicious programs.

• True

• False

Poll

Have you ever been a victim of Malware?

• Yes

• No

Impact of Malware

Malware can be used to corrupt or delete data being stored on IT systems. This could cause a lot of inconvenience to an organisation as they will need to spend time recovering the data from backups. If they have no backups then this could be disastrous as they could lose sales records, stock levels, employee pay data, etc.

The impact on individuals could be just as harmful. For example, personal photos that have real emotion value could be lost forever causing a lot of distress. Malware, especially spyware, could also be used to gather personal data, such as bank details, in order to steal money from individuals or to commit identity fraud.

Open Ended

There are many news stories where businesses have been impacted by malware. Take 5 minutes to research one example online and the consequences to the business. Briefly summarise your findings below.

Hackers

• Someone who gains unauthorised access to a computer system.

• Simple Hacking can be done by guessing passwords and getting into someone else's account.

• More professional Hackers use programs that automatically go through a list of common passwords until it breaks into the computer system by eventually guessing the correct password. This is known as a Brute Force Attack.

• This is why you are always encouraged to use complex passwords!

Hackers

There are other more technical methods of hacking which require programming knowledge and an understanding of the flaws in a computer system and its software.

Not all hacking is malicious. White Hat Hackers are employed to test systems for security flaws by attempting to gain access to help check the security procedures of an organisation. There are even "bounties" paid to hackers who detect flaws and report them to the organisation.

Match

Match the following

• Brute Force Attack

• White Hat Hacker

• Simple Hacking

Running a program to test lots of commonly used passwords

Attempting to hack into a system to test security flaws

Guessing a password and entering a system

• Running a program to test lots of commonly used passwords

• Attempting to hack into a system to test security flaws

• Guessing a password and entering a system

Impact to Individuals and Organisations

The unauthorised access to an organisation’s or individual’s data can be used to steal financial information in order to steal money from them.  Personal information taken from individuals, or via records stolen from hacking a business, could also be used for identity fraud.

Hackers could also use any private and confidential data for blackmail purposes. Due to hacking causing a big impact on an organisations reputation, a hack could be used to blackmail the business by revealing the hack to the public.

Open Ended

Businesses that have been hacked can often be fined under the Data Protection Act. Take 5 minutes to research an example of this on the news and summarise details below/post a link to the news article.

Password Strength Calculator

https://www.passwordmonster.com/

Have a go yourself /\

Phishing

Where emails are sent pretending to be from a reputable company or person, but in fact have been sent by a malicious user for the purpose of gaining personal or financial information.

They usually contain a link that appears to be for a legitimate website. However, when clicked on, it will take the user to a malicious website which will contain a form to be filled out with personal data and when submitted, this will go to the malicious user.

Impact to Individuals and Organisations

The goal of phishing is usually to obtain personal and financial information. This is therefore commonly used for stealing money from an individuals or an organisations bank account. Individuals can also be impacted by identity fraud, where personal data is stolen and used to sign up for loans for example.

The data stolen from organisations through a phishing email could be used to then perform a hack on the organisation. For example, a user may reveal their login details.

Open Ended

How can you tell that this is a Phishing email? Give all possible tell tale signs

Open Ended

How can you tell this is a Phishing email? Give all tell tale signs.

Accidental Damage

Not all damage to an IT system is malicious. Through human error, we can lose data and damage our IT systems. Some examples of this include:

• Dropping laptops, tablets, smartphones, etc.

• Spilling liquids on IT systems.

• Misplacing external storage devices, laptops, tablets & smartphones.

• Accidentally deleting or overwriting files or folders.

All of these are done with no malicious intent but can have catastrophic consequences to the business as you could lose a massive amount of data. This is a major reason why businesses will perform regular backups to their data.

Impact to Individuals and Organisations

​Individuals may lose data, such as photos, with emotional value.

Organisations may lose important business data such as sales records.

This is extremely expensive to recover from for both individuals and businesses. You may need to pay a specialist to try and recover the data or will need to recapture and re-enter data from its source.

Finally, you will need to replace any lost or damaged devices which will be costly too, especially to individuals.

Open Ended

There have been cases where employees have left devices on trains or buses and the data has been stolen as a result. Research online for any examples of this happening. What happened and what was the outcome?

Fill in the Blanks

Multiple Choice

Malware can corrupt or ______ data which could be expensive to recover and possibly lead to data being stolen for fraud purposes.

• delete

• save

• duplicate

Match

Match the following

• Hacker

• White Hat Hacker

• Malicious Hacker

Someone who gains unauthorised access to a computer system.

Someone who tries to break in to a system to test vulnerabilities

Someone who gains entry with the intention to misuse the data for fraud etc.

• Someone who gains unauthorised access to a computer system.

• Someone who tries to break in to a system to test vulnerabilities

• Someone who gains entry with the intention to misuse the data for fraud etc.

Drag and Drop

​

Placeholder

is where emails are sent purporting to be a ​

Placeholder

company. But in fact, the email has been sent by a ​

Placeholder

user for the purpose of gaining personal or ​

Placeholder

information in order to commit ​

Placeholder

.

Drag these tiles and drop them in the correct blank above

phishing

reputable

malicious

financial

fraud

Drag and Drop

​Accidental ​

Placeholder

is where IT systems or data are harmed through ​

Placeholder

error, such as dropping a ​

Placeholder

or accidentally ​

Placeholder

important files. This can be ​

Placeholder

, as you need to recover or re-enter the data that has been lost and replace harmed equipment.

Drag these tiles and drop them in the correct blank above

damage

human

device

overwriting

costly

Complete Workbook page on Threats to Data