Securing Data & Systems WJEC GCSE CBAC

What is meant by social engineering?

• When cyber criminals take advantage of human behaviours without the

  use of code to gain unauthorised access to sensitive data.

• When cyber criminals take advantage of poor security to use basic code to gain unauthorised access to sensitive data.

• When cyber criminals engineer the code to gain unauthorised access to sensitive data.

• When cyber criminals take advantage of poor security to use advanced coding techniques to gain unauthorised access to sensitive data.

Reorder the following to show the life cycle of a social engineering attack

• Interact with the victim

• Execute the attack

• remove all traces of the attack

• Identify the victim

What type of social engineering attack is this?

• Phishing

• Trojan

• Denial of service

• Scareware

What is phishing?

• A fraudulent technique where an internet user is tricked (an email

  message is common) into revealing personal or confidential

  information

• A method of forcing users into denial of service therefore revealing login details

• A type of wide scale attack that searches for login details in email inboxes

• A fraudulent technique where an internet user is tricked using a coded script into revealing personal or confidential

  information.

What type of language would you expect to see in a phishing email?

• Pressuring, urgent demanding

• Suggestive, polite, friendly

• Formal, non urgent professional

• Kind, helpful, endearing

Phishing emails are normally addressed dear sir/madam and are not personal

• TRUE

• FALSE

Match the following Social engineering attack methods

• Scareware

• A fraudulent technique

  where an internet user is

  tricked (an email message is

  common) into revealing

  personal or confidential

  information.

• Shoulder Surfing

• This is when a criminal will

  make up a scenario in order

  to extract sensitive

  information. This could be

  done via email, over the

  phone or even in person.

• Blagging

• This method refers to the act of obtaining

  personal or private

  information through direct

  observation.

• Baiting

• Malicious computer

  programs designed to trick a

  user into buying and

  downloading unnecessary

  and potentially dangerous

  software, such as fake

  antivirus protection.

• Phishing

• Attacks of this method use a false

  promise to pique a victim's

  greed or curiosity. They

  lure users into a trap that

  steals their personal

  information or inflicts their

  systems with malware.

Short for malicious software, Malware is a blanket

term for viruses, worms, trojans and other

harmful computer programs

• True

• False

Match the following

• Trojan

• Used to track users activity without their

  knowledge and might use key loggers to

  monitor actions taken by the user and gain

  personal information.

• Ransomware

• Encrypts the user personal data using

  strong encryption methods and will

  demand a ransom to decrypt. This ransom

  will usually be in the form of a fee.

• BOT

• A type of malware that can copy itself and

  spread to other users by attaching itself to

  other files.

• Virus

• An automated type of malware used to

  perform DDOS attacks to get access to

  servers

• Spyware

• Enter users computer as a normal file or

  program and once downloaded, will

  perform malicious tasks.

Match the following Network Security attacks

• Distributed Denial of Service

  Attack:

• This method overloads the

  network by using bots to send

  useless requests to servers to a

  point in which is becomes flooded and unresponsive. These bots can be designed to perform malicious tasks such as stealing data.

• Brute Force Attack

• This method of attack requires

  very little ‘specialist knowledge’.

  Hackers will use automated

  software to try millions of

  different password combinations.

  Therefore this can be referred to

  as a ‘trial and error method’.

• Pack Sniffers

• This involves the use of packet

  analysers (packet sniffers)

  These are used to intercept data

  packets on a network which are then analysed. Sensitive data such as login names, passwords and credit card numbers can be stolen.

• SQL Injection

• This attack is used to interfere with

  queries that an application makes to its database in order to gain

  unauthorised access to users data