Common Security Threats:
There are many information
security threats that we need to be constantly aware of and protected against
in order to ensure our sensitive information remains secure. This document
details different information security threats that are commonly found, together
with some preventative measures that can be taken.
Unauthorized Access –
Enter at your own risk:
The attempted or successful
access of information or systems, wihtout permission or rights to do so.
Ensure
you have a properly configured firewall, up to date malware prevention software
and all software has the latest security updates.
Protect
all sensitive information, utilizing encryption where appropriate, and use
strong passwords that are changed regularly.
Social
Engineering – Go find some other mug:
Tricking
and manipulating others by phone, email, online or in-person, into divulging
sensitive information, in order to access company information or system.
Verify
all requests for sensitive information, no matter how legitimate they may seem,
and never share your passwords with anyone – not even the IT Service Desk.
Never
share sensitive information if in doubt, and report suspected social
engineering attempts immediately.
Cyber Espionage – Hey, gets
off my network!
The act of spying through the
use of computers, involving the covert access or “hacking” of company networks
to obatin sensitive information.
Be
alert for social engineering attempts and verify all requests for sensitive
information.
Ensure
software has the latest security updates, your network is secure and monitor
for unusual network behavior.
Malware – you Installed what?!
A collective term for malicious
software, such as virus, worms and trojans; designed to infiltrate
systems and information for criminal, commercial or destructive purposes.
A collective
term for mailicious software, such as viruses, worms and trojans; designed to
infiltrate system and information for criminal, commercial or destructibe
purposes.
Ensure
you have a properly configured firewall, upto date malware prevention and all
software has the latest security updates’
Do
not click links or open attachments in emails from unknown senders, visit
un-trusted websites or install dubious software.
Data
Leakage – I seek what you leak
The
international or accidental loss, theft or exposure of sensitive company or
personal information.
Ensure
all sensitive information stored on removeable storage media, mobile devices or
laptops is encrypted.
Be
mindful of what you post online, check email recipients before pressing send,
and never email sensitive company information to personal email accoutns.
Mobile Device Attack –
Lost, but not forgotten:
The malicious attack on, or unauthorized access of,
mobile devices and the information stored or processed by them; performed
wirelessly or through physical possession.
Keep
devices with you at all times, encrypt all sensitive data and removable storage
media, and use strong passwords.
Aviod
connecting to insecure, un-trusted public wireless networks and ensures
Bluetooth is in ‘undiscoverable’ mode.
Insiders – I see bad
people
An employee or worker with
malicious intent to steal sensitive company information, commit fraud or cause
damage to company system or information.
Ensure
access to senstive information is restricted to only those that need it and
revoke access when no longer required.
Report
all supicious activity or workes immediately to the IT service Desk.
Phishing – Think before
you link
A form of social engineering,
involving the sending of legitimate looking emails aimed at fraudulently
extracting sensitive information from recipients, usually to gain access to
system or for identity theft.
Look
out for emails containing unexpected or unsolicited request for sensitive
informations, or contextually relevant emails from unknown senders.
Never
click on suspicious looking links within emails, and report all suspected
phishing attempts immediately.
System Compromise – Only the
Strong survive
A system that has been
attacked and taken over by malicious individuals or ‘hackers’ usually through
the exploitation of one or more vulnerabilities, and then often used for
attacking other system.
Plug
vulnerable holes by ensuring software has the latest security updates and any
internally developed software is adequately security reviewed.
Ensure
system are hardened and configured securely, and regularly scan them for
vulerabilities.
Spam – Email someone else
Unsolicited email sent in
bulk to many individuals, usually for commercial gain, but increasingly for spreading
malware.
Only
give your email to those you trust and never post your address online for
others to view.
Use
a spam filter and never reply to spam emails or click links within them.
Denial of Service – Are you
still here?
An international or uniternational
attack on a system and the information stored on it, rendering the system
unavailable and inaccessible yo autorized users.
Securely
configure and harden all networks and network equipment against known DoS attacks.
Monitor
networks through logreviews and the use of instruction dectection or prevention
system.
Identity Theft – you will
neve be me
The theft of an unknowing
individual’s personal information, in order to fraudlently assume that
individual’s identity to commit a crime, usually for financial gain.
Never
provide personal information to un-trusted indivicuals or websites.
Ensure
personal information is protected when stored and securely dusposed of when no
longer needed.
