セキュリティ脅威

The Friday the hospitals went dark

• On 12 May 2017 a program called WannaCry spread to more than 200,000 computers in 150 countries in a single day. It needed no one to click anything: it found a flaw in Windows file sharing and copied itself from machine to machine.
• On each one it encrypted every file and demanded $300 in bitcoin. In the UK, a third of hospital trusts were hit; 19,000 appointments were cancelled and ambulances were diverted.
• The patch that closed the flaw had been published two months earlier. The computers that were hit had not installed it.
• Worm, ransomware, missing update: three words from this lesson in one afternoon. This lesson is the threats to data and to the systems that hold it.

Security, privacy, integrity

• Security 安全 is keeping data safe from loss and from unauthorised 未授权 access, change or deletion.
• Privacy 隐私 is keeping data confidential, so that only those with the right to see it can, with consent and for a clear purpose.
• Integrity 完整性 is the data being accurate, consistent and complete.
• A file can be secure but corrupted, or accurate but readable by anyone. The exam asks for the difference in one sentence each.

Two things to protect

• The data: it is personal and confidential, so it must not be read, changed or deleted by an unauthorised person, and losing it would stop the organisation working.
• The computer system: an intruder who reaches it can install malware, use it to attack other systems, damage hardware or software, or lock it with ransomware.
• A secure system is the first line of defence for the data on it. "Why must a school keep both secure?" wants one reason for each.

Malware

Two families: the ones that spread themselves and the ones that hide

Worked example: describe a virus and spyware

Tricking people

• Phishing 网络钓鱼: an email pretending to come from a legitimate organisation leads the user to a fake website that collects their credentials or personal data.
• Pharming 域名欺骗: malicious code redirects the user to a fake website even when they type the correct address.
• Social engineering 社会工程: tricking a person into giving up information, by phone, by email or in person.
• The difference the exam marks: phishing needs the user to follow a link; pharming works on a correct address.

Attacks on the network

• Hacking by hackers 黑客: unauthorised access, often through a weak password or a software flaw.
• Denial of service 拒绝服务 (DoS/DDoS): a server is flooded with requests until real users cannot reach it.
• Eavesdropping 窃听: capturing data in transit, a risk on open Wi-Fi. Man-in-the-middle 中间人攻击: an attacker secretly relays or alters the messages between two parties.

Both parties believe they are talking to each other

Worked example: two threats to a school network

Restricting the risk of malware

• Install anti-malware software and keep it updated, so that new malware is recognised.
• Use a firewall. Keep the operating system and applications patched, which is exactly what WannaCry's victims had not done.
• Do not open attachments or download files from unknown sources, and train users to recognise phishing.

Marks that slip away

You've got it