Cyber Attacks and Social Engineering Quiz

Cyber Attacks

• A cyber attack is any electronic attack on computer systems, servers, networks, or devices
• Attacks aim to:
  • Gain access to data
  • Delete or modify information
  • Disable systems
  • Damage connected devices (often by overriding safety limits)

Social Engineering

• Attacks that exploit human behavior and responses to situations
• Common forms:
  • Phishing: Email or fake websites that look legitimate, tricking users into revealing personal info
  • Shoulder surfing: Observing users to steal info like passwords/PINs, often in public places
  • Pharming: Redirecting users to a fake website, often through malicious emails or DNS server infection

Pharming

• Domain names are used to represent IP addresses (Internet Protocol addresses) to make internet use easier
• Domain Name Service (DNS) translates the domain name back to the IP address when you enter it in a browser.
• If you previously visited a site, the IP address is cached on your computer
• Malware in emails can change the IP address to a bogus one, redirecting the user to a fake site
• This can affect everyone since malware may also affect the DNS servers

Shoulder Surfing

• Gaining confidential information by directly observing a user's actions, possibly looking over their shoulder
• Often happens in busy places where targets are concentrating on a task
• Goal is to get usernames/passwords/PINs
• Example: At a cash machine, the shoulder surfer observes the user input their PIN on the keypad, once seen, the card is stolen

Unpatched Software

• Software security issues are often found after use in the real world, and updates are released to correct them
• Security patches require manual installation by technicians
• Organizations may miss applying these patches, leaving the software vulnerable

USB Devices

• USB flash drives (and other USB devices) can contain malware and transfer it to a computer/network, or copy data to the attacker
• Malware can be transferred through the Internet

Eavesdropping

• Intercepting data sent between computer systems, similar to listening to a conversation without the knowledge of those involved
• Done without copying or stealing the data

Code Vulnerabilities

• Errors in programming logic can lead to security flaws
• Code performs the required task, but has errors that allow a security breach

Code Reviews

• Review of code by another programmer, often more experienced/senior, to identify coding errors or vulnerabilities
• Automated code review software can also be used to highlight common errors in programming languages

Modular Testing

• Testing individual parts/modules of the code as they are created, confirming proper functioning
• Importantly, helps catch small errors which could potentially be exploited by hackers or lead to program crashes

Audit Trails

• Records of activities on a computer system, which cannot be altered.
• Can detail the time of activity, user/program responsible, and activity undertaken
• Protects against alterations of records
• Usually chronological and not intended for direct user viewing

Network Security

• Effective management, monitoring, and training of users are crucial
• Staff need to be up-to-date with technical training

Ethical Hacking

• Branch of cybersecurity aimed at proactively identifying system weaknesses that malicious actors could exploit
• Uses hacking techniques legally and ethically
• Goal is to improve weaknesses and prevent attacks to enhance cybersecurity

Penetration Testing

• Authorised attack against IT systems to find vulnerabilities (legal)
• Can be conducted by internal staff or external contractors
• Used to assess security and identify potential weaknesses

Network and User Policies

• Written documents detailing authorized network activities, data security protocols and password management.
• Crucial for network security
• Employee sign-off on policies is often required before network access.

User Policies

• Policies on network usage outlining acceptable and unacceptable activities.
• Policies relating to acceptable use/disallowed use, what happens for violations, reporting processes and security procedures.
• Policies concerning secure password conventions, and importance of maintaining security in general

Test your knowledge on cyber attacks, social engineering tactics, and pharming. This quiz covers various types of electronic attacks aimed at exploiting data, systems, and human behavior. Challenge yourself to understand these critical cybersecurity concepts and their implications.