����ý

Threats to a network can take many forms.

• social engineering
• unpatched software
• USB and digital devices
• eavesdropping
• key loggers

Social engineering

Social engineering is where users are manipulated by cyber criminals into giving access to the network. This might be done with or without their knowledge. Some of the most common forms of social engineering are phishing and shoulder surfing.

Phishing

In the most common form of phishing, a hacker pretends to be somebody in order to trick the user into disclosing sensitive data such as their user ID and password. For example, this might be an email pretending to be a genuine message from the user’s bank containing a link to a website that looks like the real bank’s website. When the user clicks on the link it takes them to a fake website, designed to catch data such as their ID and password.

Shoulder surfing

A hacker watches a user to record the password or PIN they enter. This might be by looking over their shoulder at a cashpoint before stealing their bank card and using it to withdraw money. It might involve watching a user as they enter a door code to allow the hacker to gain access to the physical network.

Unpatched software

Occasionally a software manufacturer identifies potential security breaches in their own software and sends out patches to their registered users. The patches update the software and fix the potential hazards. A network manager is responsible for keeping up to date with the latest patches. They must ensure that the patches are installed on the system before a cyber criminal can use the security loopholes to gain access to their data.

USB and digital devices

The network policy should identify if users are allowed to connect USB devices and digital devices to the network and how this can be done safely. These devices can contain malware, which may infect the network, causing damage to hardware, software and data.

Eavesdropping

A hacker monitors a network in order to gain information. An example of this is wiretapping, where communications are monitored. The hacker can use this data later to gain access to the system by pretending to be an authorised user. This is also known as a ‘man-in-the-middle’ attacks.

Key loggers

Key loggers are programs that capture user input. This data is then sent on to people with malicious intent.