Stories

https://www.metacompliance.com/blog/5-examples-of-security-breaches-in-2018/

Social engineering

1. the use of centralized planning in an attempt to manage social change and regulate the future development and behaviour of a society. "the country's unique blend of open economics, authoritarian politics, and social engineering"
2. (in the context of information security) the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes. "people with an online account should watch for phishing attacks and other forms of social engineering"

A brute force attack is a trial and error method used by application programs to decode encrypted data such as passwords, through exhaustive effort (using brute force) rather than employing intellectual strategies.

A denial-of-service (DoS) is any type of attack where the attackers (hackers) attempt to prevent legitimate users from accessing the service. In a DoS attack, the attacker usually sends excessive messages asking the network or server to authenticate requests that have invalid return addresses

The data or message which is sent by the sender is intercepted by an unauthourized individual - the attacker.

Security Risks

1. malware
   • trojan horses
   • viruses
   • worms
   • browser malware ()
2. social engineering
3. phishing
4. brute force attack
5. denial of service
6. data interception
7. SQL injection
8. poor network policy

---------------------------------

1. rogue security software
2. rootkit
3. man-in-the-middle attack
   1. DNS spoofing
   2. HTTPS spoofing
   3. IP spoofing
   4. ARP spoofing
   5. SSL hijacking
   6. Wi-Fi hacking

https://securitytrails.com/blog/top-10-common-network-security-threats-explained

Pharming: a fraudulent practice that directs internet users to a bogus website that mimics a legitimate one, in order to get their username, password and other confidential information.

Phishing: the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers. "an email that is likely a phishing scam"

Security Measures

1. user access rights
2. using passwords along with username
3. network policy
4. acceptable use of network
5. backup
6. disaster recovery
7. network forensics
8. anti-malware
9. firewall
10. penetration testing
11. encryption

-----------------------------

SQL injection is a code injection technique, used to attack data-driven applications, in which malicious (code |SQL statements) are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).

A set of rules governing the setting up and usage of network. Poorly designed or poorly implemented rules will lead to weakness which will could be used by attackers.

Malware - malicious software that could harm the system.

ping, nmap traceroute, tracert,

detection and logging

prevention

https://robertheaton.com/2014/03/27/how-does-https-actually-work/

HTTPS = HTTP + SSL (Transport Layer Security)

SSL establishment

1. Hello - client Hello (info for server) ; ServerHello (info for client)
2. Certificate exchange - trust building
3. Key exchange - public-private keys exchanged. Public key for encryption, private key for decryption