3.6.1, 3.6.2 - Cyber security and system weaknesses

Purpose of cyber security

Protecting a computer system involves people's actions and organisational procedures as well as security software.

A shop's checkout system must keep customers' information private, record correct prices and remain available to process sales. An attack that steals customer details compromises confidentiality. One that changes prices damages the correctness of data. One that stops the checkouts disrupts availability even if it steals nothing. Cyber security addresses all these purposes.

An organisation might use technology such as a firewall, a practice such as checking the identity of someone requesting a password reset, and a process such as applying updates and reviewing access rights. Buying security software is therefore only one part of protection. The organisation must use and maintain it appropriately.

Passwords, access rights, media and updates

A weakness can make an attack easier without being the attack itself.

Weak passwords are easy to guess or discover, for example a common word or a person's publicly known name. Default passwords are supplied with devices or software; attackers may know these published defaults. If a business leaves a router's default administrator password unchanged, an attacker may gain configuration access without needing to break encryption.

Misconfigured access rights give a user more permissions than their task needs. For example, a temporary receptionist needs appointment access, but should not receive permission to delete all customer records. Excess rights allow misuse by that user and increase the damage if the account is compromised. Use appropriate permissions and review them when roles change.

Removable media, such as a USB drive, can carry malicious files onto a system. A drive can also be used to copy private files out and can be lost after carrying sensitive data. A drive found in a car park should not be trusted because it has a familiar label. Restricting its use and checking permitted media reduce risk.