1.4.2 Identifying and Preventing Vulnerabilities

A vulnerability is a weakness in a computer system, network, software or security procedure that could be exploited by an attacker. Security measures can either help identify and remove vulnerabilities before they are exploited, or reduce the likelihood and impact of an attack if one occurs.

No single security measure can protect against every threat. In practice, several different methods are often used together to provide stronger protection. These methods include penetration testing, anti-malware software, firewalls, user access levels, passwords, encryption, and physical security.

Penetration testing is the authorised testing of a computer system or network to identify security weaknesses that an attacker could exploit.

During a penetration test, testers deliberately attempt to gain access or bypass security controls in a controlled environment, using techniques similar to those that a real attacker might use. The test may examine software vulnerabilities, network configuration, access controls or how users respond to social engineering attempts.

Penetration testing does not directly stop an attack. Instead, it helps organisations discover vulnerabilities before criminals exploit them. This can help reduce the risk of attacks such as unauthorised access, malware infections, social engineering or other attacks that depend on weaknesses in the organisation's systems or security procedures.

Once weaknesses have been identified, they can be corrected, for example by changing configurations, updating software, strengthening access controls or improving security procedures.

Anti-malware software is designed to detect, block and remove malicious software such as viruses, worms, Trojans, ransomware and spyware.

It can scan files, programs and incoming data for known signs of malware. Anti-malware software is regularly updated so that it can recognise newly identified threats. It may also perform periodic or real-time scans to detect suspicious files or programs.

If malware is detected, the software may quarantine it. Quarantining isolates the suspicious file so that it cannot run or spread while it is examined or removed. Anti-malware software therefore helps prevent malware from being installed or executed and can remove malicious software that has already reached a device.

A firewall is hardware or software that monitors and filters network traffic entering and leaving a device or network.

The firewall compares data against a set of security rules. Traffic that meets the rules is allowed through, while traffic that is considered unauthorised or suspicious can be blocked.

Rules may consider information such as the source or destination IP address, the type of network traffic or the service being accessed. This can help prevent unauthorised connections and restrict communication with known or suspicious sources.

Firewalls may also help reduce some denial of service attacks by blocking or limiting excessive or suspicious traffic. They can also prevent malware on an infected device from communicating freely with systems outside the network.

User access levels control which files, software and system functions different users are permitted to access.

Different users may require different permissions. For example, a teacher on a school network may be allowed to access staff files that students cannot, while an administrator may be allowed to install software or change system settings.

Restricting permissions helps prevent unauthorised access to sensitive information. It can also reduce the damage caused by mistakes, malware or compromised accounts because users can only access or change the resources they have been given permission to use.

For example, if ordinary users are prevented from installing software, malware cannot be installed through that account as easily even if the user is tricked into downloading it.

Passwords are used to authenticate users by checking that they know a secret value associated with an account.

Strong passwords make unauthorised access and brute-force attacks more difficult. Longer passwords or passphrases create a much larger number of possible combinations, increasing the time required to guess them. Passwords should also avoid easily guessed information such as names, birthdays or common words and should not be reused across multiple accounts.

Systems can further reduce brute-force attacks by limiting repeated login attempts or temporarily locking an account after too many unsuccessful attempts.

Two-factor authentication (2FA) can provide additional protection by requiring a second form of verification as well as the password, such as a code sent to another device or generated by an authentication app. This means that obtaining the password alone may not be enough to access the account.

As explored in Lesson 1.3.6 Wired and Wireless Networks, Protocols and Layers, encryption converts readable plaintext into unreadable ciphertext using an encryption key. The data can only be returned to its readable form using the correct decryption key.

Encryption helps protect data from interception and theft. If an attacker captures encrypted data while it is travelling across a network, the data should remain unreadable without the correct key.

Encryption can also protect stored data. For example, files on a device or removable storage can be encrypted so that they cannot easily be read if the hardware is stolen or accessed without permission.

Encryption therefore does not necessarily stop data from being intercepted or stolen, but it can prevent the attacker from being able to understand or use the data.

SQL injection can be limited by checking and safely handling user input before it is used in a database query. Two methods are input validation and input sanitisation.

• Input validation checks that the data entered follows the expected rules. For example, a field that should contain only a username can reject input containing characters or patterns that should not normally appear there.
• Input sanitisation processes user input to remove or safely handle potentially dangerous characters or commands before the data is passed to the database.

These methods reduce the risk of malicious SQL being treated as part of a database command. This helps prevent attackers from bypassing login checks, accessing information without permission, changing stored data or deleting data from the database.

Physical security protects computer equipment, networks and data from physical access, theft, damage or environmental threats.

Measures can include locked server rooms, secure doors, access cards, security cameras and security staff to prevent unauthorised people from reaching important equipment.

Physical security can also protect systems from events such as fire, flooding or other disasters. For example, important backups may be stored securely at a different location so that data can still be recovered if equipment at the main site is damaged.

These measures help prevent unauthorised physical access, theft and tampering with computer equipment. This can reduce the risk of attackers stealing devices or data, accessing systems directly or disrupting services by damaging equipment. Protection against fire, flooding and other physical threats also reduces the risk of systems and data being permanently lost.