Walk into the module which will discuss computer attack methods we will try to get an overview of the
process in situations where the target is a typical computer system the issues we will mention in this
module will be discussed in more detail later on.
Knowledge about attack methods is necessary to develop effective protective measures in order to create
a security policy.
We need more than just what we mentioned before.
Which is an assessment of resources and consequences of their loss.
We also need to know attack methods cyber attackers develop these methods years ago but they are constantly
being updated and refined.
What characterizes attack methods in general gathering information about a prospective target is the
first phase.
The information attackers are interested in making certain a certain system in general or users of that
system.
The more information they manage to gather the easier it is for them to conduct a successful attack.
Why successful attack.
We mean one that achieves its aims and remains undetected for a sufficiently long period of time.
The next phase of the attack is looking for entry points entry points or elements of the system which
allowed direct interaction with a user or the system.
One of the most common forms of attack is gaining access to a computer system and tracking the data
flow in local networks.
Lots of data is sent as plain text and many resources are not sufficiently protected.
Very often such resources and data could be classified as sensitive private or confidential and prove
useful for an attacker.
After gaining control over a system the attacker will try to ensure that they will be able to access
it again.
This means they'll try to get administrator privileges they will also try to hide traces of the attack
because the longer it goes undetected the more beneficial it is for the attacker.
First we will consider a very distinctive category of attacks that is local attacks.
They are very successful for one simple reason.
Most of the popular security solutions do not protect computers against local attacks.
As we've mentioned before no computer program which includes operating systems can fulfill its function
when it's switched off.
If you run another operating system on the computer you will get access to all data stored on every
hard drive unless the data is encrypted.
How can we get protected against local attacks.
Technological solutions prove ineffective.
The only effective solution is a security policy.
A successful security policy will include careful control over who gets access to the computers.
One of the most basic security measures for companies is to prevent unauthorized people from entering
the premises.
Everyone on the premises must be required to authenticate their identity usually.
Each employee is required to carry an ID badge that proves his or her identity.
Moreover there are ID badges for visitors.
The problem is that a typical visitor badge is all too easy to fake.
It's just a white piece of plastic with the large word visiter written over it.
Everyone can make one for themselves making a unique ID badge for every visitor would be inefficient.
But even the guest ID badge must be made hard to fake a person wearing such a badge looks more trustworthy.
You should also keep an eye on staff to work on the premises but are not your direct employees.
This man could contract workers such as plumbers electricians or telecommunications specialists.
Remember that a uniform is not necessarily proof of anything.
Nowadays it's relatively easy to get almost any kind of uniform some dress themselves as a postman or
a Chimney-Sweep in order to reinforce their fake identity.
To counter this danger give your employees clear guidelines on how to act when they spot a stranger
on the premises.
An employee should approach the stranger and offer to help in looking for a specific person or department.
Strangers should not be allowed to walk freely on the premises.
The stranger who manages to gain physical access to a computer can give full control over it.
There are some other basic mistakes we should always avoid.
One of them is allowing access to BIOS settings BIOS settings allow you to control the computer's startup.
Therefore access to BIOS should be restricted.
This can be done by using a password other than the default.
We will discuss the issue of default passwords later on so control who enters the premises and protect
BIOS settings from unwanted changes.
Also it's not advisable to boot up a computer from CD.
Sometimes this may be a default option.
What is possible that it was set by a potential attacker.
Moreover it should not be easy to open up a system unit when someone gets access to the hard drive that
can make a clone of it.
It's hard to protect your computer against such manipulation.
However a user or an administrator should be able to tell whether the computer was compromised in such
a way.
Normally you should not leave computer cases open.