Common causes of network security threats

Network security threats can compromise the safety of data and systems. These threats often occur when organisations do not properly secure their networks, such as by failing to encrypt data or using poorly written code. Additionally, threats can arise from hackers who exploit human vulnerabilities, like manipulating employees to gain unauthorised access.

Social engineering as a method to exploit people

Social engineering is a technique used to obtain sensitive information or unauthorised access to networks by manipulating people, often employees in large organisations. It relies on psychological influence rather than technical hacking, making people the weak point in secure systems.

How social engineering works over the telephone

• Impersonation tactics - Attackers call employees and pretend to be network administrators or other internal staff to build trust.
• Gaining confidential data - Once trust is established, the attacker persuades the employee to reveal personal details, such as login credentials, or sensitive company information.

Prevention of social engineering attacks

The most effective way to combat social engineering is through employee education. Companies should train staff on the risks, including what to watch for, such as suspicious calls requesting confidential information. Even advanced software cannot prevent someone from voluntarily sharing a password, so awareness is key.

Phishing attacks and how to prevent them

Phishing is a type of social engineering where criminals send emails or text messages pretending to be from legitimate businesses, such as banks or online retailers. The goal is to trick recipients into providing personal information.

How phishing attacks operate

1. Criminals distribute emails or texts to large numbers of people, hoping some will believe the message is genuine.
2. These messages often include links to fake (spoof) websites that mimic real company sites.
3. Users are prompted to enter or update sensitive details, like passwords or bank account information.
4. Once entered, this data is captured by the criminals, who can then access the victim's real accounts.

Spotting and reducing phishing risks

• Common signs of phishing - Look for poor grammar, unexpected requests to follow links, or demands to update personal details.
• Protective features in software - Many email programmes, web browsers, and firewalls include anti-phishing tools that filter out suspicious messages.
• Safe practices - Always treat emails asking for personal information with caution; verify the sender through official channels before responding.

SQL injection attacks on databases

Networks that use databases are at risk from SQL injection attacks. SQL (Structured Query Language) is a programming language commonly used to access and manage data in databases. An SQL injection involves entering malicious SQL code into a website's input field to expose sensitive information.

How SQL injections exploit weak validation

• Vulnerability in input fields - Websites often require users to enter data, like a PIN, to access accounts. If the site's SQL code lacks strong input validation (checks to ensure data is in the correct format, e.g., numerical only), attackers can input SQL code instead.
• Bypassing security - This code tricks the database into revealing more data than intended, potentially including details from other users.

Example of an SQL injection

Consider a website where users enter a PIN to view account details. The normal SQL query might look like this:

If validation is weak, an attacker could enter "67890 OR 1=1" instead of a simple PIN. This changes the query to:

Here, "1=1" is always true in SQL, so the query returns details for all accounts in the database, not just the attacker's.

Preventing SQL injections

To avoid these attacks, websites must use strong input validation in their SQL code, ensuring that only expected data types (e.g., numbers) are accepted. This prevents malicious code from being executed and protects sensitive information.