Identifying and Preventing Vulnerabilities
Learn how to protect computer systems from security threats
Introduction: Defence in Depth
No single security measure can protect against all threats. Effective security uses multiple layers of protection - if one layer fails, others remain. This approach is called defence in depth.
Layers of Security Protection
1. Penetration Testing
What is Penetration Testing?
Penetration testing (pen testing) is the practice of testing a computer system, network, or web application to find security vulnerabilities that an attacker could exploit. It's essentially ethical hacking - authorised attempts to break into a system.
How It Works
- Planning - Define scope and goals of the test
- Reconnaissance - Gather information about the target system
- Scanning - Use tools to identify potential entry points
- Exploitation - Attempt to breach the system using discovered vulnerabilities
- Reporting - Document findings and recommend fixes
What It Prevents/Limits
| Threat | How Pen Testing Helps |
|---|---|
| SQL Injection | Identifies vulnerable input fields before attackers do |
| Unpatched Systems | Reveals outdated software with known vulnerabilities |
| Misconfiguration | Finds security settings that are too permissive |
| Weak Passwords | Tests if default or common passwords are in use |
2. Anti-Malware Software
What is Anti-Malware Software?
Anti-malware software (including antivirus) detects, prevents, and removes malicious software from computers. Modern solutions protect against viruses, worms, trojans, ransomware, spyware, and other threats.
How It Works
Signature Detection
Compares files against a database of known malware "signatures" (unique code patterns)
Heuristic Analysis
Analyses code behaviour to detect new, unknown malware based on suspicious patterns
Real-time Scanning
Monitors files as they're opened, downloaded, or executed
Quarantine
Isolates suspicious files so they cannot harm the system
What It Prevents/Limits
| Threat | Effectiveness | How It Protects |
|---|---|---|
| Viruses | High | Detects and removes infected files, prevents execution |
| Worms | High | Blocks network spreading, quarantines infected files |
| Trojans | High | Identifies disguised malware before installation |
| Ransomware | Medium | Can detect known variants; new variants may evade detection |
| Phishing | Low | Limited - mainly blocks malicious downloads, not fake emails |
3. Firewalls
What is a Firewall?
A firewall monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks (like the internet).
Types of Firewalls
Hardware Firewall
Physical device between network and internet. Protects entire network.
Software Firewall
Program installed on individual computers. Protects that specific device.
How It Works
- Packet Filtering - Examines packets and blocks based on IP addresses, ports, or protocols
- Stateful Inspection - Tracks active connections and validates packets belong to legitimate sessions
- Application Gateway - Inspects traffic at the application level (e.g., blocking specific websites)
- Rules - Administrator-defined allow/deny rules for traffic types
What It Prevents/Limits
| Threat | Effectiveness | How It Protects |
|---|---|---|
| Unauthorised Access | High | Blocks external connection attempts to internal systems |
| DoS Attacks | Medium | Can limit connection rates; less effective against DDoS |
| Worms | High | Blocks network ports worms use to spread |
| Data Exfiltration | Medium | Can block suspicious outbound connections |
| Phishing Emails | Low | Cannot inspect email content - emails pass through on allowed ports |
4. User Access Levels
What are User Access Levels?
User access levels (access control) ensure users only have permission to access the data and systems they need for their job. This follows the principle of least privilege - give users the minimum permissions necessary.
Common Access Levels
| Level | Typical Permissions | Example Users |
|---|---|---|
| Administrator | Full access - install software, change settings, manage users | IT staff, system administrators |
| Standard User | Run applications, access own files, limited settings | Most employees, students |
| Guest | Minimal access - basic browsing, no file storage | Visitors, temporary users |
| Read-Only | View files but cannot modify or delete | Auditors, external partners |
What It Prevents/Limits
| Threat | How Access Levels Help |
|---|---|
| Malware Installation | Standard users cannot install software, limiting malware spread |
| Data Theft (Internal) | Users only see data relevant to their role |
| Accidental Damage | Limited permissions prevent accidental deletion of critical files |
| Privilege Escalation | Attackers gaining access to one account have limited reach |
5. Passwords
Password Security
Passwords are the most common form of authentication - proving you are who you claim to be. Strong passwords are a critical first line of defence against unauthorised access.
Characteristics of Strong Passwords
- Length - At least 12 characters (longer is better)
- Complexity - Mix of uppercase, lowercase, numbers, and symbols
- Unpredictability - No dictionary words, names, or dates
- Uniqueness - Different password for each account
Password Policies
Minimum Length
Require passwords of at least 8-12 characters
Complexity Rules
Require mix of character types
Expiry
Force password changes periodically (though this is debated)
History
Prevent reuse of recent passwords
What Passwords Prevent/Limit
| Threat | How Strong Passwords Help |
|---|---|
| Brute-Force Attacks | Longer, complex passwords take exponentially longer to crack |
| Dictionary Attacks | Random characters not found in wordlists |
| Credential Stuffing | Unique passwords mean one breach doesn't compromise all accounts |
| Social Engineering | Random passwords cannot be guessed from personal information |
6. Encryption
What is Encryption?
Encryption converts readable data (plaintext) into an unreadable format (ciphertext) using a mathematical algorithm and a key. Only those with the correct key can decrypt and read the data.
Types of Encryption
Symmetric Encryption
Same key encrypts and decrypts. Fast, used for large data. Key must be shared securely.
Asymmetric Encryption
Public key encrypts, private key decrypts. Slower but solves key sharing problem.
Where Encryption is Used
- Data at Rest - Encrypting stored files (full disk encryption, file encryption)
- Data in Transit - Encrypting network communications (HTTPS, VPNs)
- Emails - End-to-end email encryption
- Databases - Encrypting sensitive fields like passwords and payment details
What Encryption Prevents/Limits
| Threat | Effectiveness | How Encryption Protects |
|---|---|---|
| Data Interception | High | Intercepted data is unreadable without the key |
| Data Theft | High | Stolen encrypted files/devices cannot be read |
| Man-in-the-Middle | High | HTTPS ensures attackers cannot read or modify traffic |
| Eavesdropping | High | WiFi traffic encrypted even on public networks (with VPN) |
7. Physical Security
What is Physical Security?
Physical security protects computer systems, networks, and data from physical threats - theft, damage, or unauthorised physical access. It's often overlooked but is fundamental to overall security.
Physical Security Measures
| Measure | What It Protects | How It Works |
|---|---|---|
| Locks | Rooms, cabinets, devices | Physical barriers requiring keys or codes |
| CCTV | All areas | Deters crime, provides evidence, enables monitoring |
| Security Guards | Building access | Verify identity, respond to incidents |
| Biometrics | Secure areas | Fingerprint, retina, or facial recognition for access |
| ID Badges | Building/room access | Swipe cards, RFID badges control who enters |
| Cable Locks | Equipment | Physically secure laptops and equipment to desks |
What Physical Security Prevents/Limits
| Threat | How Physical Security Helps |
|---|---|
| Hardware Theft | Locks, guards, and tracking prevent stealing computers |
| Unauthorised Access | Only authorised personnel can physically access servers |
| Social Engineering | ID verification prevents tailgating and impersonation |
| Data Theft via USB | Restricted physical access prevents plugging in devices |
| Sabotage | CCTV deters deliberate damage to equipment |
Summary: Matching Prevention to Threats
Each prevention method is most effective against specific threats. The table below shows which methods best address each type of attack:
| Threat | Most Effective Prevention | Supporting Measures |
|---|---|---|
| Malware | Anti-malware software | User access levels, firewalls, user training |
| Brute-Force Attacks | Strong passwords, account lockout | Encryption, firewalls (rate limiting) |
| Phishing | User training and awareness | Anti-malware, email filtering |
| Data Interception | Encryption | VPNs, secure protocols (HTTPS) |
| SQL Injection | Penetration testing, secure coding | Firewalls (application layer) |
| DoS/DDoS | Firewalls, traffic filtering | Cloud-based DDoS protection |
| Unauthorised Access | User access levels, passwords | Physical security, firewalls |
| Hardware Theft | Physical security | Encryption (protects data on stolen devices) |
Practice Activities
Test your understanding of security prevention methods: