���˿���

An organisation needs to be able to rely on the data it is storing about its staff, customers and products or services. There are several dangers that are inherent in using networks:

• hacking - just being connected to a network opens the data to the possibility of hacking
• viruses - these may be sent via the internet, email, or as part of a hack
• technical breakdown - if this happens, there can be serious consequences for any organisation if it cannot network
• denial of service (DoS) attack - prevents users from accessing the parts of a network that they can normally access, which can prevent business from operating at all
• interception - if traffic can be intercepted then there is a possibility of accessing financial and personal data

If this data is breached it could:

• cost the organisation money through lost business, payments to recover the data or payment of ransom demands
• cause the organisation to incur a fine for failing to keep the data safe or for breaking the law by failing to comply with the Data Protection Act/General Data Protection Regulation (GDPR)
• make customers lose trust in the business if they fail to keep their personal details safe
• allow competitors to win business by gaining access to confidential client information

Ways to prevent network security breaches

Validation and authentication techniques

There are many ways that a network can ask a user to prove they are who they claim they are. This can include:

• using suitable user ID and passwords
• using a PIN
• drawing a pattern on a smartphone
• using face and voice recognition
• sending an email confirmation to ensure they are the correct person when making an online order
• two-factor authentication, such as a bank ringing an accepted phone number to confirm when a new payment is set up, or a PIN and a card having to be used together
• using CAPTCHA to prove they are human and not a robot
• validating parameters sent with a webpage, eg HTML pages might have malicious script embedded

Antivirus software

A virus is a computer program that is able to copy itself with the intention of causing damage to a computer system. It is often transferred with another file, known as a vector, without the computer user’s knowledge. Antivirus software must be installed and regularly updated to search out and destroy viruses before they can cause damage to the system or spread to other users.

A worm is like a virus but replicates itself before spreading to other programs and/or computers.

Malware is a term that covers any software attempt to disrupt computer systems.

Access levels

An organisation is responsible for setting secure access levels for the users of the system. Some individuals may need access to sensitive data that should not be available to other users of the system. The network manager must ensure these are set up and maintained correctly.

Firewalls

The decision to allow or block traffic is based on rules, known as the firewall policy. For example, some programs, such as email software and web browsers, have legitimate cause to send a transmission. These programs are known and the firewall policy allows their communications. However, the firewall can block transmissions that are sent from unknown sources or to unknown destinations - as well as those that are known to be a security risk.

Firewalls can be hardware-based or software-based. Hardware firewalls tend to be more expensive, but they are also more effective.

Acceptable use policies

Acceptable use policies define how the users of a system must act. They can include:

• rules preventing the connection of external devices such as USB memory sticks, which may contain and transmit viruses
• regulations regarding secure passwords, for example using a number of letters, numbers and symbols
• rules to govern which websites can and cannot be visited
• methods to prevent any user wirelessly connecting an unsecured laptop, tablet or smartphone
• controls on what facilities can be accessed remotely (away from the organisation)

A network manager must attempt to prevent and thwart all types of threat. They need to be aware of new threats as they emerge and update their policies to reflect these changes.

Disaster recovery procedures

Disaster recovery procedures are defined to use in case of data loss. They tell staff what to do to recover the data. A disaster recovery procedure needs to anticipate natural disasters (flood, fire, etc) accidental loss (user error) and malicious attacks from both inside and outside the organisation. It should include backup procedures and how to restore from backup.