Organisations work hard to ensure that their networks are safe.

Firewall

This scans any data entering or leaving the network and blocks any suspicious movement. This prevents not only malware being downloaded but also sensitive data being uploaded.

MAC Address Filtering

Every device that can connect to a network contains a NIC (Network Interface Card). A network manager can filter access to a network to ensure that only devices with specific MAC Addresses can access the network. Essentially they make a list of MAC Addresses that can access the network and every other device is blocked

Anti-malware Software

This software routinely scans a computer to search for malware. Any malware can be deleted or quarantined (so that it cannot access or interfere with any data on the computer).

Access Rights

It is essential in modern organisations that users are set appropriate access rights. Access rights fall into 3 key categories:

• Read/ Write access – users can open and edit files
• Read Only – users can open files to read them but cannot edit them
• No Access – users cannot open the files

Additional rights could be set including whether a user can download files or execute files.

Penetration Testing

Companies must aim to ensure that programs and networks are secure. In order to do this, the can carry out tests to see if anyone could potentially gain access.

White Box testing simulates an attack from someone inside the organisation. They may have a username and password or a certain level of access rights. They may also have knowledge of how they system was created and so may be aware of potential vulnerabilities.

Black Box testing simulates an attack from someone outside the organisation that has no prior knowledge. This could be more thorough as they attempt to gain access by any means. However, once they find a way in, other vulnerabilities may go untested.

Note: These attacks are simulated. They are not real attacks, but pretend attacks carried out by employees.

Biometric Authentication

Many modern devices now use biometrics to authenticate users including:

• Fingerprint scannners
• Facial scanners

Passwords

Organisations can ensure that all users have secure passwords. Typically, secure passwords should avoid any real words or phrases (such as a name or date of birth) and contain the following:

• At least 8 characters
• At least 1 uppercase character
• At least 1 lowercase character
• At least 1 number
• At least 1 symbol.

CAPTCHA

These are simple tests where a user has to repond to prove that they are a human and not an internet bot (a piece of software that can complete forms online rapidly – often used for malicious purposes).

Trivia: CAPTCHA stands for  Completely Automated Public Turing test to tell Computers and Humans Apart

2 Factor Authentication

People enter usernames and passwords to authenticate themselves. However, sometimes more security is required. To add an additional layer of security, a pin number might be sent to a phone – this means the user must be in possession of the phone related to the account. Alternatively they could be asked for a piece of additional private information that others are not likely to know (e.g. mother’s maiden name, colour of first car, first job).

Updates

After software has been released, it is common for developers to release updates to patch any security concerns. To ensure that users are always using the latest version of the software, administrators can set updates to install automatically.

Encryption

It is important that any sensitive data is kept secure. Most organisations now encrypt their files in case any are accidentally intercepted or deliberately stolen. Even if someone manages to access these files they would require the encryption key to be able to open the files.

Many programs and apps now encrypt data automatically. For example, when you send a message using WhatsApp, it is encrypted before it is sent and decrypted when it reaches its destination. If someone managed to intercept the message they could not view its contents. This is often cited as a security concern by the police who cannot intercept messages between criminal gangs and terrorists.