Finding Weaknesses and Improving System Security
Analysing System Data and Behaviours
Organisations collect data about how their systems are used and then look for patterns that suggest a risk — something that could lead to unauthorised access, or to data being lost, stolen or changed. Analysing that data turns a pile of records into evidence you can act on. Each source reveals a different kind of behaviour.
| Method | What it records | Risk it can reveal |
|---|---|---|
| Access logs | Who logged in, when, from where, and which files they opened | An account logging in at 3am when that user only ever works daytime hours |
| Browsing history and network traffic | Sites visited, files downloaded and uploaded, and how much data is moving | A large upload to an unfamiliar site — data leaving the organisation |
| Content or word filters | Pages and search terms users tried to reach, including blocked ones | A user repeatedly searching for ways to break into accounts |
| Monitoring software or screen sharing | What is on a user's screen, live, as they work | Customer records being pasted into a personal email |
| Scanning storage areas | Files saved on drives and shared folders | An unauthorised copy of a database sitting where it should not be |
| CCTV or direct observation | What people are doing physically in the building | A password stuck to a monitor that any visitor could read |
Spotting patterns, not one-offs
A single odd record usually means nothing. Analysis is about patterns: an account failing to log in twenty times in a minute, or one department downloading far more than everyone else. Those patterns point to a possible attack or to someone breaking the rules.
What the analysis is for
The results show whether security policies are actually being followed and where improvements are needed. If logs show that half the staff in one office share a single login, the policy on personal accounts is not working, so training or tighter account rules are needed.
Blocking websites restricts what users can reach, but it is not a method of monitoring. Nothing is recorded and nothing is reviewed, so you learn nothing about what people are actually doing.
Practise this
Pearson BTEC Digital Information Technology · Finding weaknesses and improving system security