Computing Security: Concepts and Tools

Overview

• This course covers computing security branches, cybersecurity concepts, challenges, and tools for problem-solving.
• Topics include network security, threat landscape, authentication, malware, cryptography, risk and incident management, cybercrime, and cybercriminal behavior.

Branches of Computing Security

• Network security involves security controls, policies, and practices to prevent unauthorized access and misuse.
• Security architects design system security, maintain documentation, and recommend security controls.
• Endpoint security protects devices like workstations and servers from cyberattacks.
• Security engineers design, develop, and maintain secure systems and networks, ensuring protection from attacks.
• Penetration testing simulates authorized cyberattacks to evaluate system security and is distinct from vulnerability assessments.
• Security Operations Centers (SOC) monitor, detect, analyze, and respond to cyber threats to protect organizational assets.

Cyber Security Concepts

• The CIA triad: confidentiality, integrity, and availability as key cybersecurity tenets.
• Confidentiality: Protecting data from unauthorized viewing or use to maintain security and customer trust.
• Integrity: Maintaining accurate and complete information by preventing unauthorized alterations.
• Availability: Ensuring data accessibility to authorized viewers for necessary actions.
• Cyberattacks: Understanding and defending against various attacks is crucial for cybersecurity professionals.
• Malware: disrupt systems, bypass authorization, leak data, requiring anti-malware programs and user education.
• Phishing: aims to steal login data using spam or false info, countered by two-factor authentication.
• Social Media: poses security threats via malicious friend requests or downloads.
• Advanced Persistent Threats (APT): relies on phishing or social engineering makes them hard to defend against.
• Software Patches: patching software vulnerabilities reduces chances of cyberattacks.
• Identity Access Management (IAM): is a framework to manage online user identities and access levels for system functions.
• Incident Response (IR): involves protocols for addressing intrusions for personnel and system reaction.
• Security Information and Event Management (SIEM): centralizes security log data for systematic analysis.
• Managed Security Service Provider (MSSP): monitors and maintains security for a monthly fee like endpoint detection software and firewalls.
• Security Operations Center (SOC): manages security with cybersecurity staff.
• Cloud Access Security Brokers (CASB): Policy plans like encryption and authentication ensure cloud service user's trust.
• User and Entity Behavior Analytics (UEBA): identifies unusual user behavior to reduce log session noise.
• Indicators of Compromise (IOC): unfamiliar activity exposes network intrusions during log analysis.
• Distributed Denial of Service (DDoS): disrupting services by overwhelming a site or using multiple IP addresses.

Cyber Security Tools

• Wireshark is a free, open-source packet analyzer for network troubleshooting and protocol development.
• Metasploit identifies system weaknesses.

Basics of Network Security

• Securing a network involves firewalls and intrusion detection/prevention systems (IDS/IPS).
• A layered defense strategy creates multiple defensive roadblocks to thwart potential hackers.

Threat Landscape, Authentication, Malware

• The cyber threat landscape includes risks, vulnerabilities, and actors in the digital world.
• Cyber threat Landscape threat actors
• Hacktivists are motivated by political or ideological reasons.
• Cybercriminals : seek financial gain.
• State-Sponsored Actors: conduct cyberattacks to gather intelligence.
• Insiders: cause intentional or unintentional harm.
• Threats: attacks/vulnerabilities include malware, ransomware, phishing, social engineering, and DDoS attacks.
• Vulnerabilities: are system weaknesses exploited by attackers.
• Attack Vectors are methods that attackers use to exploit vulnerabilities.
• The cyber threat landscape is constantly evolving with new techniques and actors.
• Threat Landscape Proactive Security
• Understanding vulnerabilities is vital for organizations to protect themselves.
• Allocating resources involves allocating resources to address risks.
• Knowledge of threat landscape gives the ability to respond to cyber incidents.
• Keeping up to date is vital for maintaining a cyber security
• Cryptography

Cryptography

• The art of securing information, ensuring confidentiality, integrity, nonrepudiation, and authentication.
• Focus include confidentiality, integrity, authentication, nonrepudiation and key distribution.
• Confidentiality: Encryption keeps data secret and away from prying eyes.
• Integrity is where can see changes
• Authentication in electronic messaging validates message origin from a known, trusted entity.
• Nonrepudiation: Provide source identification
• Key Distribution
• Symmetric Cryptography: encryption of one key both encrypt and decrypt.
• Symmetric Encryption: Preserving confidentiality increased speed over non-symmetric systems and maintaining simplicity
• Data Encryption Standard (DES) algorithm is still in use today.
• Triple DES (3DES): DES algorithm extend three times more powerful.
• Blowfish: fast, is made to be simple
• RC2 : allows algorithm keys between 1 and 2,048 bits
• RC4 is notable for its inclusion in the Wired Equivalent Protection (WEP) protocol used in early
• Wireless network
• RC 5 users can allow key lenght
• RC6 : Key lenght is 128_256 bits
• Rijndael / AES is very fast, is compact and can use Keys that are 128_192_256 bits long
• Two fish key lenghts of 128_256 bits.

Asymmetric (Public Key) Cryptography:

• Relatively new, from 1970's, offering key distribution benefits from a key pair: public and private
• Public key encrypts, only the private key decrypts, ensuring security.
• PKI System
• Uses public information
• Secure in trusted manner
• Hash algorithm created in digital representation form
• CA creates certificates and has control with public keys that the CA is resposible for
• CA need information that gives proves identity. Like name / Licence

Risk Management

• Is the bad that can impact that achieve objectives
• The risk for types are strategic / compliance/ financial / operational
• The framework is a template to identify risk.
• Risk identification
• Risk assesment
• Risk mitigation
• Risk reporting + monitoring is important to report level risk remain optimal levell.
• Risk governance ensures employee act with governance

Current Trends in CyberSecurity

• Remote Workers
• Poses cyber-security risks.
• Wolf-in-sheep clothing attacks increase in sophistication
• IoT Vulnerability
• Provide security threats to users / exposing them to cyber attacks
• Machine Learning
• Improves paterns 89
• Increased focus mobile cybersecurity
• Device becomes appealing avenue of opportunity for cybercriminals
• Multi factor authentication
• MFA adds another layer of security - 2 login
• Artificial intelligence
• Cyberespionage
• Is form of gathering intelligence to a target

Malware Prevention:

• Sophisticated, malicious software desighned by professionals.

Distributed Denial-of-service

• Can desrupt reular traffic

Ransomware Protection

• Restricts acess to computer / encrypts attacks and demands a

Ransom

• Cloud Storages Security important to protect data from cyber attack
• Fire wall a service fwaas protects
• XDR Detect
• Sasse
• SCRM

Investigation Methods and Techniques

• Complex / intimidating / hard for understanding
• Types used are computer science and law to find evidence
• Cyber crime occurs by identity /analyzing and migrating computer by crime attacks
• Investigation
• Gather evidence in order to bring criminals to justice
• Broad category / wide range
• Phishing / scams is a big problem to try scam people
• Types of cyber criminals hackers / individuals access computers networks to steal
• Insider
• Types are social media / digital crimes with tools like IDA Pro

Economies of Cybercrime

• Third-largest economy WEF.
• Cybercrime 8 trillion / revenue revenue stolen money and productivity damages

Incident management

• Aims to keep from affecting operations
• Needs a response team with people that solve it and document