Cybersecuritate e Protection de Information

• Learning objectives include defining privacy and security, cybersecurity infrastructure, types of attacks, types of malware, how to secure a computer, and safe computing practices.

Key Definitions

• Computer: Any electronic processing device with logical, arithmetic, and memory functions, connected to a computer network.

• Cybersecurity: Protecting information, equipment, and computer resources from unauthorized access, use, disclosure, disruption, modification, or destruction.

• Data: Representation of information, knowledge, facts, concepts, or instructions processed in a computer system or network, and stored in various forms.

• Electronic Form: Data generated, received, sent, or stored in media such as magnetic, optical, or computer memory.

• Electronic Record: Data, record, image, or sound stored, received, or sent in an electronic form.

• Digital Signature: Authentication of an electronic record using an asymmetric crypto system and a hash function.

• Electronic Signature: Authentication of an electronic record using an electronic technique as specified.

• Intermediary: Any person who receives, stores, or transmits records on behalf of another person, or provides services related to that record.

Data Privacy

• Information privacy, also known as data privacy, involves the relationship between the collection/dissemination of data, technology, public expectations of privacy, and legal/political issues.

• Information privacy is the right to control what personal information is released.

Cyber Security

• Cybersecurity, as defined by the "Cyber Security Information Act", concerns the vulnerability and resilience of computing systems, software, and critical infrastructure against intentional interference, compromise, or incapacitation through misuse or unauthorized means, which violates laws and harms interstate commerce or public safety.

Cyber Security in Different Contexts

• Corporate cybersecurity focuses on the availability, integrity, and secrecy of information systems and networks to protect a corporation's operations and assets from attacks, accidents, and failures.

• National cybersecurity focuses on the availability, integrity, and secrecy of a nation's information systems to protect its operations and assets.

• Cybersecurity broadly defined is maintaining the availability, integrity, and secrecy of information systems and networks against attacks, accidents, and failures to protect operations and assets.

• Cyber Security's goal is to protect our information and information systems

• Cyber Security protects information systems against unauthorized access or modification of information, whether in storage, processing or transit

Privacy and Security of Information

• Confidentiality: Safeguards information from unauthorized access through clearance, access levels, and need-to-know.
• Integrity: Protects information from unauthorized modification or destruction.
• Availability: Ensures information services are accessible when needed.
• Authentication: Verifies the validity of transmissions, messages, originators, as well as individual authorization.
• Non-repudiation: Provides proof of delivery and sender identity, preventing sender/recipient from denying data processing.

Sensitive Data

• Sensitive data is information that, if compromised, could seriously harm organizational operations, assets, or individuals.
• Examples of sensitive information include personnel, financial, payroll, medical, and Privacy Act information.

Threats and Vulnerabilities

• Threats are circumstances or events that can potentially harm an information system by destroying it, disclosing information, modifying data, or making the system unavailable.
• Vulnerabilities are weaknesses in an information system or its components that can be exploited (e.g. Windows XP systems).

Cyber Security Infrastructure

• According to the "Cybersecurity Research and Education Act of 2002", cybersecurity infrastructure includes equipment integral to research and education capabilities in cybersecurity

• Encryption Devices

• Network Switches

• Routers

• Firewalls

• Wireless Networking Gear

• Protocol Analyzers

• File Servers

• Workstations

• Biometric tools

• Computers

• Cybersecurity infrastructure also includes technology support staff integral to research and education.

Technical Aspects – Evidentiary Objects

• Storage (files) is a technical aspect that can contain evidentiary objects.
• Hard disk (raw data) can contain evidentiary objects
• Flash cards can contain evidentiary objects.
• Volatile memory (RAM) can contain evidentiary objects such as running processes, DLLs, Malware, User names and passwords
• Registry keys may contain evidentiary objects
• Deleted files may contain evidentiary objects
• Cookies may contain evidentiary objects
• Browser caches/history may contain evidentiary objects.
• Network connections history may contain evidentiary objects
• Network Logs are possible evidentiary objects

Network-Based Attacks

• Network-based attacks have better accessibility due to the network.
• Targets include websites, email servers, file servers, DNS servers, and routers.

Network Attacks

• DOS/DDoS are coordinated attacks from one or multiple sources.
• SYN flooding is a DOS attack, http://www.cert.org/advisories/CA-1996-21.html.
• Proliferation of DSL connections has aided SYN flooding attacks.
• DNS and BIND can be subject to redirection attacks to unintended sites.
• Vulnerabilities in BIND can allow remote users to gain privileged access.
• Routers can have routing info changed to disable networks.
• Cisco IOS usage makes routers a backbone of the internet.
• Sniffers examine and gather network traffic.
• They can gather usernames and passwords.
• Sniffers can capture electronic mail.
• Firewalls can detect network attacks
• IDS, HoneyPots, SATAN, vulnerability scanners can detect network attacks
• http://www.sans.org/newlook/resources/IDFAQ/ID_FAQ.htm
• Tripwire can detect changes in configurations

Web Attacks

• Phishing involves deceptive email messages and instant messages appearing legitimate.
• Phishing is designed to trick users into providing usernames and passwords.
• Pharming involves redirects to phony websites even when typing the correct URL.
• Pharming attacks hijack a company's domain name

Examples of Web Attacks

• Cracking Session ID numbers is an example of a web attack.
• An example is https://www.tonybank.com/account.asp?sid=12345678. URL session tracking, hidden form elements, and cookies can be vulnerable.
• Cracking SQL databases is a form of web attack.
• This can be done using an incorrect string to get an error message to reveal the query structure.
• http://www.wiretrip.net/rfp/p/doc.asp?id=42

E-Mail Attacks

• Email bombing is one type of attack, repeatedly sending an identical email message to a particular address.
• More info: http://www.cert.org/tech_tips/email_bombing_spamming.html
• Malware attachments can be spread through email
• Worms, viruses, trojan horses, etc.
• Spam is considered an email attack: unsolicited "junk" mail.
• It often happens at sites with mailers that permit relaying. RTF files are ASCII text files and include embedded formatting commands, they do not contain macros and can not be infected with a macro virus. MP3 files consist of compressed audio tracks and are not susceptible to traditional virus infections.

Cybercrime: Social Network Attacks

• Fraud: Schemes that convince you to give money or property to a person.
• Shill bidding is fake bidding to drive up the price of an item

Malware: Spam and Cookies

• Spamming is sending mass unsolicited emails.
• Spam messages are also distributed in fax, IM, and text formats.
• Spams are called "spam"
• Cookies are installed without permission.
• Cookies allows websites to identify you when you return
• Cookies track websites and pages you visit to target ads.
• Cookies may collect information you do not want to share.

Malware Adware and spyware

• Adware uses pop-ups and banner ads. Adware helps generate income Adware uses CPU cycles and internet bandwidth Adware reduces PC performance
• Spyware is malware that covertly harvests personal data. Spyware is usually installed by accident Spyware acts as a browser hijacker

Social Engineering

• Social engineering is a collection of techniques intended to trick people into divulging private information, including calls, emails, websites, text messages, and interviews.

• When faced with social engineering attempts, document the situation, verifying the caller and gathering information and writing down notes of the conversation.

• Contact your CISO.

• Don't participate in surveys.

• Don't Share personal information

• Don't give out computer systems or network information

Mobile Computing

• Always maintain physical control of mobile devices.
• Properly label mobile devices with classification and contact information.
• Disable wireless functionality on mobile devices when not in use.

Example: DOS

• Denial-of-Service attacks are most frequently executed against network connectivity.

• The goal is to prevent hosts or networks from communicating over the network.

• A description of how this can occur is at: http://www.cert.org/advisories/CA-1996-21.html

• An intruder begins the process of connecting to the victim machine in such a way as to PREVENT the completion of the connection.

• Since the victim machine has a limited number of data structures for connections, the result is that legitimate connections are denied while the victim machine is waiting to complete bogus "half-open" connections.

• This type of attack does not depend on the attacker being able to consume your network bandwidth.

• An intruder may also be able to consume all the available bandwidth on your network by generating a large number of packets directed to your network.

Denial of Service Attacks make networks or hosts unusable. Difficult or impossible to locate source. Bottom Line: COSTLY! http://www.cert.org/present/cert-overview-trends/sld001.htm Disrupt services Becoming very popular with attackers

• IRC sites
• Controversial sites or services
• Bottom line: COSTLY!

Intruder Detection Checklist

• Look for Signs That Your System May Have Been Compromised by using the following checks
• Examine log files
• Look for setuid and setgid Files
• Check system binaries
• Check for packet sniffers
• Examine files run by 'cron' and 'at'.
• Check for unauthorized services
• Examine /etc/passwd file
• Check system and network configuration
• Look everywhere for unusual or hidden files
• Examine all machines on the local network
• http://www.cert.org/techtips/intruder_detection_checklist.html

Malware: Viruses, Worms, Trojans, and Rootkits

• Virus - a program that replicates itself and infects computers.
• Needs a host file May use an email program to infect other computers
• Worm - A conficker worm was first released in 2008, reemerged in 2010 with new behaviors. Self-replicating Do not need a host to travel Travels over networks to infect other machines
• Logic Bomb Behaves like a virus Performs malicious act Does not replicate Attacks when certain conditions are met Time Bomb A logic bomb with a trigger that is a specific time or date
• First released in 2008
• Reemerged in 2010 with new behaviors
• Botnet Computer zombies/ bots controlled by a master
• Trojan horse Fake notifications security Denial-of-service attacks

Ransomware

• malware that prevents you from using your computer until you pay a fine or fee.
• Bitcoin is an anonymous, digital, encrypted currency
• Rootkit -Set of programs -Allows someone to gain control over system -Hides the fact that the computer has been compromised - masks behavior of other malware
• Nearly impossible to detect

How to Secure a Computer

• Shields up software
• A visited website installs a program in the background without your knowledge-drive by download -Hardware device that blocks access to your network
• Software that blocks access Antivirus program
• Protects against viruses, Trojans, worms, spyware
• Windows 10 includes Windows Defender Security Suites are combinations of features for security software
• Windows 10 includes Windows Defender

Shields Up - Hardware

• Connects two networks- Router Wireless encryption
• Adds security by encrypting transmitted data

Shields Up -Operating Systems

• Most important piece of security software and keep up to date

Practice Safe Computing

• Malware tricks users into clicking false Windows notifications
• User Account Control (UAC) notifies you prior to changes made to your computer
• Guest
• Three user account types

Do not turn UAC off. Read Messages before clicking yes.

Secure Password practices

• Do's

• Use a combination of lower and upper case letters, numbers, and, special characters.

• Change it every 90 days

• Create a complex, strong password, and protect its secrecy

• Don'ts

• Use personal information

• Use Dictionary words(including foreign languages)

• Do not write it down

• Do not share it with anyone

• Converts plain text into ciphertext and encrypts

An ounce of prevention - safe installation of software requires copies of files to the computer which alters settings

• Download problems

• Only download from reliable sources

• A zero-day exploit is an attack that occurs on the day an exploit is discovered

• Before the publisher can fix it there are bugs- flaws in software

• Acceptable Use policies are important in businesses and schools. Rules are important to protect

• Avoid discussing social media and monitor privacy

Laws Related to Computer Security and Privacy

• Internet Complaint Center (IC3) is a place for victims to report cybercrimes

• Reports processed and forwarded to appropriate agency

• computer Fraud and Abuse Act makes it a crime to access classified information

• computer Fraud and Abuse Act Passed act in 1986. Amendments between 1988 and 2002 added additional cybercrimes

• Cyber crime 43 covers un authorized access or introducing a conputer virus, causing disruptions. sec 66 punishment for identitiy theft

• Secure the departments by utilizing the mentioned best practices. PII should not be stored on unencrypted devices.