Chapter 8 Cybersecurity Concepts and Vulnerabilities Quiz

Information Systems: Theory & Practice - TU8: Securing Information Systems

• Course instructor: Prof. Dr. Paul Drews
• Course title: Securing Information Systems
• This is a course about information systems security theory and practice.

Chapter 8 – Intro Case Study

• Business Challenges: Increasing cyber attacks, phishing attacks, and internal security threats.
• Management: Inform public, train employees, develop cyber-aware business processes, proactively manage data breaches, and maintain a database of previous breaches.
• Organization: Build web and social media pages to warn customers; security guarantees to customers.
• Technology: Implement a cyber defense system.
• Business Solutions: Reduce cyber attacks, implement public and employee awareness programs, and reduce internal breaches.

Learning Objectives

• Explain why information systems are vulnerable to destruction, error, and abuse.
• Describe the business value of security and control.
• Describe the components of an organizational framework for security and control.
• Describe the most important tools and technologies for safeguarding information resources.

Some Recent Cases

• University of Gießen Security Incident (December 2019): The university's systems were offline for several weeks due to a hacker attack.
• District of Vorpommern-Rügen (2023) and others: Various government entities experienced significant disruptions, and ongoing issues due to cyber attacks.
• Equifax Data Breach (2017): A major data breach affected millions of US citizens.
• Bundestag (German parliament) offline due to hacker attack (2015): The German parliament experienced a significant disruption due to a hacker attack, prompting improvements to the IT security structure.
• 1.3 Million Vodafone routers insecure (2015): Vulnerabilities in Vodafone routers enabled unauthorized access.
• Backdoors in network switches (2015) Critical vulnerabilities present in Juniper's network switches were found.
• Belgium network provider — hacked by British intelligence agency (2014): A major data privacy breach occurred, likely involving the GCHQ.

System Vulnerability and Abuse

• Why systems are vulnerable: Accessibility of networks, hardware problems, software problems, disasters, use of networks/computers outside of the firm's control, and loss of portable devices.
• Internet vulnerabilities: Network open to anyone, size of the internet, use of fixed internet addresses with cable/DSL modems, unencrypted VOIP, e-mail, P2P, IM, interception, and malicious software attachments.
• Wireless security challenges: Radio frequency bands are easy to scan, and SSIDs (service set identifiers) can be identified by sniffer programs.
• Malware (malicious software): Viruses, worms, downloads and drive by downloads, E-mail, IM attachments, mobile device and social network malware, key loggers, reset browser home page, redirect search requests, slow computer performance.
• Spoofing: Misrepresenting oneself through the use of fake email addresses or masquerading as someone else.
• Sniffing: Eavesdropping programmes on networks to gather information for hackers.
• Denial-of-service attacks (DoS) and Distributed denial-of-service attacks (DDoS): Flooding servers with thousands of false requests to crash the network. Using numerous computers to launch a DoS attack is a DDoS attack.
• Hackers and computer crime: System intrusion; system damage; cybervandalism; intentional disruption, defacement, destruction.
• Identity theft: Theft of personal information.
• Phishing: Setting up fake websites or sending fake emails to receive sensitive data.
• Evil twins: Wireless networks that pretend to be legitimate Wi-Fi connections.
• Pharming: Redirects users to fake websites.
• Click fraud: Fraudulent clicks on online ads.
• Cyberterrorism and Cyberwarfare:
• Internal Threats: Employee security threats, inside knowledge, sloppy security procedures, and social engineering (tricking employees into revealing passwords)

Organizational Frameworks for Security and Control

• Information systems controls: Manual and automated controls, general, and application controls.
• General controls: Governing design, security, and use of computer programs; security of data files; throughout the organizations' IT infrastructure. Using a combination of hardware, software, and manual procedures.
• Types of general controls: Software controls, hardware controls, computer operations controls, data security controls, implementation controls, administrative controls.
• Application controls: specific controls unique to computerized applications, also including both automated and manual procedures. Ensuring only authorized data are completely and accurately processed.
• Risk assessment: Determines level of risk to a firm, types of threats, probability of occurrence, potential losses, and annual loss.
• Security policy: Ranks information risks, identifies security goals, and mechanisms to achieve these goals and drives other policies.
• Acceptable use policy (AUP): Defines acceptable uses of firm's information resources and computing equipment.
• Authorization policies: Determine differing levels of user access to information assets.
• Identity management: Business processes and tools to identify valid users of systems, control access, identifiers, and authenticating users.
• Disaster recovery planning and Business continuity planning: Plans and procedures to restore business operation after disasters. Determining which systems most need to be restored first.

Tools and Technologies for Safeguarding Information Resources

• Identity management software: Automates tracking of users and privileges, authenticates users, and controls access.
• Authentication: Password systems, tokens, smart cards, biometric authentication, and two-factor authentication.
• Firewall: Combination of hardware and software to prevent unauthorized access to private networks. Technologies include static packet filtering, stateful inspection, network address translation (NAT), and application proxy filtering.
• Intrusion detection system: Monitors and detects intruders.
• Antivirus and antispyware software: Checks for malware and often eliminates it.
• Unified threat management (UTM) systems: Eliminates malware and other threats.
• Securing wireless networks: WEP security, Wi-Fi Alliance finalized WPA2 specification.
• Encryption: Using cipher text to protect data from unwanted eyes. Two-methods include Secure Sockets Layer (SSL) and Secure Hypertext Transfer Protocol (S-HTTP).
• Symmetric key encryption: Sender and receiver use single, shared key
• Public key encryption: Two mathematically related keys (public and private). Uses recipient's public key for encrypting messages, and private key for decrypting them.
• Digital certificates: Used to establish the identity of users and electronic assets.
• Public key infrastructure (PKI): Uses public key cryptography to work with certificate authority and is widely used in e-commerce.
• Ensuring System Availability: Important in online transaction processing. Fault-tolerant computer systems contain redundant hardware, software, and power supply components for uninterrupted service.
• Controlling network traffic: Deep packet inspection that sorts low-priority material and blocks video/music downloads.
• Security Outsourcing: Service providers to manage security efforts
• Security in the cloud: Company owning data is responsible for security. Firms must ensure providers provide adequate protection.
• Securing mobile platforms: Security policies should include special requirements for mobile devices and guidelines for use. Mobile device management tools include inventory records, controls for updates, methods to lock down/erase lost devices, and encryption.
• Ensuring software quality: Software metrics (quantitative measurements), walkthroughs (reviewing documents by qualified people), and debugging (elimination of errors).

Tasks for this Week

• Actively read chapter 8, including case studies (3-4 hours).
• Discuss the statement: "IT security isn't simply a technology issue, it's a business issue" (15 minutes).

Contact

• Professor Dr. Paul Drews
• Institute of Information Systems
• University of Lüneburg

Test your knowledge on essential cybersecurity concepts, focusing on software vulnerabilities, data control, and the importance of computer forensics. This quiz will cover various aspects of cybersecurity, including hacker activities, sensitive data protection, and patch management.