Cybersecurity Essentials - Module 1

Cybersecurity Essentials - Module 1

• The CIA Triad comprises Confidentiality, Integrity, and Availability
• Confidentiality: Data protection from unauthorized access
• Integrity: Data protection from unauthorized changes, ensuring accuracy, completeness, and consistency
• Availability: Authorized data access whenever needed

CIA Triad Concerns

• Data exposure beyond intended audience leads to risks like identity theft, compromised accounts, legal issues, and reputational damage
• Data breaches affect both companies and consumers financially
• Security plans prevent unauthorized access and data changes

Data Integrity

• Data is a valuable asset for companies
• Data integrity guarantees accurate, complete, and consistent data across storage, processing, and transmission

Data Integrity Types

• Physical Data Integrity: Actions/fail-safes that protect the physical systems storing and processing data
• Logical Data Integrity: Digital checks/protocols safeguarding data from human errors/hackers

Unauthorized Information Alteration

• Alteration threats include financial records, vote totals, health records, and news stories
• To maintain data integrity, security tools like file integrity monitoring (FIM) and Relational Database Management Systems (RDBMS) can prevent unauthorized users/data changes

Data Availability

• Data availability assures authorized users' immediate, reliable access
• Non-malicious threats include hardware failures, unscheduled software downtime, and network issues
• Malicious attacks, like denial-of-service (DoS) attacks, aim to harm organizations

Regulatory Standards

• Cybersecurity Regulations include: HIPAA (protects health information), GDPR (regulates digital privacy), contracts, and local laws
• Non-compliance can lead to fines/penalties
• Regulations ensure data safety, security, accuracy, and privacy

Data and Information Assets

• An information asset is information or data of value
• Assets can exist physically or electronically (e.g., patient records, customer information, intellectual property)

Creating Information from Data

• Data analytics transforms raw data into meaningful information
• Data is raw values/facts collected via automated systems (e.g., page visits, link clicks, monthly sales)
• Information summarizes raw data, highlighting changes (e.g., positive/negative results post-change)
• Insights derive from information analysis, guiding business decisions

Intellectual Property (IP)

• IP refers to creations of the mind (not tangible)
• Protected by copyright, trademark, and patent laws
• Examples of IP include industrial designs, trade secrets, and research discoveries
• Non-disclosure agreements (NDAs) safeguard sensitive information

Digital Products

• Digital products are intangible company assets (e.g., software, online music, online courses, e-books)
• Digital Rights Management (DRM) code safeguards from copying/pirating
• Digital Millennium Copyright Act (DMCA) prohibits circumventing copy protections

Data-Driven Business Decisions

• Data-driven decisions help companies react to real-world events
• Data capture gathers data from multiple sources, securely stored in databases or data warehouses (e.g., server logs, IoT sensors, surveys)
• Data correlation identifies connections between data points
• Meaningful reporting presents analyzed information for better understanding and interpretation

Confidential Information

• Confidential information must remain secret
• Trained employees understand and handle confidential information properly
• Confidentiality types include PII (identifiable information), company confidential information, customer confidential information, and PHI (protected health information)

Security Threats

• Hardware threats: Physical damage, tampering, theft
• Data threats: Unpatched systems, misconfigured firewalls, weak security, accidental leaks, data dumps, dumpster diving, insider threats, and data breaches
• Software threats: Theft, exploits, malware (viruses, spyware, adware, ransomware, polymorphic viruses)

Snooping Attacks

• Hackers use snooping to intercept data between devices
• Snooping attack types include eavesdropping, man-in-the-middle (MITM) attacks, and replay attacks
• Eavesdropping/packet sniffing intercepts unencrypted network communication
• MITM attacks involve a malicious intermediary between a victim and target
• Replay attacks intercept & retransmit data

Cross-Site Scripting (XSS) and SQL Injection (SQLi)

• XSS: Attackers embed malicious code on trusted websites; this activates when users visit the website.
• SQLi: Attackers use malicious code to bypass website security protections.
• Prevention methods for XSS include input validation, data sanitization, and cookie rules
• Prevention for SQLi involves parameterized queries, stored procedures, and user input escaping.

Botnets and Denial-of-Service (DoS) Attacks

• Botnets are networks of compromised computer systems used for malicious activities
• DoS attacks flood networks with overwhelming traffic, causing them to crash
• DDoS attacks utilize botnets for amplified DoS traffic

Impersonation and Social Engineering

• Impersonation: Pretending to be someone else
• Social engineering: Using psychological manipulation to gain trust and steal sensitive information
• Types of social engineering attacks include shoulder surfing, baiting, pretexting, phishing, and impersonation attacks

Identity Fraud

• Identity theft: Stealing personal, private ,or financial information
• Identity fraud: Using stolen identities to commit fraud

This quiz covers the fundamental concepts of Cybersecurity Essentials, particularly focusing on the CIA Triad: Confidentiality, Integrity, and Availability. It explores the significance of data protection and the impact of data breaches, alongside the types of data integrity. Test your understanding of these core principles crucial to cybersecurity.