Cybersecurity Policies and Regulations Quiz

Cybersecurity (CYB 201)

• Cybersecurity is about protecting digital assets (systems, data, and networks) from unauthorized access, breaches, and failures.
• Key concepts include: Cyber, Security, Confidentiality, Integrity, and Availability.
• Cyber: Refers to the digital or networked environment.
• Security: Protecting data and systems from unauthorized access or disruption.
• Confidentiality: Access restricted to authorized individuals only.
  • Techniques include encryption (converting data into secure format, readable only by some with decryption key) and access control (restricting based on user roles and permissions).
• Integrity: Ensures data is accurate, complete, and unaltered.
  • Techniques include hashing (unique digital fingerprints, changing if data modified), checksums, and digital signatures (using algorithms and cryptographic keys).
• Availability: Ensuring systems, data, and services are readily available to authorized users.
  • Methods include redundant systems (backup servers and data replication) for system failures.
• Authentication: Verifying a user, device, or system's identity before granting access.
  • Methods include passwords, PINs, multi-factor authentication (MFA), and biometrics (fingerprints, facial recognition).
• Access Control: Regulating user access to resources based on roles, permissions, and policies.
  • Types include Role-Based Access Control (RBAC), Mandatory Access Control (MAC), and Discretionary Access Control (DAC).
• Non-repudiation: Ensures actions cannot be denied later.
  • Techniques include digital signatures.
• Fault-tolerant methodologies: Designing systems to continue operating even with component failures.
  • Methods include redundancy, failover systems, load balancing, backups, and DDoS protection.
• Network Resilience: Maintaining service during high traffic or attacks.
• Data Replication: Synchronizing data across multiple locations.
• Failover Systems: Automatically switching operations to a backup system when the primary fails.
• Load Balancing: Distributing network/application traffic across multiple servers.
• Backups: Regularly storing copies of data in a secure, separate location.
• DDoS Protection: Protecting against distributed denial-of-service (DDoS) attacks that overload systems.
• Network Segmentation: Isolating network segments to limit the impact of breaches.

Fault-Tolerant Methodologies in Cybersecurity

• Fault tolerance: Designing systems to continue functioning even in component failure.
• Redundancy: Duplicate critical system components (servers, databases, etc.).
• Failover systems: Automatic switching to backup systems.
• Load balancing: Distributing traffic across multiple servers.
• Backups: Ensuring data recovery if the primary system fails.
• DDoS protection: Protecting against distributed denial-of-service attacks.
• Network segmentation: Isolating segments to limit malicious network impacts.

Security Policies and Best Practices

• Security policies: Formal documents defining an organization's security approach.
• Acceptable Use Policy (AUP): Defines acceptable employee activities on company devices and networks.
• Data Protection Policy: Specifies how sensitive data should be handled, stored, and moved.
• Incident Response Policy: Outlines steps to handle security incidents.

Testing Security and Incident Response

• Vulnerability Scanning: Automated tools scan systems for known vulnerabilities.
• Penetration Testing (Pen Testing): Ethical hackers simulate attacks to find and highlight weaknesses.
• Red Team Exercises: Specialized teams conduct complex simulated attacks to test defences.
• Security Audits: Comprehensive reviews of security practices, policies, and infrastructure.
• Incident Response (IR): Plan to detect, analyse and respond to security incidents.
  • Stages: Preparation, Identification, Containment, Eradication, Recovery, and Post-incident Review.

Risk Management and Disaster Recovery

• Risk Management: Identifying, assessing, and mitigating risks to an organisation's assets.
  • Stages: Risk Assessment, Risk Mitigation, Risk Acceptance, Risk Transfer.
• Disaster Recovery (DR): Restoring operations after a critical incident (cyberattack, natural disaster, or outage).
  • DR components include backups, failover systems, business continuity planning (BCP), and DR drills.

Access Control

• Access Control: Regulates user access based on roles, permissions, and policies.
• Role-Based Access Control (RBAC): Granting access based on user roles, within an organisation.
• Mandatory Access Control (MAC): Centralized policies restrict access based on data classifications.
• Discretionary Access Control (DAC): Allows resource owners to set permissions for their resources.

Basic Cryptography

• Cryptography: Securing data to make it unreadable to unauthorized access.
• Key cryptographic concepts include: Encryption (converting data into secure format), Symmetric Encryption(using single key for encryption and decryption), Asymmetric Encryption(using public and private key), Hashing (creating a fixed-length fingerprint for data integrity), and Digital Signatures (using asymmetric cryptography for data integrity and authentication).

Software Application Vulnerabilities

• SQL Injection: Attackers inject malicious SQL code into vulnerable input fields.

• Cross-Site Scripting (XSS): Malicious scripts injected into webpages,viewed by other users.

• Buffer Overflow: Writing more data to a buffer than its capacity.

• Insecure Deserialization: Untrusted data deserialized into objects.

• Broken Authentication: Improper authentication mechanism.

• Sensitive Data Exposure: Disclosure of sensitive data in applications.

• Missing Function Level Access Control: Vulnerable access based on user input roles accessing unauthorised data

• Command Injection: Attacker inputs malicious commands from user input into an application.

• Path Traversal: Allows attackers to access files outside intended directories.

• Race Conditions: Unpredictable behaviour from concurrent actions.

• Insufficient Logging & Monitoring: Deficient logging & monitoring for security incident detection.

Evolution of Cyber-Attacks

• Early attacks (1980s-1990s): simple viruses and worms.
• Organised crime and financial motives (2000s): attacks for financial gain
• Advanced Persistent Threats (APTs) and Nation-State attacks (2010s): complex, targeted, long-term operations for espionage
• Targeted ransomware and supply chain attacks (2020s): sophisticated, large-scale attacks on critical infrastructure and supply chains.