Cybersecurity Threats and Best Practices

Unit 3: Cybersecurity

• Cybersecurity involves standards and practices used by organizations to protect applications, data, programs, networks, and systems from cyberattacks and unauthorized access.

Main topics

• Common cybersecurity threats
• Best practices for online security
• Strategies for safeguarding personal and professional information

Common Cybersecurity Threats

• Malware: Harmful software like spyware, viruses, ransomware, and worms used by cyberattackers to access system data.
• Social engineering: Exploitation of human interactions to gain unauthorized access to information and systems.
• Phishing: Tricking users to divulge sensitive data, often through malicious links.
• Ransomware attacks: Encrypting a victim's data and demanding payment for decryption keys.
• Distributed denial of service (DDoS) attacks: Overloading systems with internet traffic to disrupt services.
• Spam, scam
• Phishing intends to deceive the victim by using malicious email attachments, fake URLs, or malicious websites pretending to be legitimate, to induce the victim to provide desired information to the attacker.

Phishing Variants

• Spear phishing targets individuals with tailored convincing messages, impersonating colleagues or trusted sources, e.g., posing as tech support for VPN complications.
• Vishing involves phone calls to extract sensitive data by impersonating legitimate entities like banks, alerting victims about suspicious transactions to coax personal account verification, leading to financial theft.
• Smishing is the use of text messages disguised as urgent requests to trick people into clicking malicious links compromising personal data.
• Baiting involves enticing victims with goods or information, such as distributing USB drives with malware hidden within purportedly important work-related data.
• Pretexting involves attackers using false pretenses to obtain personal information, e.g., posing as surveyors to exploit trust and gain confidential data for business or security audits.

Injection Attacks

• Injection attacks occur across platforms, especially web applications an attacker sends untrusted data to an interpreter, which executes unintended commands or accesses data without authorization.
• SQL injection is the insertion of malicious SQL statements into input fields to manipulate a database, potentially disclosing, modifying, or deleting data.
• Code injection involves injecting malicious code into a vulnerable application, which is then executed by a server.
• OS command injection happens when an attacker inputs shell commands into a command-line interface to perform functions on a system, often gaining control of the operating system.
• Man-in-the-middle (MitM) attacks intercept communications between two parties to steal or manipulate information.
• Supply chain attacks compromise software or hardware before they reach the consumer.

Additional Threats

• Insider threats: Arise from within an organization, either accidental or malicious, bypassing traditional security.
• Advanced persistent threats (APTs): Complex, stealthy attacks targeting specific data or disruption, and they are undetected for long periods.
• Viruses and worms are malware that can spread uncontrollably, damaging core system functions and data, with worms self-replicating and exploiting vulnerabilities in the network.
• Cryptojacking is a stealthy threat that hijacks computer resources to mine cryptocurrency.
• Internet of Things attacks: IoT devices' lack of security makes them vulnerable, utilizing insecure firmware, weak authentication, and unsecured network services.
• Nation-state cyber activities target espionage, sabotage, or influencing global political landscapes.
• Insider threats arise from individuals abusing their access to systems and data within an organization, whether maliciously or through negligence.

Characteristics of APTs

• Highly targeted: Attackers focus on specific entities, tailoring their tactics based on the target’s vulnerabilities and value.
• Long-term engagement: APTs seek sustained access to a network, potentially lasting years, to continually steal data or await the opportune moment to act.
• The use of advanced malware: This includes complex malware and spear-phishing attacks to establish initial access and ensure continued presence within the target's infrastructure.
• Evasion techniques: Sophisticated methods like encryption, kill switches, and zero-day exploits are employed to avoid detection.
• Lateral movement: APTs moves through the compromised digital infrastructure to establish footholds in different parts of an organization.

Best Practices for Online Security

• Use a secure internet connection.
• Choose strong passwords.
• Enable multi-factor authentication.
• Keep software and operating systems updated.
• Check that websites look reliable.
• Review privacy settings and understand privacy policies.
• Be careful of suspicious links and where you click.
• Make sure your devices are secure.
• Backup data regularly and close unused accounts.
• Be careful what you download and post, and be careful who you meet online.
• Use a good antivirus and keep it updated.
• Double-check online information.

Strategies for Safeguarding Information

• Behavioral analytics: Use user and entity behavior analytics (UEBA) to detect anomalous behavior patterns indicating malicious activity or policy violations.
• Access controls: Apply the principle of least privilege and regularly review access permissions to ensure that employees only have access to the resources necessary for their job functions.
• Regular audits and training: Conduct comprehensive security audits and provide ongoing security awareness training.
• For nation-state threats: Strengthen national cybersecurity policies, enhance international cooperation and develop counter-cyber espionage strategies.