Cybersecurity Threats and Principles

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which of the following is an example of a confidentiality threat?

Distributed denial of service attack

Data theft (correct)

Virus

Ransomware

Ransomware primarily affects the integrity of data.

True

What are the two key principles that should be established according to authentication and authorization standards?

Strong authentication and proper access permissions

An attacker might launch a ______ to make a system unavailable to its users.

Distributed denial of service attack Signup and view all the answers

Which of the following is NOT a threat to integrity?

Cyber bullying Signup and view all the answers

Match the security threats with their categories:

Virus = Software threat Ransomware = Availability threat Data theft = Confidentiality threat Distributed denial of service = Availability threat Signup and view all the answers

Security updates should be applied as soon as they become available.

True Signup and view all the answers

What does proper system infrastructure management entail?

Proper configuration and timely security updates Signup and view all the answers

What is the main purpose of operational security?

To help users maintain security Signup and view all the answers

Multi-factor authentication increases the likelihood of an intruder gaining access to the system with stolen credentials.

False Signup and view all the answers

What should be implemented to ensure you keep undamaged copies of program and data files?

Backup policies Signup and view all the answers

SQL poisoning attacks take advantage of situations where user input is used as part of an ______.

SQL command Signup and view all the answers

Match the following types of attacks with their descriptions:

Buffer overflow attacks = Involves exceeding memory allocation limits SQL poisoning attacks = Uses malicious SQL to gain database access User command logging = Tracks user commands for security reviews Auto-logout = Automatically logs users out after inactivity Signup and view all the answers

Which of the following is NOT a strategy for minimizing the effects of an attack?

Ignoring unauthorized access Signup and view all the answers

Injection attacks utilize valid input fields to execute malicious code.

True Signup and view all the answers

What is one common type of injection attack?

SQL poisoning Signup and view all the answers

What is the main goal of user lockout attacks?

Lock users out to deny them access to the service Signup and view all the answers

Brute force attacks typically involve attackers using weak passwords.

True Signup and view all the answers

What is authentication?

The process of ensuring that a user is who they claim to be. Signup and view all the answers

Attackers create different passwords and try to login with each of these in a ________ attack.

brute force Signup and view all the answers

Match the type of attack with its definition:

User lockout attack = Locks users out after failed authentication attempts Brute force attack = Attempts multiple password combinations to gain access Authentication = Process of verifying user identity Denial of service attack = Prevents legitimate users from accessing services Signup and view all the answers

What outcome may occur if accounts are not locked after failed validation attempts?

Brute-force attacks on the system Signup and view all the answers

Authentication is only necessary for software that does not contain user information.

False Signup and view all the answers

What tactic do attackers often use to speed up brute force attacks?

Using lists of common passwords. Signup and view all the answers

What does allocating users to groups in access control manage?

Group-based permissions Signup and view all the answers

Encryption transforms readable data into an unreadable format.

True Signup and view all the answers

What is used by the encryption algorithm to transform data?

a secret key Signup and view all the answers

Modern encryption techniques can make data practically __________ using current technology.

uncrackable Signup and view all the answers

Match the following resources with their corresponding permissions:

Resource A = Read Resource B = Execute Resource C = Create, Delete Resource D = Read, Edit Signup and view all the answers

What potential future technology may necessitate a new approach to encryption on the Internet?

Quantum computing Signup and view all the answers

All encryption methods used today are guaranteed to remain secure indefinitely.

False Signup and view all the answers

What is the reverse process of encryption called?

decryption Signup and view all the answers

What does the public key of the CA include?

Key size and encryption algorithm Signup and view all the answers

The public key can be used to encrypt the digital signature.

False Signup and view all the answers

What does TLS stand for?

Transport Layer Security Signup and view all the answers

The server's public key is included in the digital __________ sent to the client.

certificate Signup and view all the answers

What is the purpose of the RS and RC numbers generated during the TLS process?

They help compute the symmetric key for data encryption. Signup and view all the answers

What is a primary function of a Key Management System (KMS)?

Maintaining encryption keys Signup and view all the answers

To verify the identity of the client, the server encrypts the RS using its public key.

False Signup and view all the answers

Data protection regulations do not require archival data to be encrypted.

False Signup and view all the answers

What is the minimum retention period for tax and company data in the UK?

six years Signup and view all the answers

What needs to be checked regarding the digital certificate sent from the server?

Issuer and validity Signup and view all the answers

Younger people tend to be less inhibited about sharing personal information on ______.

social networks Signup and view all the answers

Data is exchanged using a __________ key computed from RS and RC.

symmetric Signup and view all the answers

Why should encryption keys be changed regularly?

To reduce the risk of security breaches Signup and view all the answers

Match the following components with their roles in TLS:

Public key = Used to decrypt the digital signature Private key = Encrypts the RS Digital certificate = Includes the server's public key Symmetric key = Used to encrypt data during the session Signup and view all the answers

Match the following terms with their correct definitions:

Encryption = The process of converting data into a secure format Key Management System = A system for managing encryption keys Archival Data = Data retained for compliance and reference Privacy = The appropriate use of personal information by third parties Signup and view all the answers

The process ends after the exchange of data using the symmetric key.

True Signup and view all the answers

Cultural and age differences influence individuals' views on privacy.

True Signup and view all the answers

What should be maintained by KMS for decrypting backup data and archives?

multiple, timestamped versions of keys Signup and view all the answers

Study Notes

Introduction to System Analysis and Design

BIS301 is an introductory course to System Analysis and Design
Lecture notes are based, in part, on work by Ian Sommerville

Software Security

Software security is a high priority for developers and users
Failure to prioritize security leads to losses from malicious attacks
Attacks can put product providers out of business
Customer data compromise leads to subscription cancellations
Recovery from attacks requires significant time and effort, better spent on software security

Types of Security Threats

Availability Threats: Attempt to deny access to legitimate users. Example: Distributed Denial of Service (DDoS) attack
Integrity Threats: Attempt to damage the system or its data. Example: Viruses or Ransomware
Confidentiality Threats: Attempt to gain access to private information. Example: Data theft

System Infrastructure Stack

Operational Environment
Application
Frameworks and application libraries
Browsers and messaging
System libraries
Database
Operating system
Software infrastructure
Network

Security Management

Authentication and Authorization: Establish standards and procedures to ensure strong authentication and proper access permissions
System Infrastructure Management: Ensure proper configuration and timely application of security updates to patch vulnerabilities
Attack Monitoring: Regularly check for unauthorized access and put in place resistance strategies to minimize the effects of detected attacks
Backup: Implement policies to keep undamaged copies of program and data files

Operational Security

Focuses on helping users maintain security
User attacks trick users into disclosing credentials or accessing malware-laden websites (e.g., key-logging systems)
Security Procedures/Practices:
- Auto-logout: Addresses the problem of users forgetting to log out of shared computers
- User command logging: Discovers actions taken by users that damage system resources, either deliberately or accidentally.
- Multi-factor authentication: Reduces the chance of intruders gaining access with stolen credentials

Injection Attacks

Malicious users inject malicious code or commands into input fields/database commands, executing these commands.
This may damage the system or leak system data to attackers
Examples include buffer overflow attacks and SQL poisoning attacks

SQL Poisoning Attacks

Attacks exploit input to an SQL command
Malicious users utilize form input fields to insert SQL fragments that affect data access
This allows the attacker to get the desired information

Cross-Site Scripting Attacks

Another form of injection attack
Attacker inserts malicious JavaScript code into web pages
Scripts executed when pages are loaded or when pages interact with the server
Potential for stealing customer information or directing users to malicious websites
Can steal cookies, enabling session hijacking attacks
Avoidable with input validation

Session Hijacking Attacks

Attackers get hold of a session cookie to impersonate legitimate users
Involves capturing traffic between client and server
Session Hijacking can also be done by malicious scripts (like cross-site scripting attacks)
The attacker gets access to the session content and potentially compromise the entire session

Actions to Reduce the Likelihood of Hacking

Traffic Encryption: Encrypt network traffic (e.g., use https, not http) to make it harder to monitor session cookies
Multi-factor Authentication: Require multiple forms of authentication before a user accesses a resource or performs an action. (Example: password + one-time passcode)
Short Timeouts: Limit session length, requiring new authentication after inactivity reduces chances for exploitation of accounts after legitimate users forget to log out.

Denial of Service Attacks

Attack intends to make a system unavailable
Distributed Denial-of-Service (DDoS) attacks are the most common type
Involve numerous hijacked computers in a botnet sending flood of requests to a system, overwhelming it and denying legitimate users access
Other types target user authentication, locking users out for failed login attempts or using email addresses to gain unauthorized access

Brute-Force Attacks

Attackers try multiple combinations of login names and passwords to gain unauthorized access to the system.
Use brute force to gain unauthorized access to a system or account
Some attackers use a string generator to create all possible combinations of symbols
To speed things up, some attackers start by trying common passwords

Authentication

Verifying the identity of a user.
Essential for protecting sensitive information
Different methods depending on the system
Example: Knowledgeable, possession, attribute-based
Usage of authentication to learn about users helps personalize their product experience

Authentication Approaches

Knowledge: Using something the user knows. Example: password
Possession: Using something the user has. Example: a mobile device
Attribute: Using something inherent to the user. Example: fingerprint

Authentication Methods

Knowledge-based: Using secret/personal information
Possession-based: Using a physical device such as mobile phone
Attribute-based: Using unique biological attributes such as fingerprint

Weaknesses of Password-Based Authentication

Insecure passwords: Passwords that are easy-to guess are vulnerable
Phishing attacks: Scams that trick users into giving up passwords or login credentials
Password reuse: Using the same password for multiple services
Forgotten passwords: Security risks if password recovery mechanisms are not robust or easily exploited

Federated Identity

Authentication approach using external authentication services
Example "Login with Google" and "Login with Facebook"
One set of credentials stored by a trusted service
Easier for users and reduces chances of security breaches

Authorization

Determining which resources a user is permitted to access based on their identity and access control policies.
Examples:
- Shared Folder permissions on Dropbox
- Defining who has access to information and resources and the types of access.

Access Control Policies

Rules defining what information and programs are accessible and how.
Important for legal compliance and technical reasons.
Data protection rules limit information accessible to users.
Security breaches from incomplete or noncompliant policies can have legal implications
Can be used as the starting point for setting up a complete access control scheme. Example: access rights for different users or different groups (e.g., students)

Access Control Lists (ACLs)

Tables that link users with resources and specify permissible actions.
Can become large; groups and permissions are more efficient
Example: reviewers can read and annotate a document without edit or delete access

Encryption

Making a document unreadable by applying transformation rules
A secret key is the basis for transformation

Symmetric Encryption

Same key used for encrypting and decrypting
Secure message exchange requires secure key exchange
Security risk if the key is compromised.

Asymmetric Encryption

Different keys for encryption and decryption
Public key for encryption, private key for decryption
Public keys are publicly available
Private keys are kept secure.
Used for authentication and secure communication.

Encryption and Authentication

Asymmetric encryption can verify sender identity
Sender uses recipient's public key for encryption
Recipient uses recipient's private key for decryption

TLS and Digital Certificates

https protocol for secure communication over web
Includes a Layer for Encryption called TLS (Transport Layer Security)
Use of digital certificates for server validation.
CA (Certificate Authority) issues and validates certificates.

Encryption Levels

Application, database, files, media.
Data will be encrypted and decrypted at different levels.

Key Management

Process of securely generating, storing, and distributing encryption keys.
KMS (Key Management System) is a specialized database for key management.
Important for protecting data.

Long-Term Key Storage

Need to maintain encryption keys for long periods (e.g., financial records)
Archival data should use separate keys to reduce security risk
Key management systems need backup and timestamped key versions

Privacy

Social concept, encompassing collection, use, and dissemination of personal information
Importance varies across cultures and demographics.
Legal and/or ethical considerations

Business Reasons for Privacy

Compliance with privacy laws is critical for sales
Protects business products from legal action (e.g., lawsuits)
Reputational damage when privacy is violated

Data Protection Laws

Laws protecting individual privacy, limiting data collection use, etc
GDPR affects all companies collecting user data
Companies responsible for securely storing, managing and distributing data.

Data Protection Principles

Key aspects that must be upheld

Privacy Policy

Defines how an organization collects, stores, and uses sensitive data
Must be auditable, written in plain language.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

Test your knowledge on various cybersecurity threats, including confidentiality and integrity concerns. This quiz will also cover key principles related to authentication and authorization standards. Assess your understanding of proper system management practices as well.

Cybersecurity Threats and Principles

Choose a study mode

Podcast

Questions and Answers

Which of the following is an example of a confidentiality threat?

Ransomware primarily affects the integrity of data.

What are the two key principles that should be established according to authentication and authorization standards?

An attacker might launch a ______ to make a system unavailable to its users.

Which of the following is NOT a threat to integrity?

Match the security threats with their categories:

Security updates should be applied as soon as they become available.

What does proper system infrastructure management entail?

What is the main purpose of operational security?

Multi-factor authentication increases the likelihood of an intruder gaining access to the system with stolen credentials.

What should be implemented to ensure you keep undamaged copies of program and data files?

SQL poisoning attacks take advantage of situations where user input is used as part of an ______.

Match the following types of attacks with their descriptions:

Which of the following is NOT a strategy for minimizing the effects of an attack?

Injection attacks utilize valid input fields to execute malicious code.

What is one common type of injection attack?

What is the main goal of user lockout attacks?

Brute force attacks typically involve attackers using weak passwords.

What is authentication?

Attackers create different passwords and try to login with each of these in a ________ attack.

Match the type of attack with its definition:

What outcome may occur if accounts are not locked after failed validation attempts?

Authentication is only necessary for software that does not contain user information.

What tactic do attackers often use to speed up brute force attacks?

What does allocating users to groups in access control manage?

Encryption transforms readable data into an unreadable format.

What is used by the encryption algorithm to transform data?

Modern encryption techniques can make data practically __________ using current technology.

Match the following resources with their corresponding permissions:

What potential future technology may necessitate a new approach to encryption on the Internet?

All encryption methods used today are guaranteed to remain secure indefinitely.

What is the reverse process of encryption called?

What does the public key of the CA include?

The public key can be used to encrypt the digital signature.

What does TLS stand for?

The server's public key is included in the digital __________ sent to the client.

What is the purpose of the RS and RC numbers generated during the TLS process?

What is a primary function of a Key Management System (KMS)?

To verify the identity of the client, the server encrypts the RS using its public key.

Data protection regulations do not require archival data to be encrypted.

What is the minimum retention period for tax and company data in the UK?

What needs to be checked regarding the digital certificate sent from the server?

Younger people tend to be less inhibited about sharing personal information on ______.

Data is exchanged using a __________ key computed from RS and RC.

Why should encryption keys be changed regularly?

Match the following components with their roles in TLS:

Match the following terms with their correct definitions:

The process ends after the exchange of data using the symmetric key.

Cultural and age differences influence individuals' views on privacy.

What should be maintained by KMS for decrypting backup data and archives?

Study Notes

Introduction to System Analysis and Design

Software Security

Types of Security Threats

System Infrastructure Stack

Security Management

Operational Security

Injection Attacks

SQL Poisoning Attacks

Cross-Site Scripting Attacks

Session Hijacking Attacks

Actions to Reduce the Likelihood of Hacking

Denial of Service Attacks

Brute-Force Attacks

Authentication

Authentication Approaches

Authentication Methods

Weaknesses of Password-Based Authentication

Federated Identity

Authorization

Access Control Policies

Access Control Lists (ACLs)

Encryption

Symmetric Encryption

Asymmetric Encryption

Encryption and Authentication