Introduction to basic Cybersecurity concepts

Introduction to Cybersecurity

• Cybersecurity protects individuals, organizations, and governments from digital attacks by protecting network systems and data from unauthorized use and harm.
• Three Levels of Protection; Personal, organizational, government.
• Personal Protection - Safeguarding identity, data, and computing devices on a personal level.
• Organizational Protection - Protecting reputation, data, and customers.
• Government Protection - Protecting national security, economic stability, and citizens' well-being as digital information protection becomes vital.

Protecting Personal Data

• Personal data is any information that can identify you and exists offline and online.
• Offline Identity - refers to daily life persona presented at home, school or work.
• Online Identity - refers to your representation of yourself to others online, including usernames, aliases, and social identity on online communities and website.
• Limit the amount of personal information revealed through your online identity.

Data Vulnerabilities

• Personal data includes name, social security number, driver's license, birth date/place, mother's maiden name, pictures, and messages exchanged with family/friends.
• Cybercriminals use sensitive information to impersonate individuals, intruding on privacy and causing reputational damage.

Medical Records

• Each doctor visit adds personal physical and mental health information to electronic records (EHRs), most saved online.
• Many fitness trackers' clinical data, like heart rate, blood pressure, and blood sugar, is stored and displayed via the cloud.

Education Records/Employment and Financial Records

• Educational records contain academic qualifications, contact information, attendance records, disciplinary reports, health/vaccination records, and special education records.
• Employment data, including past employment and performance reviews, is valuable to hackers.
• Financial records include income, expenditure, tax records, paychecks, credit card statements, credit rating, and bank account details.

Securing Information

• Safeguarding personal information and financial records properly prevents cybercriminals from using it for their gain.
• Sharing personal data requires security awareness, considering privacy and data protection laws applicable in specific countries.
• Store loyalty cards assist shops in building your profile of purchasing behavior to target special marketing offers to you.
• Wearable technologies collect clinical research data, patient health monitoring, and fitness/wellbeing tracking data.

Hackers

• Social media firms generate income by selling targeted advertising based on customer data, mined using algorithms/formulas.
• Cybercriminals pursue money, steal identities, and ruin lives.

Identity Theft

• Identity thieves often apply for credit cards, open bank accounts, rent an apartment, or take out loans using stolen identities.
• Medical theft arises from rising medical costs, with cybercriminals stealing insurance for personal benefit, causing medical procedures to be saved in victim's records.
• Private data theft helps cybercriminals access bank accounts, credit cards, social profiles, etc.; identity thieves file tax returns, collect refunds, take loans, and ruin credit.

Who Else Wants Your Data?

• Internet service providers (ISPs) track online activity for profit via advertisers. They are legally mandated to share user information with government surveillance agencies.
• Advertisers track online behavior, preferences, and send targeted ads.
• Search engines and social media platforms gather user information, such as geolocation, demographics, and ideologies, for sale to advertisers.
• Websites use cookies to track user activity, creating a data trail linked to online identities, shared with advertisers.

Organizational Data

• Safeguarding organizational data requires understanding its types.
• Two Primary Types of Organizational Data at eLearning company @Apollo; Traditional Data, IoT(Internet of Things) Data & Big Data

Traditional Data

• Generated and maintained by organizations involving; transactional, intellectual property and financial data.
• Transactional Data - Details relating to buying and selling, production activities and basic organizational operations.
• Intellectual Property - Patents, trademarks and new product plans, allowing market dominance; kept as trade secrets to avert potential disasters.
• Financial Data - Revenue and spending statements and cash flow statements that provides insight into organizational health.

The Internet of Things (IoT)

• IoT involves physical objects (sensors, software, etc.) connected to the Internet to collect and share data.
• Expanding storage via cloud and virtualization leads to IoT-driven data growth, creating "Big Data".

The McCumber Cube

• Founded by John McCumber in 1991 it helps establish information security initiatives by evaluating all related factors.
• Composed of three dimensions: foundational principles, information protection, and security measures.

Protecting Principles

• Confidentiality - prevents data disclosure to unauthorized entities via encryption, identity proofing, and two-factor authentication.
• Integrity - protects system data from manipulation, preventing both intentional and accidental modification.
• Availability - ensures authorized users can access systems and data when needed.

States Of Information Within The McCumber Cube

• Processing - data being used and updated.
• Storage - data stored in rest in memory or on a permanent storage device.
• Transmission - data travelling between information systems.

Security Measures To Protect Data Within The McCumber Cube

• Awareness, training, and education is implemented ensuring users are knowledgeable of security threats.
• Technology refers to the software and hardware solutions designed to protect information systems such as firewalls.
• Policy and procedure refers to the administrative controls that provide foundation for how an organization implements assurance.

Data Security Breaches

• In August 2020, Razer had a data breach of approximately 100,000 customers.
• Cloud cluster misconfiguration exposed Razer's infrastructure, leading to a data leak.
• Razer took >3 weeks to secure the cloud instance, granting cybercriminal access to customer info, usable for social engineering and fraud.
• The Persirai botnet targeted 1,000+ IP camera models in 2017 via open ports, to inject malware led to 122,000 hijacked cameras used for DDoS.

Data Breaches

• The Equifax breach involved attackers exploiting a web application, occurred in September 2017.
• Attackers gained access to the personal data of millions of customers.
• Equifax created a dedicated website for customers to determine if their personal datawas compromised, in response to the data breach.
• Cybercriminals created unauthorized websites with similar domains used to impersonate legitimacy, tricking customers into providing data.
• Consequences of a security breach include reputational damage, theft, loss of revenue, and damaged intellectual property.
• Cybercriminals are constantly finding new ways to attack, requiring cybersecurity professionals to quickly minimize impact.

Scenario 1 - Security Breaches

• A well-known global hotel chain reported a breach that exposed over 3 million guests' personal information through employee login details.
• Hackers gained access to the hotel's customer database.
• The hotel did not believe the hackers were able to access account passwords.
• Guests were encouraged to check the hotel's web portal impact.

Scenario 2

• A popular online training platform left exposed millions of students (many of them minors) personal data on a publicly accessible cloud database.
• Hackers were able to access student names, email addresses, phone numbers, and school enrollment details via the internet.

Cyber Attackers

• Cyber attackers' main goal is to exploit vulnerabilities for personal or financial gain, targeting everything from designs to credit cards.
• They are often categorized as white, grey, or black hat attackers.

Hacker Types

• Amateurs (script kiddies) - use existing tools/instructions, may cause devastating attacks.
• White hat hackers - break into systems to find weaknesses to improve, with owner approval /results reported back to the owner.
• Gray hat hackers - find vulnerabilities, report based on agenda, share publicly for exploitation.
• Black hat hackers - exploit vulnerabilities for illegal gain.

Organizational Hacker Groupings

• Organized hackers include cybercriminals, hacktivists, terrorists, and state-sponsored hackers.
• They normally provide cybercrime as a service.
• Hacktivists - Make political statements about issues.
• State-sponsored attackers - gather intelligence with specific goals beneficial to their government.

Cyber Attack Origins

• Cyber-attacks can originate internally or externally.
• Internal attacks involve mishandling confidential data and facilitating external attacks.

Cyberwarfare

• Cyberwarfare is the utilization of technology by a nation to penetrate and attack the computer systems/networks of another nation.
• Goal is to disrupting services like; shutting down power grids.

The Purpose Of Cyberwarfare

• The main reason for resorting to cyberwarfare is to gain advantage over other nations or competitors.
• To steal defense secrets and help narrow technology gaps, and leverage compromise sensitive data to blackmail personnel. Disrupt a nation's infrastructure, causing disruption and havoc by shutting down a power grid.

Types Of Malware

• Viruses, Trojans and Worms.
• Virus - replicates, attaching to executable files requiring end-user interaction.
• Trojans - masks as its true intent, often found in image/audio files or games, exploiting user privileges without self-replication.
• Worms - replicate to spread, exploiting vulnerabilities, and causing damage without a host program.

Types Of Other Malware

• Spyware - monitors online activity and logs keystrokes/data by modifying security settings.
• Adware - delivers ads, often from bundled software, often coupled with spyware.
• Backdoor - bypasses authentication for remote access and command execution.
• Ransomware - holds systems/data captive until payment by encrypting data.
• Scareware - deceives users with 'scare' tactics for specific actions to infect with malware. Rootkit - modifies the operating system to create a backdoor via exploiting vulnerabilities.

Malware Symtoms

• Increased CPU usage, computer freezing/crashing, decreased browsing speed, network connection issues, unknown files, turning off/reconfiguring, and unauthorized emails.

Social Engineering

• Social Engineering - is defined as manipulating people into divulging confidential information or performing certain tasks.
• Attacks; pretexting, tailgating, or quid pro quo.
• Pretexting - when an attacker calls an individual and lies to them in an attempt to gain access to privileged data or persona/financial data.

Denial of Service

• Denial-of-Service (DoS) attacks interrupt network services by overwhelming a server with traffic or sending malicious packets.
• Overwhelming quantity of traffic occurs when a network, host or application is sent an enormous amount of data.
• Maliciously formatted packets may be exploited by forwarding packets containing errors or improperly formatted packets.

Distributed Denial of Service

• DDoS - is similar to a DoS attack but is distributed from multiple and coordinated attacks
• A botnet is build of infected hosts called zombies which is used as handler systems.
• Infected Hosts will constant scan and infect more hosts. Hacker will instruct the bots to make DDoS attacks.

Botnets

• Botnets is a group of bots, connected through the Internet, that can be controlled by a command-and-control server, tens and thousands/hundreds of thousands of bots are involved.
• Activated to distribute malware via DDoS, spam email, launch brute-force pw attacks.

On-Path Attacks

• On-path attackers is defined as attacks that intercept or modify communications between two devices to obtain or impersonate data.
• These attacks can be called the man-in-the-middle or man-in-the-mobile attack.
• A MitM attack is when a cybercriminal take control of a device without the user knowing.
• A MitMo is a type of attacks used to take control over a user's mobile device, one example of this is Zeus.

SEO Poisoning

• Goal is to increase traffic to malicious sites.
• SEO Poisoning defined- Search engines which are manipulated to present malicious results to users.
• Many legitimate companies optimize website positions, attacks use popular terms via SEO to promote dangerous sites.

Password Attacks

• Security Attacks to Usernames and Passwords, including password spraying, dictionary attacks, brute-force attacks, rainbow attacks, traffic interception.
• Password Spraying is a technique to gain access to a system via spreading a few commonly used passwords across accounts, remains undetected.
• Dictionary Attacks- every word is tried in a hackers dictionary systemically to break into accounts.
• Brute-Force Attacks- Every letter, number/symbol combination is used in the password space to access protected sites. Pass Rainbow Attacks-Precomputed password hashes compares ones stord to rainbow tables.

Cracking Time

• Strong passwords often require hackers to try everything available to crack a WiFi Password.
• Advanced Persistent Threats a APT is characterized as multi-phase, long-term, costly and highly stealth operations.
• Complex and require the high skill set needed to carry out the attack, an APT is commonly carried out by well funded business or political leaders.

Security and Exploit Vulnerability

• It's Over to You - Hackers deploy a wide assortment of tools.

The Definition Of Security

• Security vulnerabilities are kinds of hardware and software problems, and A program is written to exploit, and An attack is aimed at an aim.

Hardware and Software Vulnerabilities

• Hardware are often the result of hardware design flaws.
• The security measures for software's updates are usually added by errors in the operating system or application code.
• Software and Hardware can be found in; systems, applications, browsers, mobile apps, web servers which organizations produce too to finding and patching. Software and Hardware can be found in; systems, applications, browsers, mobile apps, web servers which organizations produce too to finding and patching.

Types Of Validated Code

• Code including non-validated input, race conditions, weakness in securities and access controls problems.
• Buffer Overflow and data corruption are some additional security vulnerabilities.

Software Updates

• Updates that need to be performed often come from Microsoft, Apple, and other operation system producers who release patches almost every day.
• There also is a rise in applications such as web browsers and mobile apps and web servers are are usually updated by companies.
• Software bugs can cause high risk and high alert in security systems.

The Cybersecurity Landscape

• Cryptocurrency involves; Crypto jacking (emerging threat), digital money, encryption techniques, and Banks/governments.