Introduction to Cybersecurity Concepts

Cybersecurity Fundamentals

• Cybersecurity combines three key pillars: people, policies, and technologies.
• People need to understand data security principles such as strong password creation, cautious email usage, and data backup.
• Policies establish how organizations handle cyber threats and attacks.
• Technology provides essential tools for protecting against cyber attacks.

Key Entities to Protect

• Endpoint devices: includes computers, smart devices, and routers.
• Networks: safeguard interconnected devices.
• Cloud and data centers: housing critical data and applications.

Common Protective Technologies

• Next-generation firewalls.
• DNS filtering.
• Malware protection and antivirus software.
• Email security solutions.

Vulnerabilities, Threats, and Countermeasures

• Vulnerability: a weakness in security systems that can be exploited.
• Threat: a circumstance that poses potential harm or loss.
• Controls: protective measures to mitigate vulnerabilities, including actions and procedures.

Malware Symptoms

• Increased CPU usage and slow computer performance.
• Network connectivity issues and system crashes.
• Appearance of unusual files or abnormal computer behavior.
• Automated emails sent without user initiation.

Malware Countermeasures

• Use high-quality antivirus software with up-to-date virus definitions.
• Exercise caution when opening unsolicited email attachments or downloading files.
• Regularly back up data to prevent loss.

Types of Cybersecurity Threats

• Ransomware: malware that locks and encrypts files, demanding payment for decryption.
• Social engineering: manipulation techniques to trick users into divulging confidential information.
• Phishing: fraudulent emails mimicking legitimate sources to steal sensitive data.
• Spear phishing/whaling: targeting specific individuals or organizations.
• Angler phishing: exploiting social media trust to capture personal information.
• Vishing/Smishing: phishing via voice calls and SMS, respectively.
• Pharming: misdirecting users to fraudulent websites silently.
• Pretexting: using fabricated stories to gain victim trust for information extraction.
• Baiting: enticing victims with tempting offers.
• Tailgating: unauthorized entry by following authorized individuals.
• Doxing: publicizing personal information online to harm individuals.
• Zero-Day Attack: exploiting previously unknown vulnerabilities.
• Reverse Social Engineering: deceiving the target into believing they need help.

Security Awareness and Education

• Implement strong password policies and periodic changes.
• Conduct effective training programs to increase awareness of cyber threats.
• Classification of information based on sensitivity.
• Enforce two-factor authentication for added security.

CIA Triad: Confidentiality, Integrity, Availability

• Confidentiality: measures to protect sensitive information from unauthorized access.
• Integrity: assurance that data remains accurate and reliable.
• Availability: ensuring authorized users can access information when needed.

Ensuring Confidentiality

• Utilize encryption, access control, and steganography to safeguard data secrecy.
• Awareness of attacks like eavesdropping, sniffing, and shoulder surfing that violate confidentiality.

Maintaining Data Integrity

• Use file permissions, user access controls, and version control to protect data.
• Implement cryptographic checksums to verify file integrity over time.

Ensuring Availability of Data

• Protect against threats such as device failures and Denial-of-Service attacks.
• Store backup copies in geographically isolated locations to prevent data loss.

AAA Services: Authentication, Authorization, Accounting

• Identification: claiming an identity when accessing systems.
• Authentication: verifying the claimed identity.
• Authorization: defining resource access permissions for specific identities.
• Auditing: logging activities to monitor compliance.
• Accounting: reviewing logs to hold individuals accountable for actions.

Protection Mechanisms

• Layering/Defense in Depth: using multiple security controls to enhance protection.
• Abstraction: efficiently grouping elements with similar security needs.
• Data Hiding: obscuring data from unauthorized users.
• Encryption: ensuring sensitive information is not accessible to unintended recipients.

Asset, Threat, Vulnerability, and Risk Elements

• Asset: Valuable elements for an organization, including resources, processes, and infrastructure requiring protection.
• Threat: Any potential event capable of causing unwanted impact on an organization.
• Attack: An actual event that results in unwanted consequences for an organization.
• Vulnerability: Lack of safeguards or system weaknesses that can be exploited by threats.
• Threat Agent: An individual or process that initiates a threat.
• Exploit: Occurs when a threat agent leverages a vulnerability.
• Risk: The possibility of a threat exploiting a vulnerability, leading to asset damage.
• Risk Elements: Include Threat, Vulnerability, Asset, and Damage.

Threat Modeling

• Purpose: Security process for identifying, categorizing, and analyzing potential threats.
• Proactive Approach: Defensive strategy that includes threat prediction during design and development phases.
• Reactive Approach: Adversarial strategy applied post-deployment to address threats.

Identifying Threats

• Methods:
  • Focused on Assets: Identifying threats based on asset valuation.
  • Focused on Attackers: Identifying threats by analyzing potential attackers and their goals.
  • Focused on Software: Evaluating software for potential threats.
• Steps:
  • Identify involved technologies.
  • Analyze potential attacks on each technology element.
  • Determine prevention measures by anticipating issues.

STRIDE Threat Model

• Developed by Microsoft for classifying threats.
• Components:
  • Spoofing: Gaining unauthorized access through false identity.
  • Tampering: Unauthorized modifications of data.
  • Repudiation: Denying performed actions.
  • Information Disclosure: Unwanted sharing of confidential information.
  • Denial of Service (DoS): Disabling resource access for legitimate users.
  • Elevation of Privilege: Unauthorized escalation of user permissions.
• Threat Properties Violated: Reflects spoofing, tampering, repudiation, disclosure, DoS, and elevation against authentication, integrity, non-repudiation, confidentiality, availability, and authorization.

Supply Chain Security Concepts

• Definition: A network connecting a company with suppliers for product distribution.
• Secure Supply Chain: Involves reliable and trustworthy vendors ensuring quality and integrity in products.
• Security Assessments: Vital for both product design and third-party interactions.

Security Governance Principles

• Importance: Governance practices direct the security efforts of an organization.
• Core Principles:
  • Credibility: Trustworthiness and believability.
  • Transparency: Openness in actions.
  • Accountability: Responsibility and justification for actions.

Evaluating Security Governance

• Complexity: Governance issues increase in a global market with varying laws.
• Security Management: Should involve more than just IT; it is critical for business operations.
• Management Strategy: Commonly overseen by a governance committee or board, utilizing frameworks like NIST 800-53.

Security Function Alignment

• Security Management Planning: Aligns security functions with organizational strategy and objectives.
• Top-Down Approach: Senior management establishes policies guiding security efforts.
• CISO Role: Chief Information Security Officer responsible for cybersecurity, reporting directly to management.

Security Policy Development and Implementation

• Plans Developed:
  • Strategic Plan: Long-term stability, aligning security purpose with organizational goals, updated annually.
  • Tactical Plan: Midterm details on achieving strategic goals, often for about a year.
  • Operational Plan: Short-term, highly detailed, updated frequently to ensure compliance with tactics.

Example of Policy Plans

• Strategic Goal: Educate 100% of users by 2025.
• Tactical Goal: Train 30% of users by the end of 2021.
• Operational Steps:
  • Contract training program development.
  • Conduct training sessions.
  • Implement assessments to ensure knowledge retention.
  • Execute mock attacks for applied learning.
  • Finalize training reports.

Explore the fundamental principles of cybersecurity, focusing on the three key pillars: People, Policies, and Technologies. This quiz will test your understanding of essential security practices and organizational frameworks. Learn how to secure data and recognize the importance of robust cybersecurity measures.