IT Security Fundamentals

• IT security and data protection are key in modern IT
• IT security protects systems and data from attacks, manipulation, and loss
• Data protection focuses on protecting personal data and its lawful processing

Fundamentals of IT Security

Security Goals of IT Security

• Confidentiality: Only authorized individuals should access data, preventing sensitive information from falling into the wrong hands
• Encryption, access controls, and authorization concepts are measures to ensure confidentiality
• Integrity: Data should be protected from unauthorized modification to ensure that data remains unaltered during storage or transfer
• Digital signatures, hash functions, and audit mechanisms are typical measures for data integrity
• Availability: Systems and data should be accessible at all times
• Technical malfunctions, attacks (e.g., DoS attacks), or hardware failures must be minimized
• Redundant systems, regular backups, and disaster recovery plans help ensure availability
• Authenticity: Ensures identities and information are genuine and trustworthy, verifying the source of information as verifiable and untampered with
• Digital signatures, certificates, and strong authentication methods like two-factor authentication are typical measures

Threats and Attacks

• Malware (viruses, Trojans, ransomware), phishing and social engineering, Denial-of-Service (DoS) attacks, and Man-in-the-Middle attacks are common cybersecurity threats

Malware (Malicious Software)

• Malware is a collective term for malicious software that aims to damage, manipulate, or compromise systems
• Viruses: Malicious programs replicate themselves and infect files to spread
• Worms: Similar to viruses but spread independently across networks without needing to infect a file
• Trojans: Disguise themselves as useful programs but contain malicious functions, like installing backdoors
• Ransomware: Encrypts data on a system and demands a ransom for decryption
• Spyware: Spies on users and collects information like passwords or credit card data
• Adware: Displays unwanted ads and can monitor user behavior
• Measures against malware include using antivirus programs, regular security updates, avoiding unsafe downloads, and educating users on how to identify suspicious emails and attachments

Security Measures

• Firewalls and intrusion detection systems, antivirus software, encryption (SSL/TLS, hard drive encryption), two-factor authentication, and regular updates and patch management are crucial for security

Network Security

• VPNs (Virtual Private Networks) ensures secure connections
• WLAN security (WPA2, WPA3) is used to protect wireless networks
• Network segmentation reduces the potential for damage

Data Protection

• Data protection involves safeguarding personal data from misuse and unauthorized access, which is regulated by the General Data Protection Regulation (GDPR) in the EU

Basic Principles of Data Protection

• Purpose limitation: Data may only be collected for specified, legitimate purposes
• Data minimization: Only essential data should be processed
• Integrity and confidentiality: Data must be protected through appropriate measures

Measures for Data Protection

• Anonymization, pseudonymization, data economy, and access control protect data
• Compliance with GDPR is mandatory for organizations

General Data Protection Regulation (GDPR)

• The General Data Protection Regulation (GDPR) is an EU regulation that came into effect on May 25, 2018
• GDPR establishes consistent rules for processing personal data in the EU and protects citizens' rights related to their data
• Right to information: Users have the right to know what data is stored about them
• Right to erasure (“right to be forgotten”): Users can demand that their data be deleted
• Consent requirement: Companies must obtain explicit consent for processing personal data
• Notification requirement for data breaches: Companies must report data breaches to the relevant supervisory authority within 72 hours
• High penalties for violations: The GDPR provides for fines of up to 20 million euros or 4% of a company's global annual turnover

Security Incidents and Response

• Security incidents can be detected and reacted to using the incident response plan and with backup and recovery strategies

Questions

• IT security aims to protect systems and data, while data protection focuses on personal data and its lawful processing
• Methods to protect a company network include firewalls, intrusion detection systems, VPNs, secure WLAN configurations, and network segmentation
• Legal requirements for data protection in Germany and the EU are based on the GDPR, which includes principles like purpose limitation, data minimization, and the rights of individuals

Explore the core tenets of IT security, focusing on confidentiality, integrity, and availability. Learn how encryption, access controls, and redundant systems safeguard data and ensure continuous access. Understand the measures to protect systems from attacks and data loss.