IT Security Incident Overview

IT Security Incidents

• Information technology security is paramount.
• It is vital to safeguard confidential business, customer, and employee data.
• Protection from malicious theft or disruption must be counterbalanced with business demands.
• Data breaches in corporations such as Facebook and LinkedIn exemplify potential risks.

Prevalence of Computer Incidents

• The computing environment's increasing complexity raises the likelihood of attacks.
• Shared credentials and verification lapses jeopardize security.
• Cloud computing and virtualization add complexity and vulnerabilities.
• User expectations for quick support may cause security oversights.
• Personal computers connect to networks and broadly share information.
• Rapid technological advancements can make staying up-to-date with security measures difficult.
• The presence of known software flaws are exploited by attackers.
• Delayed software updates expose systems.
• Zero-day attacks use vulnerabilities that are unfixed.
• Companies use software with known vulnerabilities.

Types of Exploits

• Viruses: Malicious code that attaches to a host file and spreads when executed, and can use email attachments.
• Worms: Self-replicating programs spread across networks and can encrypt files on infected systems.
• Trojan Horses: Malicious software disguised as legitimate programs and can lead to banking information theft.
• Distributed Denial of Service (DDoS): Overwhelms systems with traffic, disrupting major websites - such as the 2016 attack on Dyn that disrupted Twitter and Netflix
• Rootkits: Tools enabling unauthorized access to a computer, targeting industrial control systems.
• Spam: Irrelevant messages sent over the internet, typically promoting dubious products.
• Phishing: Fraudulently obtaining sensitive information by impersonating a trustworthy entity.
• In spear-phishing, fraudulent emails are sent to an organization's employees.
• Smishing is phishing via text messages.
• Vishing is phishing via voice mail messages.

Types of Perpetrators

• Perpetrators include thrill seekers, common criminals, industrial spies, and terrorists.
• They all have different objectives, access to resources, and willingness to take risks.
• Hackers use technical skills to gain unauthorized access and test systems.
• Crackers are similar to hackers but are malicious.
• Malicious Insiders use their organizational roles to harm systems.
• Industrial Spies steal confidential information from competing companies.
• Cybercriminals engage in fraud, identity theft, and malware distribution.
• Hacktivists use hacking to promote ideologies.
• Cyberterrorists use the internet to conduct terrorist activities.

Classifying Perpetrators of Computer Crime

• Hackers test system limits or gain publicity.
• Crackers cause problems, steal data, and corrupt systems.
• Malicious insiders can cause financial loss and disrupt company functions.
• Industrial spies capture trade secrets and achieve competitive advantages.
• Cybercriminals aim to gain financially.
• Hacktivists endorse political ideology.
• Cyberterrorists aim to destroy infrastructure components of institutions

Implementing Trustworthy Computing

• Trustworthy computing delivers secure, private, and reliable computing, based on sound business practices.
• Security of any system is a mix of technology, policy, and people.
• Systems have to monitored to detect potential intrusion.
• A clear reaction plan includes notification, containment, eradication, and recovery.

Risk Assessment

• Risk assessments apply to organizations' computers and networks, covering internal and external threats.
• Process identifies investments that protect from most dangerous threats.
• Security focuses where the payoff is highest.
• The risk assessment process has eight steps

1. Identify assets of most concern
2. Identify loss events that could occur
3. Assess the likelihood of potential threats
4. Determine the impact of each threat
5. Figure out how each threat could be mitigated
6. Assess feasibility of mitigation options
7. Perform cost-benefit analysis
8. Decide on which countermeasures to implement

Security Policy

• A security policy defines security requirements, controls, and sanctions
• It delineates responsibilities and expected behavior
• The policy outlines what needs to be done
• Automated system policies and written policies should mirror each other
• Security policies must find a balance between ease of use and increased security
• Areas of concern include email attachments and wireless devices

Employee Education

• Educate and motivate users to follow policy.
• Discussions must include recent security incidents.
• Keeping information systems secure involves protecting passwords.
• Protection also requires controls to protect data, reporting unusual activity, and safeguarding portable devices

Prevention

• Layered Security: Use multiple security measures.
• Corporate Firewall: Limits network access.
• Intrusion Prevention Systems: Blocks viruses and threats.
• Antivirus Software: Scans for virus signatures.
• Insider Safeguards: -Delete departing accounts, -Define roles, -Separate duties and limit user authority.
• IT Security Audits
  • Evaluate policies.
  • Review access levels.
  • Test safeguards.

Detection

• Detection systems catch intruders.
• Intrusion detection systems watch system/network resources and activities
• Those systems notify the authority when it identifies an threat
• This could be a possible intrusions that originate from outside or misuse from within.
• Knowledge and behavior-based approaches are utilized.

Response

• Responses should be developed in advance, approved by legal and senior management.
• The primary goals are to regain control and limit the threat/damage.
• Define who to notify and avoid public disclosure.
• Record all events and actions for documentation.
• Act quickly, collect evidence, and verify backups by containing and eradicating.
• Determine the cause of the event and prevent recurrence with follow-up actions.
• Review, assess the incident and response
• Efforts need to capture perpetrator
• Negative publicity and legal accountability need to be considered.

Computer Forensics

• Combines elements of law and computer science to ensure admissible evidence.
• Investigation requires extensive training, certification, and knowledge of relevant laws.

Key Summary Points

• Ethical decisions determining information systems and data involve safeguarding.
• Prevalent computer exploits include viruses, worms, Trojan horses, DDoS, rootkits, spam, and phishing.
• Perpetrators encompass hackers, crackers, malicious insiders, industrial spies, cybercriminals, hacktivists, and cyberterrorists.
• Multilayer processes should manage security vulnerabilities through assessment, action, and education.
• IT leadership is essential for implementing security policies, procedures, hardware, and software.
• Computer forensics is vital for justice in computer crime cases.