Security Awareness: Introduction to Security

About the Presentations

• The presentations are designed to align with the learning objectives outlined at the beginning of each chapter.
• Chapter objectives are listed at the start of each presentation for clarity.
• The presentations are customizable to meet specific class requirements.
• Figures from the textbook chapters are incorporated. A complete image set is available on the Instructor Resources disc.

Security Awareness: Introduction to Security

• Completion of the Intro to Security chapter will enable students to:
  • Describe the difficulties associated with securing information.
  • Define information security and explain its importance.
  • Identify common types of attackers.
  • Be able to describe the process of building a security strategy.

Challenges of Securing Information

• Protecting computers and data is difficult.
• There are numerous and varied types of attacks.
• Defending against attacks presents several challenges.

Today's Attacks

• Businesses are subject to data breaches that can result in significant financial and reputational damage.
  • The average cost of a business data breach is $7.2 million.
• Cybercrime affects over 400 million adults annually, costing an estimated $388 billion in time and money.
• There is the threat of malware being preinstalled on devices imported into the U.S. and sold.
• Personal medical devices are potential attack targets.
• Car hacking involves breaking into a car's electronic systems.
• Email account compromises can lead to financial loss. Attackers send fraudulent emails to contacts requesting money.
• Nigerian 419 Advance Fee Fraud is a top internet scam that has cost victims $41 billion to date.

Difficulties in Defending Against Attacks

• Universally connected devices: Attackers can launch attacks from anywhere in the world.
• Increased speed of attacks: Attacks can target millions of computers within minutes.
• Greater sophistication of attacks: Attack tools vary their behavior to evade detection.
• Availability and simplicity of attack tools: Attacks are no longer limited to highly skilled attackers.
• Faster detection of vulnerabilities: Attackers can quickly discover security holes in software and hardware.
• Delays in security updating: Vendors struggle to keep pace with updates to defend against attacks.
• Weak security update distribution: Many software products lack a timely means of distributing security patches.
• Distributed attacks: Attackers use thousands of computers to target a single computer or network, making them harder to defend against.
• User confusion: Users must make difficult security decisions with minimal guidance.

Defining Information Security

• Grasping common security terminology is helpful when creating computer defenses.
• Information security's importance needs to be understood.
• Security encompasses the necessary actions to protect individuals or property from harm.
• Security for a home includes protection from burglary and natural disasters.
• Security is inversely proportional to convenience: increased security often decreases convenience.

Key Principles of Information Security

• The task of securing information in a digital format is a key principle.
• Information security ensures protective measures are implemented correctly.
• Information security safeguards the integrity, confidentiality, and availability of data, protecting information of value to individuals and organizations.

Protections Overview

• Confidentiality: Preventing unauthorized disclosure of sensitive or private information.
• Integrity: Preventing unauthorized modification of systems and information.
• Availability: Preventing disruption of service and productivity.

AAA Access Control Framework

• Authentication: Proving who you are.
• Authorisation: Only access what you need to do to complete your job.
• Accountability: Be able to report on who did what, where and when

Information Security Definition

• Protecting the integrity, confidentiality, and availability of information on the devices that store, manipulate, and transmit the information using products, people, and procedures.
• Protecting information requires multiple layers: products, people, and policies and procedures.
  • Products are the physical security measures.
  • People are those who use security products properly to safeguard data.
  • Policies and Procedures are the plans established to ensure correct usage.

Information Security Terminology

• Asset: Something of value.
• Threat: A malicious or negative event that exploits a vulnerability.
• Threat Agent: The person or thing that carries out a threat..
• Vulnerability: A flaw or weakness that allows a threat agent to bypass security.
• Exploit: Taking advantage of a vulnerability.
• Risk: The likelihood and potential for loss or damage when a threat occurs. Some degree of risk is always present.

Risk Options Framework

• Avoid: Completely eliminate the risk.
• Accept: Acknowledge the risk but take no action.
• Mitigate: Reduce the likelihood or impact of the risk.
• Transfer: Shift the risk to a third party, such as through insurance.

Risk Assessment

• Risk assessment is to be assessed against the organization's budget and protection cost.
• Risk is a combination of likelihood and impact.
• Assessment of whether the risk falls into low, medium or high.

Understanding the Importance of Information Security

• Protect by preventing data theft, thwarting identity theft, avoiding legal consequences, maintaining productivity maintaining productivity, and foiling cyberterrorism.
• Data theft examples: stealing business information and personal credit card numbers.
• Identity theft involves stealing someone's information, impersonating them, usually for financial gain.
  • Data privacy laws include HIPAA (patient information), FISMA (federal information), FERPA (student information), Sarbanes-Oxley (financial reporting), GLBA/PCI DSS (financial information), and GDPR (EU resident data).
• Maintaining productivity involves making sure cleaning, lost estimates, and productivity are not all diverted.
• Cyberterrorism: Politically-motivated attacks intended to cause panic and financial catastrophe
  • Possible targets include the banking industry, air traffic control centers, and water systems.

Who Are the Common Attackers?

• Common categories of attackers are:
  • cybercriminals
  • script kiddies
  • spies
  • insiders
  • cyberterrorists
  • hacktivists
  • government agencies

Cybercriminals

• Individuals who launch attacks against other users and computer systems.
• Operate within loose networks or organized gangs, often in Eastern Europe, Asia, and developing countries.
• Steal personal data (credit card numbers, Social Security numbers) for fraud or sell fake products. They may also target governments and businesses to steal and sell important business or military data.
• Difficult to prosecute due to operating in countries with weak law enforcement.

Cybercriminal Forums

• Cybercriminals use hidden online forums to share data, coordinate attacks, buy and sell information.
• The Surface web is the portion of the Internet that can be found with search engines.
• The Deep web contains content accessible through search dialog boxes on sites.
• The Dark web is intentionally hidden and requires special browsers.

Script Kiddies

• Rely on automated attack software due to a lack of necessary knowledge.
• They purchase "exploit kits" that allow them to perform attacks.
• Over 40 percent of attacks require low or no skills.

Spies

• Spies target specific systems to steal corporate or government information.
• They are hired, not randomly searching for targets.
• Spies can use espionage to obtain information without drawing attention to themselves.
• Spies often possess excellent computer skills.

Insiders

• Include employees, contractors, and business partners within an organization.
• Insider data breaches account for 48% of those that occur.
• Insider attacks can include sabotage or theft of intellectual property.
• Sabotage often comes from employees who have been recently demoted or reprimanded.

Cyberterrorists

• The goal is to deface electronic information, spread misinformation, deny service and cause critical infrastructure outages or corruption.
• May be ideologically rather than financially motivated.

Hacktivists

• They are motivated by ideology to launch attacks, for specific Webs sites that cause problems.
• Hacktivists may promote a political agenda or retaliate for a prior event.

Government Agencies

• May instigate attacks against own citizens or against foreign governments.
• Malware has been used by goverments to target others: Flame and Stuxnet are powerful examples.

Building a Comprehensive Security Strategy

• Involves four key elements:
  • Block attacks.
  • Update defenses.
  • Minimize losses.
  • Send secure information.
• Many of these tactics have been used for centuries.

Block Attacks

• Involves creating a strong security perimeter.
• Medieval castles blocked attacks with protective stone walls and moats.
• Data resides on personal computers attached to the network, so local security is crucial.

Update Defenses

• It is necessary to updating defensive hardware and software continuously to protect from new threats.

Minimize Losses

• Actions must be taken in advance to minimize losses from attacks that breach defenses.
• Actions to take include:
  • Make backup copies of data.
  • Institute business recovery policy.

Send Secure Information

• Establish a secure electronic link between sender and receiver.
• Encrypt the data so unauthorized information cannot be reached.

Summary of Security Awareness

• Information security attacks have grown exponentially, but are now difficult to defend against.
• Key protections when securing are: protecting the integrity, confidentiality, and availability of data.
• Goals of a secure system are: preventing data theft, identity theft, and cyberterrorism, also, avoid legal consequences and maintain productivity.
• Attackers fall into recognizable categories and have different motivations, targets, and skill levels.
• A comprehensive security strategy is comprised of these elements:
  • Block attacks.
  • Update defenses.
  • Minimize losses.
  • Send secure information.

An introduction to information security that describes the difficulties associated with securing information. It defines information security and explains its importance. Common types of attackers and the process of building a security strategy are identified.