Types of Cyber Attacks: External vs Internal

Confidentiality, Integrity, and Availability are the main objectives in any security plan.

Computer Security is primarily concerned with protecting data during their transmission from one computer to another.

Information Security involves protecting systems, hardware, and other elements that use, store, and transmit information.

Network Security focuses on preventing unauthorized access, modification, destruction, or disclosure of information.

Integrity ensures that computer system assets can be modified by unauthorized parties.

Confidentiality in information security means information can only be accessed by unauthorized parties for reading purposes.

Integrity ensures that point A and point B are not who they claim to be.

Availability requires that computer assets are only available to unauthorized parities.

A vulnerability is a strength within a system that cannot be exploited by attackers.

A threat is something that is a source of safety and does not pose any danger to a system.

A countermeasure aims to increase the impact of an attack.

An external attack comes from within the trusted network.

To achieve security, we need Policy, Mechanism, and Assurance.

An internal attack comes from within the trusted network.

Structured attacks are carried out by individuals with discernible characteristics.

Unstructured attacks are carried out by individuals with sufficient experience to carry out an attack.

The job of an information security specialist is to make the attacker's job as easy as possible.

A simple Google search does not provide pre-built tools for carrying out attacks.

A defense-in-depth security model only uses one layer of defense.

If one layer in a defense-in-depth model is compromised, it is guaranteed that the attacker will access all network resources.

The base layers of a defense-in-depth model include physical security measures like security guards and locks.

The core layers of a defense-in-depth model consist of tools, technologies, and best practices to protect network resources.

Examples of tools in the perimeter layer include network segmentation and network intrusion-detection systems.

The defense-in-depth model aims to increase an attacker's chance of success by reducing the risk of detection.