IT Security Best Practices PDF

# IT Security ## What is IT security? - IT security describes the precautions taken to protect computers and networks from unauthorized access. - These processes are designed to keep out agents who might seek to steal or otherwise disrupt system data. ## Quality IT Security Focuses on: - Protect...

# IT Security ## What is IT security? - IT security describes the precautions taken to protect computers and networks from unauthorized access. - These processes are designed to keep out agents who might seek to steal or otherwise disrupt system data. ## Quality IT Security Focuses on: - Protecting the integrity of the data. - Maintaining the confidentiality of the information stored in the network. - Ensuring those who need the data have access to it. - Authenticating users attempting to access computer networks. - Allowing members to securely send messages through networks. ## Why is IT security so important? - IT security is important because it protects sensitive information and data from unauthorized access, theft, or damage. - With the increasing use of technology in our daily lives, there is a greater risk of cyber-attacks and data breaches. - These attacks can result in financial losses, reputational damage, and legal consequences. - IT security measures such as firewalls, encryption, and access controls help to prevent these attacks and ensure the confidentiality, integrity, and availability of information. - Additionally, compliance with IT security regulations is often required by law or industry standards to protect individuals' privacy rights and prevent identity theft. - Overall, IT security is essential for maintaining trust in technology systems and protecting valuable assets from harm. ## Types of IT Security: - IT security deals with all aspects of protecting IT assets against cyber threats. - The modern business's IT assets are spread across multiple different platforms, meaning that IT security must secure a wide range of different platforms from cybersecurity threats. ### IT security includes: #### Identity Security: - Identity security includes methods and processes to identify, verify and authorize machines, devices, users, groups, applications, and functions. - This is essential to identity and access management (IAM). #### Network Security: - Network security involves securing on-prem networks, wide area networks (WAN), and the internet. - Network segmentation, secure transport, secure access, and content inspection to prevent threats are some methods used for securing networks. #### Cloud Security: - As organizations increasingly adopt cloud technologies, they need cloud-specific security solutions. - Common aspects of cloud security include solutions for laas security (covering infrastructure and workloads), PaaS security (securing applications and containers), and SaaS security (protecting office suites and email). #### Cybersecurity: - Cyber Security involves the practice of implementing multiple layers of security and protection against digital attacks across computers, devices, systems, and networks. #### IoT Security: - It is a subsect of cybersecurity that focuses on protecting, monitoring and remediating threats related to the Internet of Things (IoT) and the network of connected IoT devices that gather, store and share data via the internet. #### Endpoint Security: - As employees increasingly work from home, endpoint security is more important than ever. - This includes device compliance and threat prevention for both traditional endpoints and mobile devices. - It also includes securing Internet of Things (IoT) devices with device discovery, segmentation, and threat prevention. #### Application and API Security: - Applications and APIs are a major part of an organization's attack surface and should be secured via code review, analysis and runtime analytics. #### Management: - Deploying an array of security solutions means that organizations need to manage them as well. - This includes device configuration, monitoring, optimization, automation, and orchestration. #### Visibility and Incident Response: - The goal of IT security is to protect the organization against cyber threats. - To do so, organizations need to maintain visibility into their network, ingest threat intelligence, and engage in forensics, threat hunting, and threat mitigation as needed. ## Understanding Core Security Principles: - CIA triad (confidentiality, integrity and availability) is one of the core principles of information security. ## Confidentiality: - Information that should stay secret stays secret and only those persons authorized to access should have provided the access. - Allowing anonymous access to sensitive information is poor security measures against confidentiality. ## Integrity: - The prevention of erroneous modification of information. - Authorized users are probably the biggest cause of errors and omissions and the alteration of data. - Storing incorrect data within the system can be as bad as losing data. - Malicious attackers can modify, delete or corrupt info. ## Availability: - This principle ensures that the information is fully accessible at any time whenever authorized users need it. - This means that all the systems used to store, process, and secure all data must be always functioning correctly. - So, armed with these higher-level principles, IT security specialists have produced best practices to help organizations ensure that their information stays safe. ## Physical Security: - Video Surveillance - Perimeter Fencing and Walls - Signs - Security Guards - Alarm Systems - Motion detectors and Intrusion Detectors - Biometrics ## What impact does a cyber-attack have on my data? - Cyber attackers can use an individual's or a company's sensitive data to steal information or gain access to their financial accounts, among other potentially damaging actions, which is why cyber security professionals are essential for keeping private data protected. ## What is the current level of threat to IT security for companies? - IT security threats are constantly evolving and becoming more sophisticated, making it difficult for companies to keep up with the latest threats. - Some common threats including phishing attacks, malware infections, ransomware attacks, and data breaches. - Companies must implement robust security measures and stay vigilant to protect their systems and data from these threats. ## IT Security Threats - You may encounter three primary IT security threats. - Although considerable overlap exists between these threats, understanding their differences can help you better prepare your response to them. ### Cybercrime: - Cybercrime involves targeting or using computers or computer systems to commit criminal actions for some type of financial reward. - These types of crimes may include identity theft or extortion. ### Cyberterrorism: - Cyberterrorism uses the tools and methods of cybercrime and cyberattacks to try and go after critical infrastructure of countries or otherwise harm countries and cause fear. - For example: Malware, Virus, Spyware etc. ### Cyberattack: - A cyberattack executes digital attacks on a larger scale, potentially going after an entire computer system or multiple computer systems. - For example: The melissa virus, NASA Cyber Attack, Ukraine's Power Grid Attack. ## Malware: - Malware is some type of malicious software that harms a service or network. - Malware is designed to interfere with normal computer operation, usually giving hackers a chance to gain access to your computer and collect sensitive personal information. ## Anti-Malware: - Programs which can combat malware in two ways: - Real time protection against the installation of malware software on a computer. - Detection and removal of malware already installed onto a computer. ## Virus: - A computer virus is a type of malware that changes how a computer or network operates. - For example: someone must open an infected email, click a link or open a document to release the virus into the system. - The virus then makes copies of itself that allow it to spread to other devices. - Often viruses are disguised as games, images, email attachments, website URLs, shared files or links or files in instant messages. ## Anti-Virus: - The most effective mechanism for combating viruses are installing anti-virus software and keeping the anti-virus signature up-to-date. ## Spyware: - Spyware is malicious computer program that does exactly what its name implies-i.e., spies on you. - After downloading itself onto your computer either through an email you opened, website you visited or a program you downloaded, spyware scans your hard drive for personal information and your internet browsing habits. - Some spyware programs contain key loggers that will record personal data you enter websites. - Some spyware can interfere with your computer's system settings, which can result in a slower internet connection. ## Ransomware: - Ransomware is malicious software that holds vital information hostage for a ransom. - Hackers can design ransomware that locks people out of their computers or even companies out of their entire networks and then demand large sums of money or something else valuable in exchange for access to the vital information. ## Adware: - Adware is unwanted software that continually displays pop-ups. - They can slow down computer functioning significantly. - Adware can also help mask additional cyberthreats. ## Denial of Service(DoS) and Distributed Denial of Service(DDoS) - A Denial-of-Service (DoS) attack is a malicious, targeted attack that floods a network with false requests to disrupt business operations. - In a DoS attack, users are unable to perform routine and necessary tasks, such as accessing email, websites, online accounts or other resources that are operated by a compromised computer or network. - A distributed-denial-of-service (DDoS) attack is an attempt by malicious actors to render a service or a system (eg: server, network resource, or even a specific transaction) unavailable by flooding the resource with requests. ## Phishing - Phishing is a type of cyberattack that uses email, SMS, phone or social media to entice a victim to share personal information such as passwords or account numbers or to download a malicious file that will install viruses on their computer or phone. ## Botnets: - Botnets describe groups of computers linked together by a hacker who has infected them with some type of malware. - Once the hacker has control over the group of devices, they can use the computers as a single entity to launch stronger attacks, such as a DDoS attack or infect the computers of different organizations with spyware. ## Vulnerability: - A vulnerability is a weakness in an IT system that can be exploited by an attacker to deliver a successful attack. - They can occur through flaws, features or user error, and attackers will look to exploit any of them, often combining one or more, to achieve their end goal. ## Worm: - A worm is a type of malware or malicious software that can replicate rapidly and spread across devices within a network. - As it spreads, a worm consumes bandwidth, overloading infected systems and making them unreliable or unavailable. - Worms can also change and delete files or introduce other malware. ## Trojan Horse: - A Trojan horse is a program that either pretends to have, or is described as having, a set of useful or desirable features but contains damaging code. - Generally, you receive Trojan horses though emails, infected webpages, instant message, or downloading services like games, movies, and apps. - True Trojan horses are not technically viruses, since they do not replicate; however, many viruses and worms use Trojan horse tactics to initially infiltrate a system. - Although Trojans are not technically viruses, they can be just as destructive. ## SQL injections: - An SQL injection (SQLi) involves attackers inserting bad SQL code into entry fields for applications that access certain types of databases. - When this is done correctly, the malicious code allows the attacker to gain access to sensitive information, such as customer lists. ## Man-in-the-Middle-Attack(MitM) - A MITM (man-in-the-middle) attack occurs when a criminal hacker inserts themselves between a device and a server to intercept communications that can then be read or altered. ## Data Theft: - An offender gains access to files or data with sensitive information such as personal identifiable information (PII), credit card numbers, bank account information health records, and social security numbers. ## Pharming: - A pharming attack redirects users from the legitimate website they intend to visit and lead them to malicious ones, without the user's knowledge or consent. - A malicious site can look the same as the genuine site. - But when users enter their login name and password, the information is captured. ## How can companies increase their IT security? - There are several ways companies can increase their IT security: - **Conduct regular security assessments:** Companies should regularly assess their IT systems and identify potential vulnerabilities. This can be done through penetration testing, vulnerability scanning, and other security assessments. - **Implement strong access controls:** Companies should implement strong access controls to ensure that only authorized personnel have access to sensitive data and systems. - **Use multi-factor authentication:** Multi-factor authentication adds an extra layer of security by requiring users to provide more than one form of identification before accessing a system or data. - **Train employees on cybersecurity best practices:** Employees are often the weakest link in IT security, so it's important to train them on cybersecurity best practices such as how to identify phishing emails and how to create strong passwords. - **Keep software up-to-date:** Companies should keep all software up-to-date with the latest patches and updates to prevent known vulnerabilities from being exploited. - **Use encryption:** Encryption can help protect sensitive data from being intercepted or stolen by hackers. - **Implement a disaster recovery plan:** A disaster recovery plan can help companies quickly recover from a cyber-attack or other IT-related disaster by outlining procedures for restoring systems and data. ## IT Security Best Practices: - **Use strong passwords:** Use a combination of upper- and lower-case letters, numbers, and symbols to create a strong password. Avoid using easily guessable information such as your name, birthdate, or common words. - **Keep software up-to-date:** Regularly update your operating system, antivirus software, and other applications to ensure that they are protected against the latest threats. - **Use two-factor authentication:** Two-factor authentication adds an extra layer of security by requiring a second form of verification in addition to your password. - **Back up important data:** Regularly back up important data to an external hard drive or cloud storage service to protect against data loss due to hardware failure or cyber-attacks. - **Be cautious when clicking links:** Be wary of clicking on links in emails or on websites that you don't trust. These links may lead to phishing scams or malware downloads. - **Use a virtual private network (VPN):** A VPN encrypts your internet traffic and hides your IP address, making it more difficult for hackers to intercept your data. - **Limit access to sensitive information:** Only grant access to sensitive information on a need-to-know basis and ensure that employees are trained on how to handle this information securely. - **Monitor network activity:** Regularly monitor network activity for unusual behavior that may indicate a cyber-attack is underway. - **Develop an incident response plan:** Create an incident response plan that outlines the steps you will take in the event of a cyber-attack or data breach. - **Train employees on cybersecurity best practices:** Educate employees on how to identify and avoid common cyber threats such as phishing scams and malware downloads. ## Major Antivirus Software - McAfee - Norton - Malwarebytes - Symantec - Avast ## Enterprise Environments: - **Group Policies - Least Privilege, Software Installation restrictions, Access and authentications:** - **Security Patches through centralized servers:** - **Monitoring and Reporting Servers:** - **Centralized Antivirus Management:** - **Firewall and proxy servers:** - **IDS(Intrusion Detection Systems) and IPS(Intrusion Prevention Systems):** - **Filtering and data protection utilities – (Ex: RFS, DLP, DES etc.):** - **User Access Control and Security in Browsers:** - **Network Access Protection – Ex: NAC and MAC binding:**