The Need For Cybersecurity PDF

Summary

This document covers cybersecurity concepts, information systems security, and how cybersecurity protects people and businesses. It explores the need for cybersecurity, the motivations behind cybercrimes, and the different domains of an IT infrastructure.

Full Transcript

The Need For Cybersecurity Course: CYB105 Instructor –Stacy Nicholson This Photo by Unknown Author is licensed under CC BY-NC Learning Objective(s) and Key Concepts Learning Objective(s) Key Concepts ▪ Explain cybersecurity and its effect on...

The Need For Cybersecurity Course: CYB105 Instructor –Stacy Nicholson This Photo by Unknown Author is licensed under CC BY-NC Learning Objective(s) and Key Concepts Learning Objective(s) Key Concepts ▪ Explain cybersecurity and its effect on ▪ Cybersecurity concepts people and businesses. ▪ Information systems security concepts ▪ Confidentiality, integrity, and availability (C-I-A) ▪ The seven domains of an IT infrastructure ▪ The weakest link in the security of an IT infrastructure ▪ IT security policy framework and data classification standard What is Cybersecurity? ▪ The body of technologies, processes, and practices, designed to protect networks, devices, programs, and data from attack, damage or unauthorized access.1 ▪ Cybersecurity covers preventative strategies applied to protect information from being stolen, compromised or attacked.2 Source1- Digital Guardian Source2- Cybersecurity Fundamental textbook Motivation behind Cybercrimes ▪ Financial gain ▪ Data is valuable ▪ Political gain ▪ Exploit Systems ▪ Taking technical challenge ▪ Seeking new knowledge ▪ Damage a business or individuals This Photo by Unknown Author is licensed under CC BY-SA ▪ Etc. Need for Cybersecurity ▪ Major concerns for the entire world ▪ Cybercrimes are rising ▪ Businesses and individuals face cybersecurity threats ▪ Your data is valuable ▪ Threaten by criminals, hackers and terrorists – they perform malicious activities – e.g., data and identity theft, DOS attack, unauthorized access, financial frauds , etc. ▪ IoT devices and mobile phones exploited. ▪ Applications Software ▪ Etc. Cybersecurity Cont. ▪ Internet of Things (IoT) connects personal devices, home devices, and vehicles to the Internet ▪ More data to steal ▪ Cybersecurity is duty of every government that wants to ensure its national security ▪ Data security is the responsibility of every organization that needs to protect its information assets and sensitive data copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. IoT copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Cyberspace: The New Frontier copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Data versus Information ▪ Data ▪ Information ▪ Refers to unprocessed facts ▪ Refers to processed data that give meaningful results to the user. ▪ Contains numbers, letters, characters and multimedia ▪ Processed information can be stored in some context for its intended objects. receiver(s). ▪ Data is used as input for computer system to generate information. copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Risks, Threats, and Vulnerabilities ▪ Risk ▪ The level of exposure to some event that has an effect on an asset ▪ Threat ▪ Any action, either natural or human induced, that could damage an asset ▪ Vulnerability ▪ A weakness that allows a threat to be realized or to have an effect on an asset copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. What Is Information Systems Security? ▪ Information system ▪ Hardware, operating system, and application software that work together to collect, process, and store data for individuals and organizations ▪ Security ▪ Being free from danger or risk ▪ Information systems security ▪ The collection of activities that protect the information system and the data stored in it copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. What Are We Securing? copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Compliance Laws and Regulations Drive the Need for Information Systems Security copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Tenets of Information Security ▪ Confidentiality ▪ Only authorized users can view information ▪ Integrity ▪ Only authorized users can change information ▪ Availability ▪ Information is accessible by authorized users whenever they request the information copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Confidentiality (1 of 2) Confidential information includes: ▪ Private data of individuals ▪ Intellectual property of businesses ▪ National security for countries and governments copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Confidentiality (2 of 2) ▪ Cryptography ▪ Practice of hiding data and keeping it away from unauthorized users ▪ Encryption ▪ The process of transforming data from cleartext into ciphertext ▪ Ciphertext ▪ The scrambled data that results from encrypting cleartext copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Encryption of Cleartext into Ciphertext copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Integrity ▪ Maintain valid and accurate information copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Availability ▪ In the context of information security ▪ The amount of time users can use a system, application, and data ▪ Availability Time Measurements ▪ Uptime ▪ Downtime ▪ Availability [A = (Total Uptime)/(Total Uptime + Total Downtime)] ▪ Mean time to failure (MTTF) ▪ Mean time to repair (MTTR) ▪ Mean time between failures (MTBF) ▪ Recovery point objective (RPO) ▪ Recovery time objective (RTO) copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Seven Domains of a Typical IT Infrastructure copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. User Domain ▪ Roles and tasks ▪ Users can access systems, applications, and data depending upon their defined access rights ▪ Responsibilities ▪ Employees are responsible for their use of IT assets ▪ Accountability ▪ Human resources department is accountable for implementing proper employee background checks copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Common Threats in the User Domain ▪ Unauthorized access ▪ User destroying systems, applications, and data ▪ Lack of user awareness ▪ Disgruntled employee attacking ▪ User apathy toward policies organization or committing sabotage ▪ Security policy violations ▪ Employee romance gone bad ▪ User inserting CD/DVD/USB with ▪ Employee blackmail or extortion personal files ▪ User downloading photos, music, or videos copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Workstation Domain ▪ Roles and tasks ▪ Configure hardware, harden systems, and verify antivirus files ▪ Responsibilities ▪ Ensure the integrity of user workstations and data ▪ Accountability ▪ Ensure that the Workstation Domain conforms to policy copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Common Threats in the Workstation Domain ▪ Unauthorized workstation access ▪ Unauthorized access to systems, applications, and data ▪ Desktop or laptop operating system and software vulnerabilities ▪ Desktop or laptop application software vulnerabilities and patches ▪ Viruses, malicious code, and other malware ▪ User inserting CD/DVD/USB with personal files ▪ User downloading photos, music, or videos ▪ Security risk due to user violation of acceptable use policy (AUP) ▪ Bring Your Own Device (BYOD) copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Local Area Network (LAN) Domain ▪ Consist of two or more computers in a relatively small coverage area like a single office, building, and campus. ▪ Roles and tasks ▪ Includes both physical network components and logical configuration of services for users ▪ Responsibilities ▪ Physical components and logical elements ▪ Accountability ▪ Maximize use and integrity of data within the local area network (LAN) Domain copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Common Threats in the LAN Domain ▪ Unauthorized access to LAN ▪ Unauthorized access to systems, applications, and data ▪ LAN server operating system software vulnerabilities ▪ LAN server application software vulnerabilities and software patch updates ▪ Unauthorized access by rogue users on wireless LANs (WLANs) ▪ Compromised confidentiality of data on WLANs ▪ LAN servers with different hardware, operating systems, and software make them difficult to manage and troubleshoot copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. LAN-to-WAN Domain ▪ Roles and tasks ▪ Includes both the physical pieces and logical design of security appliances; physical parts need to be managed to give easy access to the service ▪ Responsibilities ▪ Physical components, logical elements, and applying the defined security controls ▪ Accountability ▪ Ensure that LAN-to-Wide Area Network (WAN) Domain security policies, standards, procedures, and guidelines are used copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Common Threats in the LAN-to-WAN Domain ▪ Unauthorized network probing and port scanning ▪ Unauthorized access through the LAN-to-WAN Domain ▪ Denial of service (DoS)/distributed denial of service (DDoS) attacks ▪ IP router, firewall, and network appliance operating system vulnerability ▪ IP router, firewall, and network appliance configuration file errors or weaknesses ▪ Remote user download of sensitive data ▪ Download of unknown file type attachments from unknown sources ▪ Unknown email attachments and embedded URL links received by local users ▪ Lost productivity due to local users surfing the web copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Wide Area Network (WAN) Domain ▪ Connects computers to a larger geographical area. ▪ Roles and tasks ▪ Allow users the most access possible while making sure what goes in and out is safe ▪ Responsibilities ▪ Physical components and logical elements ▪ Accountability ▪ Maintain, update, and provide technical support and ensure that the company meets security policies, standards, procedures, and guidelines copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Common Threats in the WAN Domain (Internet) ▪ Open, public, and accessible data ▪ Most Internet traffic sent as cleartext ▪ Vulnerable to eavesdropping ▪ Vulnerable to malicious attacks ▪ Vulnerable to DoS and DDoS attacks, TCP synchronize (SYN) flooding, and IP spoofing attacks ▪ Vulnerable to corruption of information/data ▪ Insecure Transmission Control Protocol/Internet Protocol (TCP/IP) applications ▪ Hackers, attackers, and perpetrators email Trojans, worms, and malicious software copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Common Threats in the WAN Domain (Connectivity) ▪ Commingling of WAN IP traffic on the same service provider router and infrastructure ▪ Maintaining high WAN service availability ▪ Maximizing WAN performance and throughput ▪ Using Simple Network Management Protocol (SNMP) applications and protocols maliciously (ICMP, Telnet, SNMP, DNS, etc.) ▪ SNMP alarms and security monitoring 24/7/365 copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Remote Access Domain ▪ Roles and tasks ▪ Connect mobile users to their IT systems through the public Internet ▪ Responsibilities ▪ Maintain, update, and troubleshoot the hardware and logical remote access connection ▪ Accountability ▪ Ensure that the Remote Access Domain security plans, standards, methods, and guidelines are used copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Common Threats in the Remote Access Domain ▪ Brute-force user ID and password attacks ▪ Multiple logon retries and access control attacks ▪ Unauthorized remote access to IT systems, applications, and data ▪ Private or confidential data compromised remotely ▪ Data leakage in violation of data classification standards ▪ A mobile worker’s laptop is stolen ▪ Mobile worker token or other authentication stolen copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. System/Application Domain ▪ Roles and tasks ▪ Includes hardware, operating system software, applications, and data and includes logical design ▪ Secure mission-critical applications and intellectual property assets both physically and logically ▪ Responsibilities ▪ Server systems administration, database design and management, designing access rights to systems and applications, and more ▪ Accountability ▪ Ensure that the System/Application Domain is in compliance with security policies, standards, procedures, and guidelines copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Common Threats in the System/Application Domain ▪ Unauthorized access to data centers, ▪ Unauthorized access to systems computer rooms, and wiring closets ▪ Data breach where private data is ▪ Downtime of servers to perform compromised maintenance ▪ Corrupt or lost data ▪ Server operating systems software vulnerability ▪ Loss of backed-up data as backup media are reused ▪ Insecure cloud computing virtual environments by default ▪ Recovery of critical business functions potentially too time consuming to be ▪ Susceptibility of client-server and web useful applications ▪ Downtime of IT systems for an extended period after a disaster copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Weakest Link in the Security of an IT Infrastructure ▪ Humans are the weakest link in security ▪ Strategies for reducing risk: ▪ Check background of job candidates carefully ▪ Evaluate staff regularly ▪ Rotate access to sensitive systems, applications, and data among staff positions ▪ Test applications and software and review for quality ▪ Regularly review security plans ▪ Perform annual security control audits ▪ Etc. copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Ethics and the Internet ▪ Human behavior online is often less mature than in normal social settings ▪ Demand for systems security professionals is growing rapidly ▪ U.S. government and Internet Architecture Board (IAB) defined a policy regarding acceptable use of Internet geared toward U.S. citizens ▪ Policy is not a law nor mandated ▪ Systems security professionals are responsible for is doing what is right and stopping what is wrong copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. IT Security Policy Framework ▪ Policy ▪ A short written statement that defines a course of action that applies to entire organization ▪ Standard ▪ A detailed written definition of how software and hardware are to be used ▪ Procedures ▪ Written instructions for how to use policies and standards ▪ Guidelines ▪ Suggested course of action for using policy, standard, or procedure copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Hierarchical IT Security Policy Framework copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Foundational IT Security Policies ▪ Acceptable use policy (AUP) ▪ Security awareness policy ▪ Asset classification policy ▪ Asset protection policy ▪ Asset management policy ▪ Vulnerability assessment/management policy ▪ Threat assessment and monitoring policy copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Data Classification Standards (1 of 2) ▪ Private data ▪ Data about people that must be kept private ▪ Confidential ▪ Information or data owned by the organization ▪ Internal use only ▪ Information or data shared internally by an organization ▪ Public domain data ▪ Information or data shared with the public copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Data Classification Standards (2 of 2) U.S. federal government data classification standards: ▪ Top secret ▪ Applies to information that the classifying authority finds would cause grave damage to national security if it were disclosed ▪ Secret ▪ Applies to information that the classifying authority finds would cause serious damage to national security if it were disclosed ▪ Confidential ▪ Applies to information that the classifying authority finds would cause damage to national security copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com. Summary ▪ Cybersecurity concepts ▪ Information systems security concepts ▪ Confidentiality, integrity, and availability (C-I-A) ▪ The seven domains of a typical IT infrastructure ▪ The weakest link in the security of an IT infrastructure ▪ IT security policy framework and data classification standards copyright@2023 by Jones & Bartlett Learning, LLC an Ascend Learning Company. www.jblearning.com.

Use Quizgecko on...
Browser
Browser