Cybersecurity Terms and Data Privacy Laws: Key Concepts for Organizations

The Privacy Amendment (Notifiable Data Breaches) Act 2017

Requires organizations covered by the Privacy Act to notify affected individuals and the Australian Information Commissioner of data breaches that are likely to result in serious harm

Serious harm includes unauthorized access, disclosure or loss of personal information

They must notify and recommend steps to mitigate potential harm

Phishing

Cybercriminals deceive individuals into providing sensitive information such as login credentials or financial details by pretending to be trustworthy entities

Denial of Service:

Makes a network or service unavailable to its intended users by overwhelming it with a flood of illegitimate requests

Defending it involves traffic monitoring, rate limiting, and using special protection services

Back Door

Cybercriminals use a hidden entry point into a computer system or network that bypasses normal authentication mechanisms to gain remote unauthorised access

Mitigate back door attacks by regularly updating software, conducting security audits and using intrusion detection systems

IP Spoofing

An attacker disguising their IP address as that of a trusted source to gain unauthorised access to a network or system

To prevent it, implement robust authentication mechanisms and packet filtering techniques

SQL Injection

An attack where malicious SQL statements are inserted into an input field for execution by a database

Prevent it by sanitising input fields

Man in the Middle

When an attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other

To protect against it, use strong encryption protocols, secure communication channels and vigilant network monitoring

Cross Site Scripting

A vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. When a victim visits the compromised page, the script executes in their browser, potentially stealing cookies or session tokens

To protect against it, use proper input validation, output encoding and security headers

Ransomware

Encrypts or locks files on a device, preventing the owner from accessing them. Attackers then demand a ransom in exchange for the decryption key

Viruses

A type of malicious code that attaches itself to a legitimate file or program, spreading when the infected file is executed

Spyware

A software that secretly monitors and collects information about a user's activities without their consent

Worms

Self replicating malware that spreads through networks without needing to attach to files or programs

Trojan Horses

Disguises itself as legitimate software but delivers malicious code once installed. They don't replicate themselves but can create openings for attackers

Adware

Automatically delivers advertisements

Physical Network Threats

Damage or disruption to network infrastructure through physical means

Can include unauthorised access to hardware, theft of devices, tampering with equipment, or destruction due to environmental factors like fire or flooding

Zero Day vulnerabilities

Unknown security flaws in software or hardware that have not yet been patched by the vendor. The developer isn't aware of the vulnerability, so attackers can exploit it

Internal network threats

Threats originating from within the organisation, including current or former employees, contractors, business partners or anyone who has or had legitimate access to the network

Lost or stolen devices

Compromised credentials

Misuse by employees

Lost or stolen devices

Misplaced devices pose a significant threat if they contain sensitive data

Can be prevented by installing tracking services

Compromised Credentials

Stolen usernames and passwords allow unauthorised access to a network and sensitive systems

Can be prevented by security training

Misuse by Employees

Employees with legitimate access misusing their privileges intentionally or unintentionally, leading to data leaks and policy violations

Prevented by security training and awareness programs

Analysis of Log files

Helps detect and respond to security incidents by providing insights into network activities and identifying anomalies

Monitoring logs helps pinpoint unauthorised access attempts, potential breaches and performance issues

Antimalware

Protects systems from malicious software, including viruses, trojans and ransomware. It scans and removes malware, preventing it from causing damage or stealing data

Firewall Filtering

Controls incoming and outgoing network traffic based on predefined security rules. It acts as a barrier between trusted internal networks and untrusted external networks

Access Control List

Manages permissions by specifying who can access certain resources and what actions they can perform

Intrusion prevention systems

Monitor network traffic to detect and prevent potential threats in real time

Virtual private networks

Encrypt internet connections, ensuring secure communications between remote users and the organisation's network

User training

Educates employees about cybersecurity best practices and how to recognise and respond to potential threats

ICT code of conduct

Outlines acceptable use policies and security protocols for information and communication technologies

Physical security

Protects the organisation's hardware, data centres, and other critical infrastructure from unauthorised access and physical damage

Solution to social engineering

Conduct regular user awareness training on identifying phishing attempts

Solution to denial of service

Use DDoS protection services such as cloud based mitigation to absorb and filter malicious traffic

Solution to backdoor

Regularly conduct security audits to identify and close unauthorised access points

Solution to IP spoofing

Use packet filtering and firewalls to verify the legitimacy of IP addresses in network traffic

Solution to SQL injection

Sanitise and validate user inputs to prevent injection

Solution to man in the middle attacks

Use strong encryption for all data in transit and use VPN

Solution to cross site scripting

Sanitise and validate user inputs on web applications

Solution to types of malware

Deploy antivirus and antimalware software across all endpoints with real time scanning capabilities

Solution to physical network threat

Implement strict physical security controls, such as surveillance, secure access points, and restricted access to server rooms

CIA

Confidentiality, ensuring information is only accessible to authorised users

Integrity, ensuring information remains accurate and has not been altered without permission

Availability, ensuring information and systems are accessible when needed

AAA

Authentication, verifying a user's identity before they are granted access to a system

Authorisation, what an authenticated user is allowed to access

Accounting, recording and monitoring user activities with a system

Symmetric encryption

Where the same key is used for both encrypting and decrypting data. The sender and receiver must both have access to a shared secret key which is used to encode the plaintext into ciphertext for secure transmissions and decode it back

Types of symmetric encryption algorithms

AES (Advanced Encryption Standard), widely used and very secure

DES (Data Encryption Standard), older encryption standard with a smaller key

Advantages and disadvantages of symmetric encryption

Advantage:

Fast

Simple

Disadvantage:

Key distribution

Scalability

Asymmetric encryption

Uses a pair of keys for encryption and decryption, a public and private. The public key is shared openly while the private key is kept secret. Two keys that are linked are generated. The public key is used to encrypt and only the person with the right private key can decrypt it

Common Asymmetric encryption algorithms

RSA, most widely used algorithms, supports various key sizes

DSA (Digital Signature Algorithm) ; used for digital signatures, ensures data integrity and authenticity

Advantages and disadvantages of asymmetric encryption

Advantage:

Easier and more secure key distribution

Is scalable

Disadvantage:

Slower

More complex

Use of asymmetric encryption

Prevent unauthorised access

Use digital signatures

Authenticate data being sent

Digital certificates

Used to verify the authenticity of a public key

Prevents man in the middle attacks

How to securely communicate

Use asymmetric encryption to send a symmetric key

Methods of encryption

Substitution cipher swaps out characters

Easily broken using frequency

Vigenère uses a repeated key combining plain text with the key

Easily broken if the length of key is known

Data Encryption Standard (DES) first digital encryption standard with small key size

Advanced Encryption Standard (AES) larger key size and not yet cracked

Best practice for encryption

Secure private key

Back up your key

Use longer length key

Role of ethical hacking

Identify vulnerabilities

Assess security controls

Provide recommendations

Enhance incident response preparedness

Compliance and regulatory requirements

Role of blue team in penetration testing

The defenders responsible for maintaining and defending the network

Role of red team in penetration testing

The attackers hired to simulate real world threats. Their role is to highlight vulnerabilities in the network

ODBC

Open Database Connectivity is a standard API that allows applications to access various database management systems using a common interface

ACID

Atomicity ; ensures a transaction is fully completed or isn't even started

Consistency ; data follows the rules set by the database

Isolation ; transactions occur separately and don't affect other unrelated ones

Durability ; ensures that once a transaction has been committed it is permanent

Referential integrity

Ensures all foreign keys correspond to a valid primary key

Domain integrity

Ensures data follows a defined set of valid values

Entity integrity

Each record has a unique, not null primary key

Currency

How up to date the data is

Authenticity

The genuineness and verifiability of the data

Relevance

How pertinent and applicable the data is for the task

Outliers

Data points that deviate significantly from other observations

Purpose of normalisation

Reduces data redundancy and ensures data integrity. It facilitates efficient querying, updates, and maintenance of databases

Purpose of cleaning and manipulating data

To ensure it is accurate, consistent, and suitable for use

Use of data mining

It can inadvertently reveal sensitive information leading to privacy breaches. You have to ensure individuals are aware and have consent to the possibility of data breach

Privacy Act of 1988

Regulates the handling of personal information by government agencies and private sector organisations

APP 5

Tell people why their information is being collected

APP 8

Protect personal information sent overseas

APP 10

Ensure personal information is accurate and up to date

APP 11

Keep personal information secure

APP 12

Allow people to access their own information

SQL create table

CREATE TABLE table_name (

column1 datatype constraint,

column2 datatype constraint,

...

);

SQL drop table

DROP TABLE IF EXISTS table_name;

SQL insert

INSERT INTO table_name (column1, column2, column3, ...)

VALUES (value1, value2, value3, ...);

SQL update

UPDATE table_name

SET column1 = value1, column2 = value2, ...

WHERE condition;

SQL delete

DELETE FROM table_name

WHERE condition;

SQL alter table

Can be used to add column, drop column, rename column, modify column, and rename table

ALTER TABLE table_name

ADD column_name datatype;

ALTER TABLE table_name

DROP COLUMN column_name;

ALTER TABLE table_name

RENAME COLUMN old_name TO new_name;

ALTER TABLE table_name

ALTER COLUMN column_name new_datatype constraint;

ALTER TABLE table_name

RENAME TO new_table_name;