Chapter 4 - Cybersecurity Accessible

Chief Information Security Officer (CISO)

• Plays a role in developing an organization’s policies
designed to protect information assets and technologies
• Advise developing, implementing, and maintaining
processes to minimize IT risks
• Handle security incidents, oversee security tools, and lead
the development and enforcement of security protocols
and practices
• Require (or strongly prefer) a master’s degree: Master of
Business Administration (MBA) or a master’s degree in
cybersecurity

Common Job Responsibilities of a CISO

• Ensure alignment with the strategic direction of the
business
• Examine and report information security risks to meet
compliance and regulatory requirements
• Manage security incidents to protect corporate IT
assets
• Oversee relationships with security related vendors to
ensure they meet security requirement

Generative AI in Cybersecurity

• Can be used to learn from patterns found in cybersecurity
threats and vulnerabilities
• Can be trained on massive data sets of cybersecurity data
• Can be used to identify patterns and trends that aid in
predicting and preventing future cybersecurity threats

cybersecurity threat

an event or condition that has the
potential for causing asset loss and the undesirable
consequences or impact from such loss.

Causes of Asset Loss

situations and events related
to adversity typically referred
to as disruptions, hazards,
or threats

Types of Asset Loss

all forms of intentional,
unintentional, accidental,
incidental, misuse, abuse,
error, weakness, defect,
fault, and/or failure events
and associated conditions

Cybersecurity vulnerabilities

weaknesses or flaws in system
security procedures, design,
implementation, and control that
could be compromised accidentally
or intentionally.

Cybersecurity Exploits

the means through
which a system vulnerability can
be used by a hacker to execute a
malicious activity on a system

Viruses

Software that infects computers and is created using
computer code

Spyware

Software that collects information about a person’s
Internet surfing habits and behaviors.

Impersonation

A social engineering tool in which a hacker plays the role
of someone the target knows or would likely trust,
thereby fooling them into sharing important information.

Distributed Denial
of Service (DDOS)
attack

A cyberattack to make a computer or online service
unavailable to its users. It’s usually accomplished by
flooding the resource with nonsensical or superfluous
requests from multiple sources across the web

Cybersecurity threat mitigation

the policies and
procedures to help prevent against security incidents.Threat Prevention

Threat Prevention

Policies and procedures put in place by an organization
to protect systems and data

Threat
Identification

Security tools and oversight designed to identify
specific and active security threats

Threat Cure

Policies, tools, and strategies used to lessen the impact
of active security threats

Cybersecurity breaches

early-stage intrusions that can
lead to system damage, data loss, and network downtime.

Social Engineering

the
manipulation of people so that
they give up their confidential
information including:
• bank information
• passwords
• access to computers or networks
• Social Security numbers

Social engineering attacks

exploit
individuals’ trust and lack of
knowledge about what types of
information should be divulged

Three Common Cybersecurity
Goals

1. protection of data, information, and
systems
2. preservation of data, information, and
system integrity
3. promotion of the authentication of
data, systems, and information for
authorized users and to prevent
access to unauthorized users

Integrity can be maintained
through a variety of measures,
including:

• user-access controls
• file permission
• version controls

Authentication

a process that
helps an organization to establish
the origin of information or to
determine an individual’s or
entity’s identity.

Authentication methods are
designed to

• prevent unauthorized access to an
organization’s resources
• ensure that those who need access
to data and information receive the
access they need

External Threat Types

The risks are external to the
organization and include
malware, DDoS attacks,
ransomware, viruses, and
phishing attacks designed to
steal information and disrupt
system activities.

External Threat Types

These are threats from inside the
organization and include
accidents and intentional attacks.
• accidents include
accidentally erasing data or
allowing a breach via a social
engineering attack
• intentional attacks include
willful attacks on systems
and data

Spyware

software that collects
information about your Internet
surfing habits and behaviors

The information collected by
spyware includes:

• keystrokes
• passwords
• account numbers
• other confidential information

Spyware is commonly installed

via free downloads or by visiting
certain illegitimate websites

Adware

software that
collects the user’s web
browsing history

Functions of Adware:

• surface advertisements on a
digital device
• forward your search history and
requests to advertising and
social media sites
• collect a variety of marketing
and online behavioral data
about you

Bots

used to perform repetitive jobs with no
malicious intent, such as indexing a search engine or
gathering informa

Web Crawlers

One of the typical “good” bot
uses is to gather information.
Bots used for this purpose
are called web crawlers.

Malware Bots

Uses self-propagating malware
that infects its host and connects
back to a central server.

Ransomware

Malware that makes a computer’s data inaccessible until a
ransom is paid.

Rootkit

a type of malware that
hides in the operating system (OS)
and is triggered each time you boot
your computer.

Rootkits allow

an individual, either
legitimately or maliciously, to gain
control of a digital device or system
and maintain control over the device
or system undetected

keystroke logger / Keyloggers

a
form of spyware/surveillance
technology that records all actions
typed on a keyboard

Computer Viruses Application

It is created using computer code.
Computer viruses typically must be
“run” to attack and do damage

Adverse Impact Computer Viruses

Viruses can destroy programs or
alter the operations of a computer
or network.

Key Condition Computer Viruses

Computer viruses, much like a
biological flu virus, are designed to
spread in hosts and have the ability
to replicate themselves. They
cannot reproduce and spread
without proper programming, such
as that contained in a file or
document.

Trojan Horse

a program that appears legitimate but
executes an unwanted activity when activated.keyloggers can
be used on smartphones, tablets, and laptop computers

A Trojan horse can be used to

• delete data
• block data
• copy data
• modify data
• disrupt computer performance

A man in the middle (MITM)

occurs when a wrongdoer
places themselves in a dialog between a user and a computer
application.

Goal of an Attack MitM

these attacks are designed to steal a variety of digital personal
information including login and account information and credit
card numbers

Targets

MitM attacks are often targeted to the users of financial service
applications where a login is required including banks and credit
card companies, SaaS businesses, and online shopping sites

Man-in-the-Phone Attacks
(also termed as Man-in-the-
Mobile Attacks, or MitMo
attacks)

a new type of digital
attack that has recently emerged
due to the advancement and
proliferation of smartphones as
primary computing devices.
This malware allows a
perpetrator unauthorized access
to a device which gives them the
ability to monitor activity on the
device.

Kerberoasting attacks

type of cyberattack that targets the
Kerberos authentication protocol used within Windows Active
Directory environments.

brute force attack

a type of cyberattack where a hacker
guesses information such as a usernames and passwords to
access a private system.

How do these Kerberoasting attacks occur?

1. Attackers identify service
accounts within the Windows
Active Directory.
2. Attacker can request Ticket
Granting Service (TGS) tickets
from the Kerberos Key
Distribution Center.
3. Attacker extracts the TGS
tickets from memory on their
own compromised account or
machine.
4. Attacker can use credentials to
gain unauthorized access to
sensitive systems or data.

How to prevent a kerberoasting
attack?

• Use strong and complex
passwords
• Regularly change service
account passwords
• Implement least privilege
access
29

insider

any individual that has
knowledge of or authorized access to an organization’s IT
resources.

Threats can manifest through the following insider behaviors

• Espionage
• Terrorism
• Unauthorized access
• Workplace violence
• Intentional or unintentional loss or degradation of departmental
resources or capabilities

Intentional Insider Threats

Occur when an individual takes adverse actions for
personal benefit or grievance

Unintentional Insider Threats

Are the result of negligence or accidental
circumstances.

Other Insider Threats

• Include collusive and third-party threats. Collusive
threats are a type of insider threat whereby insiders
collude with outside parties to compromise the
organization.
• Third-party threats occur when people outside of the
organization that have been given access to
resources either intentionally or unintentionally
compromise security measures

SQL Injection

deployed via the web and designed to exploit
security weaknesses that allow the attacker to compromise databases
and data-driven applications.

Input Validation

User input is validated according to the
expected format.

Prepared Statements and Parameterized Queries

This
tactic helps to ensure that an attacker cannot change the intent
of a query, even if SQL commands are inserted by an attacker.

Frequent Testing

Tools and practices, such as penetration
testing, to regularly search for and fix vulnerabilities within the
application

Educating Developers

Ensuring that developers are aware
of the risks associated with SQL injection and the best practices
for preventing it

confidentiality

covers privacy and seeks to
avoid the unlawful exposure of personal and organizational
information.

The tools to ensure confidentiality
include

• access control
• user authentication
• user authorization
• physical security

availability

deals with ensuring data and
system infrastructure are available when needed.

Data in Transit

• in transit through networks (cellular, Wi-Fi, or other networks), or
• located in RAM (random access memory)

Protecting Data in Transit

the definition of data in transit is frequently used in the language
concerning many laws and regulations and addresses another key
area where data should be secured

Data At Rest

all data in computer storage. This
excludes data that is traveling on a network or that is
temporarily housed in computer memory (RAM) waiting for
execution.

Examples of data at rest include

• the files an organization stores on hard drives of individual computers
• files stored on internal storage hardware
• files on the servers by an offsite backup service provider
• files stored by cloud service/storage providers

Data In Process

Refers to data that is actively being processed and is not in
storage.
Common types of data in process:
• account balances
• usernames
• account information

The Federal Computer Fraud and Abuse Act (CFAA) prohibits a variety of activit

• unauthorized access (or exceeding authorized access) to a computer
• unauthorized access to a computer being used in interstate or foreign
commerce
• damaging a computer either recklessly or intentionally
• transmitting threats of extortion, and cyber extortion

National Conference on State Legislatures
(NCSL) Some of the key areas of legislative activity include:

• restructuring government for increased cybersecurity
• addressing the security of Internet-connected devices
• addressing cybersecurity threats in elections
• providing security for utilities and critical infrastructures

General Data Protection Regulation (GDPR)

This law regulates how companies protect the personal data
of citizens of the European Union (EU).

General Data Protection Regulation (GDPR) requirements include

• requiring the consent of subjects for data processing
• anonymizing collected data to protect privacy
• providing notifications of data breaches
• safe handling of data across country borders
• requiring that certain companies appoint a data protection officer to
oversee GDPR compliance

California’s SB-327 for IoT (Internet of Things) Security terms are:

• defined, to equip the device with a reasonable security feature or
features that are appropriate to the nature and function of the device
• appropriate to the information it may collect, contain, or transmit
• designed to protect the device and any information contained therein
from unauthorized access, destruction, use, modification, or
disclosure, as specified

Due to limited resources, organizations must:

• calculate their cybersecurity threats
• determine the value it will cost to protect against these threats
In order to determine the cost of security, a calculation of
Probable Maximum Loss (PML) is executed.

The purpose of risk analysis is to identify:

• An organization’s assets
• The potential loss to an organization due to threats
• How to best respond to a loss of data, information, and infrastructure

Risk analysis consists of five steps:

1. The organization assigns values to their information
assets including data, information, and infrastructure
2. They estimate the potential losses per security risks. This includes:
1. Costs associated with a malware attack
2. Costs due to fines and penalties from a security breach
3. Lost revenue due to system downtime.
3. Once the potential losses have been calculated, an estimate of the
likelihood of each type of risk or breach is calculated.
4. Costs are analyzed to create a range of potential costs to the
organization.
5. After careful analysis, the organization makes decisions about
appropriate countermeasures and the policies and procedures that
should be implemented

National Institute of Standards Technology (N IST)
Cybersecurity Framework

designed to assist
organizations in the development of cybersecurity policies and
procedures to protect against cyber threats and intrusions.

According to NIST, the framework is voluntary guidance for
organizations based on

• existing standards
• guidelines
• practices

Identify (ID) function

creates a
call to action for companies to develop a framework for how to
manage cybersecurity risks associated with the systems,
data, hardware, and capabilities that comprise their IT
infrastructure

Five Categories in the ID Function

1. Asset management
2. Business environment
3. Governance
4. Risk assessment
5. Risk management strategy

Protect (PR) function of the NIST
Cybersecurity Framework

• limiting and controlling secure access to systems and digital assets,
both physical and digital
• creating policies and procedures to prevent unauthorized access

Detect (D E) function

the development and implementation of
activities to identify the occurrence of a cybersecurity event,
with a focus on supporting the timely discovery of such events

Three Categories in the DE Function

1. Analysis of anomalies or events
2. Continuous monitoring of systems
3. Processes to detect events

Respond (RS) function

to establish and put in place the
necessary procedures that enable stakeholders to take action
regarding a detected cybersecurity event.

The five categories included in the R S function

• response planning
• communications about the issue
• analysis of the issue
• mitigation of the issue
• improvements to security as a result of the issue

Recover (RC)
function

an organization’s ability to develop and implement
the appropriate activities to maintain plans for resilience and to
restore any capabilities or services that were impaired due to a
cybersecurity event.

The RC function is broken down into three categories that
includ

• recovery planning to ensure restoration of systems
• improvements to existing security measures and processes that result
from an issue
• communications with internal and external stakeholders about the
circumstances of the issue and the remediation that took place

Common methods of identity verification include

Two-Factor Identification (2FA)
• Knowledge-Based Authentication (KBA)
• Multi-Factor Authentication (MFA)
• Biometric Verification
• Token-Based Authentication

Firewalls

Systems that control incoming and outgoing network
traffic based on predetermined security rules

Intrusion Detection Systems (IDS) and Intrusion Prevention
Systems (IPS)

Designed to monitor networks and systems for
malicious activities.
• IDS’s generate alerts for suspicious activities.
• IPS’s are designed to block detected threats actively.

Multifactor Authentication

A method of securing networks
requiring two or more verification factors to access a resource.
Combines something the user knows (a password) with something the
user has (a security token).

Steps in a Cybersecurity Plan

Step 1: Assess the Landscape
Step 2: Define Goals and Develop Policies and Procedures
Step 3: Identify and Enact IT Defenses
Step 4: Create Incidence Response and Recovery Plans
Step 5: Address Legal and Compliance Requirements
Step 6: Train Personnel
Step 7: Monitoring and Assessment

Steps for acquiring and implementing cybersecurity software

• Needs assessment
• Budget and cost analysis
• Research and selection
• Evaluate vendors
• Deployment and maintenance

Supply chain attacks

occur when an entity infiltrates an IT
system through an outside partner (such as a vendor) or
provider (such as a network provider) with access to
organizational systems and data

Third-party
Vulnerabilities of Supply Chain Attacks

Attackers exploit vulnerabilities in third-party software or
hardware components that are integrated into the target
organization's IT environment.

Stealth of Supply Chain Attacks

These attacks are often difficult to detect because they
exploit the trust between a company and its suppliers or
service providers.

Extensive
Impact of Supply Chain Attacks

Organizational supply chains are often interconnected
across the globe. A single compromised component of
the supply chain can affect multiple organizations across
multiple industries.

Hybrid environments

IT infrastructures that combine cloud-based
services with on-premises computing resources.

Generative AI (GenAI)

Offers productivity gains, skills gap
reduction, and better monitoring for threats

Outcome-Driven Metrics (ODM’s)

Measure the outcome of
investment in security measures