Aerospace Module 7 - Cyber Security

Cyber

Characteristics of computers, information technology, and virtual reality

Space in Cyberspace Context

An abstract idea of virtual environment rather than a physical space

Cyberspace

The environment that allows digital technology to communicate with one another via the Internet

Network

A channel that links two or more devices

Node

A connecting point that relays information along a distribution network

Packet Switching

A process of arranging data into small units to be transmitted over a digital network; helps prevent network overloading and maintain efficiency

Client-Server Network

A network allowing a client to send a request to the server for the server to grant that request. The communication method is via messages in real-time request-response patterns

Client

A device that requests access from a server

Server

A computer program or device that manages and provides sharable resources to a client

Internet

A worldwide collection of different networks connecting millions of devices allowing communication; backbone of cyber space; First iteration called ARPANET created Sept. 1969

Cyber Security

The collection of security tools, policy, and practices that protect the cyberspace environment and its users

Cyber Security concepts

Information Security, Network Security, Endpoint Security, Website Security, Application Security

Cyber Crime

Crime that involves a computer and/or network

Cybercriminal

Someone who conducts illegal activity using computers or other digital technology

Cyber Warfare

Using technology to attack a nation via network

Cyber Ethics

A set of moral, legal, and social principles that applies a computer users behavior

Guidelines for practicing good cyber ethics

1. Do not use offensive language or hateful speech

2.Do not cyberbully

3. Do not plagiarize

4. Do not use someone else's password without permission

5. Do not attempt to infect someone else's computer

6. Avoid infringing on someone's copyright when downloading material from the internet

Cyberattacks

Malicious attempts by hackers to damage, steal, or destroy a computer network or system by exploiting its vulnerabilities

Computer Virus

Software application that disguises itself as an innocent program, produces copies of itself to insert into other software application, and runs a malicious action

Malware

Malicious software variants that disrupt, damage, or gain unauthorized access to a computer system

Computer Worm

A standalone self-replicating software application that invades computers on a network and usually performs a destructive action

Morris Worm

Earliest significant worm infection

Released by Robert Morris in 1988

Spyware

Software that allows an attacker to obtain information about another's computer activities

Ransomware

A type of malicious software that attackers use to block access to a computer system until the user pays ransom money

Trojan

Malicious software that looks legit but can take control of the computer

Adware

Software that automatically displays or downloads advertising material when online

Denial of service attack (DoS)

A cyber attack in which the perpetrator seeks to make a machine or network resource unavailable or to disrupt services connected to the Internet

Phishing

A practice of sending out fraudulent information posing as someone else to deceive individuals into revealing personal information (eg. passwords and credit card numbers)

Characteristics of Phishing

1. The email sound too good to be true (eg. offering a reward)

2. You do not recognize the sender

3. The emails pressure you to react without thinking by including phrases like "Act Now" or "Immediate Action Required"

4. The message contains odd or unexpected attachments.

5. The message contains text or URLs that look suspicious (eg. misspelling)

6. The logo of the sending organization does not look exactly right (eg. has a different font or misspelled)

Social Engineering

The practice of manipulating people into revealing confidential, personal information

Eavesdropping

Happens when an unauthorized user intercepts a private communication (eg. a phone call, instant message, video conference, or email)

Sniffing

The process of capturing all data packets passing through a network

Hacking

The act of using a computer to gain unauthorized access to data in a system

Hackers

Someone unauthorized who hacks into a system

Black hat hackers

Criminals who break into computer networks and systems with malicious intent

White hat hackers

"Good" people who use their computing skills for ethical legal reasons

Ethical Hacking

An act of performing penetration tests on a system or network to find loopholes and vulnerabilities that a malicious attacker might use to cause loss or damages

Grey hat Hackers

"Neutral" peopel who sometimes violates laws of ethical standards, but does not have the malicious intent of a black hat hacker

Keylogger

A tool that records every keystroke on a computing device

Session Hijacking

Occurs when an unauthorized user takes over an active communications session without the user's permission

Vulnerability Scanner

Software that detects weaknesses in computers, networks, and applications

Brute Force Attack

An attacker who submits many passwords with the hope of eventually guessing correctly

Privacy

The right to be free from being observed or disturbed by other people

Internet Privacy

The ability for users to control what information is accessible to others online

Personally Identifiable Information (PII)

Personal information that can be used to identify an individual (eg. phone number, address, social security number, email address, and photographs.)

Privacy Risks

Weaknesses that allow attackers to compromise a users privacy

Events that could increase privacy risks

1. Browsing the web - Device's privacy compromised

2. Emailing - Email hijacking

3. Online shopping - Credit card number put at risk

Web Browser

A software application used to access websites on the Internet

Computer Cookies

Small text files created by a web browser that store information to track a user's activity on a website

First-party Cookies

Computer cookies created by a website that is visited by a user

Third-party Cookies

Computer cookies created by websites that are not directly visited by a user. They have the ability to track across multiple websites

Session Cookies

Allows a website to store information across different pages within the site so the user does not have to repeatedly enter the same information

8 Ways to protect your privacy on the Internet

1. Check the company's privacy Settings

2. Take care when storing private info in a cloud storage location

3. Avoid online tracking on shared devices

4. Use a secondary email to sign-up for websites

5. Use messaging apps with end to end Encryption

6. Use secure Passwords

7. Review permissions for mobile apps and websites

8. Use a VPN when accessing public Wi-Fi networks

Incognito mode

Web browsing feature that prevents browser history from being stored on the user's device

End-to-End Encryption

A communication method that prevents unauthorized access to data while it is in transit between systems

Weak Password

A password that is easily guessed by a human or computer

Virtual Private Network (VPN)

Internet connection that encrypts traffic from a device to a private network

Digital Footprint

A trail of data created by a user through online activity

Active Footprint

A trail of data intentionally left behind by a user who is deliberately sharing info about themselves on websites

Passive Footprint

A trail of data unintentionally left behind by a user without that user's knowledge

Ways to create a good digital footprint

1. Delete inactive accounts

2. Think before posting anything personal

3. Use privacy settings to restrict personal data to close friends or family

Metadata

Descriptive data that contains information about other data

Online Usage

Data flowing between a user's computer and the internet

Online Reputation

A Collection of data that describes an entity (eg. a company person product of service)

Cyber Bullying

Harassment using electronic communication with the intent to harm

Cyber Stalking

The use of electronic communications to harass or stalk someone

Cyber Predator

An individual who exploits people via the internet intending to cause harm

Ways to Fight Cyber Predators

1. Avoid revealing sensitive info (eg. name address)

2. Do not communicate with strangers or suspicious users

3. Never meet someone you do not know in person

4. Report inappropriate behavior to the website

5. Avoid using suggestive usernames of photos in your profile that could attract unwanted attention

Cyber Trolling

Harassment targeted at an individual, relies on the engagement of other users to provoke the victim

Ways to Prevent Cyberbullying

1. Do not share passwords or other account info

2. Only post phots that are deemed appropriate

3. Think before posting anything that could negatively impact your online reputation

4. Set Up Privacy Controls

5. Check your digital footprint by searching yourself on major search engines to monitor the accessibility of personal info

6. Never open messages from unknown users

7. Report the incident to the authorities

Computer Science

The study of computing systems and their functionality

Cyber Security Degree Programs

A degree program at a college or university that provide formal training and experience

Cyber Security Certifications

A form of qualification that is more convenient than a degree program

Introductory Cyber Security Skills Certification

A certification for IT professionals who are new to cyber security and are looking to gain a basic foundation of knowledge and experience.

This certificate includes network attacks and defenses, security policies, business continuity, disaster recovery, encryption, and cryptography

Ethical Hacking Certificates

A certification for individuals who can assess the security of a system and understand how to identify system vulnerabilities.

This certificate includes hacking technologies, malware, viruses, mobile platforms, operating systems, security laws, and standards

Information System Security Certificates

A certification for more advanced cyber security specialists that focuses on the technical aspect of securing info assets.

This certificate includes risk management security operations, access control, networking, cryptography, and telecommunications

Penetration Testing Certificate

This certification includes finding vulnerability through simulated attacks, vulnerability scanning, web application attacks, buffer overflows, antivirus, and privilege escalation

Entry-Level Job in Cyber Security

For individuals who want to gain experience in cyber security (job eg. security specialists, technicians, and investigators)

Intermediate-Level Job in Cyber Security

For individuals with 3 to 5 years job experience in cyber security (job eg. Cyber Security analyst, security consultant, and penetration tester)

Advanced-Level Job in Cyber Security

For individuals with more than 5 years experience in cyber security (job eg. cyber security engineers, security architects, and chief information security officers)