Cybersecurity - Lecture 1

Cybersecurity

Protection of computer systems from theft, damage, disruption, or misdirection of their services.

Computer Security

Another name for cybersecurity or IT security.

Cybersecurity Scope

Includes physical security, software security, web security, network security, personal security, privacy, and ethics.

Cyberspace

The environment in which communication over computer networks occurs.

Cybercrime

Any crime involving a computer and a network; the computer may be the target or used to commit the crime.

Asset

Anything of value to an organization that needs protection from threats.

Asset Examples

Data, hardware, software, infrastructure, and intellectual property.

Cyberattack

An attempt to expose, alter, disable, destroy, steal, or gain unauthorized access to an asset.

CIA Triad

The three main cybersecurity objectives: Confidentiality, Integrity, and Availability.

Confidentiality

Preventing unauthorized disclosure of sensitive information.

Confidentiality Controls

Firewalls, ACLs, and encryption.

Integrity

Preventing unauthorized modifications to information or systems.

Integrity Controls

Hashing and integrity monitoring solutions.

Availability

Ensuring legitimate users can access systems and information when needed.

Availability Controls

Fault tolerance and backups.

Nonrepudiation

Ensuring someone who performed an action cannot later deny performing it.

Nonrepudiation Control

Digital signatures.

DAD Triad

The opposite of the CIA Triad; describes three key cybersecurity threats.

Disclosure

A violation of confidentiality.

Data Exfiltration

When an attacker gains access to sensitive information and/or moves it outside an organization.

Alteration

A violation of integrity.

Denial

A violation of availability.

DDoS Attack

An example of a denial threat that violates availability.

Vulnerability

A weakness, flaw, or gap in security that can be exploited by a threat.

Software Vulnerability

A software weakness that can be exploited, such as a web application bug allowing SQL injection.

Human Vulnerability

A weakness caused by human behavior, such as weak passwords or falling for phishing.

Threat

A potential negative action that exploits a vulnerability and can cause damage.

Intentional Threat

A threat caused deliberately, such as hackers or malware.

Unintentional Threat

A threat caused unintentionally, such as human error or natural disasters.

Security Incident

An event involving a breach of confidentiality, integrity, and/or availability.

Malicious Security Incident

An incident caused by malicious activity, such as an attacker stealing sensitive information.

Accidental Security Incident

An incident caused accidentally, such as an employee leaving an unencrypted laptop.

Natural Security Incident

An incident caused by natural activity, such as an earthquake destroying a datacenter.

Risk

The potential for loss or damage to the confidentiality, integrity, or availability of data.

Risk in Simple Terms

The possibility or chance of something bad happening to a system or application.

Vulnerability vs Threat

A vulnerability is a weakness; a threat is an action or event that can exploit that weakness.

Threat vs Risk

A threat is a potential harmful action; risk is the potential loss or damage resulting from it.

SQL Injection Example of Risk

The vulnerability is missing input validation; the threat is an attacker using SQL injection; the risk is unauthorized access or a data breach.

Risk Categories

Financial, reputational, strategic, operational, and compliance.

Financial Risk

The risk of monetary damage to an organization, either directly or indirectly.

Direct Financial Damage

Immediate monetary loss, such as the cost of replacing a lost laptop.

Indirect Financial Damage

Losses resulting from consequences, such as competitors obtaining confidential product plans.

Reputational Risk

The risk of damage to an organization's reputation and customers' trust.

PII

Personally identifiable information, such as Social Security numbers, bank accounts, credit cards, driver's licenses, and passport data.

Strategic Risk

The risk that an organization becomes less effective at meeting major goals due to a security breach.

Operational Risk

The risk to an organization's ability to perform its day-to-day functions.

Operational Risk Examples

Slower business processes, delayed customer orders, or time-consuming manual work.

Compliance Risk

The risk of violating legal or regulatory requirements because of a security breach.

HIPAA

The Health Insurance Portability and Accountability Act.

HIPAA Security Requirement

HIPAA requires healthcare providers to protect the confidentiality, integrity, and availability of protected health information.

Risk Mitigation

Steps or actions taken to reduce the severity or impact of a risk.

Risk Mitigation Examples

Regular software updates, security patches, and network segmentation.

Network Segmentation

A security measure that limits the spread of an attack within an organization's infrastructure.

Safeguard / Security Control

A specific measure used to fulfill security objectives, protect against threats, and reduce vulnerabilities.

Gap Analysis

Reviewing control objectives and examining whether existing controls achieve those objectives.

Security Control Gap

A missing or insufficient control identified through gap analysis; it should be treated as a potential risk.

Technical Controls

Controls that use hardware and software technology to protect assets.

Technical Control Examples

Firewalls, IDS/IPS, and encryption.

Operational Controls

Human-driven day-to-day execution of security processes.

Operational Control Examples

Log monitoring and regularly scanning and patching software vulnerabilities.

Managerial Controls

Policies, procedures, and guidelines that govern an organization's security.

Managerial Control Examples

Risk assessments, security awareness training, and incident response procedures.

Physical Controls

Controls designed to protect physical assets.

Physical Control Examples

Fences, locks, fire suppression systems, and surveillance cameras.

Preventive Controls

Proactive controls designed to stop security incidents before they occur.

Preventive Control Examples

Firewalls, encryption, awareness training, and locks.

Detective Controls

Reactive controls that identify and alert on security events.

Detective Control Examples

IDS, SIEM, and cameras.

Corrective Controls

Controls that remediate damage caused by security incidents that have already occurred.

Corrective Control Examples

Backup and recovery systems and incident response procedures.

Deterrent Controls

Controls that discourage potential attackers by making consequences seem severe.

Deterrent Control Examples

Visible security cameras and warning signs.

Compensating Controls

Alternative controls used when primary controls are not feasible or practical.

Compensating Control Example

Using a stricter password policy when a legacy system cannot support MFA.

White-Hat Hacker

An authorized attacker who finds vulnerabilities with the intent of correcting them.

Black-Hat Hacker

An unauthorized attacker who seeks to defeat security controls and compromise CIA.

Gray-Hat Hacker

A person who acts without proper authorization but intends to inform targets about vulnerabilities.

Red Team

The offensive cybersecurity team that simulates adversary behavior to test defenses.

Red Team Role

Tests an organization's defenses and provides results to improve defensive capabilities.

Blue Team

The defensive team made up of the organization's cybersecurity personnel.

Blue Team Role

Establishes security measures, monitors them, and adjusts defenses based on testing and feedback.

Purple Team

A temporary/transient team that optimizes collaboration between red and blue teams.

Purple Team Role

Bridges gaps in understanding and communication between offensive and defensive teams.

Network Security

A cybersecurity field focused on protecting networks and networked systems.

Data Security

A cybersecurity field focused on protecting data.

Application Security

A cybersecurity field focused on protecting applications.

System Security

A cybersecurity field focused on protecting computer systems.

Cloud Security

A cybersecurity field focused on protecting cloud environments.

Mobile Security

A cybersecurity field focused on protecting mobile devices and environments.

IoT Security

A cybersecurity field focused on protecting Internet of Things devices and systems.

Infrastructure Security

A cybersecurity field focused on protecting infrastructure.

Course Content

The course covers cybersecurity, authentication, access control, threats, malware, network security, IDS, and firewalls.

User Authentication

A course topic concerned with verifying users' identities.

Remote User Authentication

A course topic concerned with authenticating users accessing systems remotely.

Access Control

A course topic concerned with controlling access to resources.

Cybersecurity Threat Landscape

A course topic covering cybersecurity threats and the environment in which they occur.

Malicious Software

A course topic covering harmful software and malware.

Intrusion Detection Systems

A course topic covering systems that detect security intrusions.

Firewalls

A course topic covering network security mechanisms that control traffic.

Disclosure Example

An attacker accesses sensitive information, violating confidentiality.