S3M1
Cybersecurity Risk Management Overview
Definition of Cybersecurity:
Cybersecurity is the practice of protecting an organization’s IT infrastructure and critical data from bad actors by deploying a variety of:
Technologies
Internal control processes
Best practices to mitigate the business impact of attacks.
Goal of Cybersecurity:
Manage cybersecurity risks by securing and enhancing:
Confidentiality
Data integrity
Availability
Impact of Successful Cyberattacks
Consequences:
Successful cyberattacks can cost an organization:
Monetary losses
Non-monetary losses to restore the ability to work with:
Customers
Vendors
Partner organizations
Cyberattacks are threats to both individuals and organizations.
Top security concerns for senior executives and IT governance include:
Data breaches
Theft
Service interruptions
Regulatory noncompliance
Data Breaches
Definition:
Data breaches occur when information is compromised and utilized without the authorization of the owner.
Examples of attacks leading to data breaches include:
Ransomware
Phishing
Malware
Compromised passwords
Service Disruptions
Definition:
An unplanned event that renders the general system or major application inoperable for an unacceptable length of time.
Causes of service disruptions include:
Malware
Distributed Denial-of-Service (DDoS) attacks
SQL injections
Password attacks
Compliance Risk
Regulators can require organizations to comply with cybersecurity regulations.
Consequences of non-compliance:
Failure to comply can result in fines and other penalties.
Areas involving compliance risk include:
HIPAA
GDPR
PCI-DSS
ISO / IEC 27001
Mitigation Strategies
Recommendations:
Organizations should:
Discuss various programs to mitigate cybersecurity risks.
Constantly update security measures to keep up with the ever-changing technology landscape.
Cyberattacks Overview
Definition of Cyberattacks:
Any malicious activity that targets:
Computer information systems
Infrastructures
Computer networks
Personal computer devices.
Objective:
Collect, disrupt, deny, degrade, or destroy information system resources or information itself.
Impact of cyberattacks can directly or indirectly affect:
Organization
Customers
Vendors
Partner organizations
Types of Cyberattacks
Categories of cyberattack execution:
Network-based attacks
Host-based attacks
Social engineering attacks
Application-based attacks
Physical attacks
Supply chain attacks
Threat Agents
Definition:
A threat agent is an internal or external attacker that can negatively impact data security through:
Theft
Manipulation
Control of sensitive information or systems
Multiple types of threat agents exist with specific goals, such as financial gain or data destruction.
Types of Threat Agents:
Attacker, Threat Actor, or Hacker: Individuals or groups targeting systems to gain access to data for various motives.
Objectives range from theft to destabilizing businesses to espionage.
Adversary: Individuals or groups with conflicting interests against the organization.
Government-sponsored/State-sponsored Actors: Funded by nations, engaged in espionage and theft of intellectual property.
Hacktivists: Groups targeting organizations to promote social causes, steering clear from altruistic entities.
Insiders: Employees with malicious intent or infiltrators posing risks from inside.
External Threats: Externally initiated attacks.
Network-based Attacks
Target:
The infrastructure of a network, including:
Switches
Routers
Servers
Cabling
Types of** network-based techniques**:
Backdoors and Trapdoors: Methods to bypass security, including both intentional and accidental openings.
Covert Channels: Mechanisms using unintended methods to transmit data, bypassing security protocols.
Types of covert channels:
Storage channels: Data transmitted through unauthorized storage access.
Timing channels: Using timing discrepancies to transmit data.
Buffer Overflows: Attackers overwhelm program buffers with excessive input, potentially executing malicious code.
Denial-of-Service (DoS): Flooding systems with traffic to exhaust resources, causing operational failures.
Distributed Denial-of-Service (DDoS): Coordinated attacks from multiple sources flooding a target network.
Man-in-the-Middle (MITM): Intercepting communications between parties and potentially altering messages.
Port Scanning Attacks: Identifying open ports on networks for vulnerabilities, focusing on logical ports used for protocols like TCP.
Ransomware Attacks: Malware that locks systems or data, demanding ransom for access recovery.
Replay Attacks: Eavesdropping on secure communications and re-transmitting intercepted messages.
Return-Oriented Attacks: Using legitimate code in a sequence to perform unauthorized operations.
Spoofing: Impersonating entities to gain unauthorized access, including:
Address Resolution Spoofing (ARS): Falsifying MAC and IP address mappings.
DNS Spoofing: Modifying domain-to-IP mapping to redirect users to malicious sites.
Hyperlink Spoofing: Altering links to redirect users to harmful destinations.
Application-based Attacks
Target:
Specific software or applications, like databases or websites, to gain unauthorized access or disrupt functionality.
Example Techniques:
SQL Injection: Injecting malicious SQL code into a query to access sensitive data.
Cross-Site Scripting (XSS): Injecting code into websites targeting users visiting that site.
Race Condition: Exploiting system operations reliant on specific sequences to gain unauthorized access.
Mobile Code: Malicious software lingering on devices, often referred to as a virus, aiming to replicate and infect further systems.
Host-based Attacks
Focus:
Target individual hosts, typically laptops, mobile devices, or servers.
Types:
Brute Force Attacks: Automated password guessing based on all possible combinations.
Malware: Any software impacting system confidentiality, integrity, or availability, including keyloggers.
Rogue Mobile Apps: Malicious applications disguised as legitimate ones.
Social Engineering Attacks
Definition:
Psychological manipulation of individuals to divulge confidential information.
Methods:
Phishing: Deceptive emails requesting sensitive data.
Spear Phishing: Targets specific individuals, often at a corporate level, disguising as trusted entities.
Business Email Compromise (BEC): Targets executives to manipulate them into fraud.
Pretexting: Creating identities or scenarios to deceive individuals into providing data.
Pharming: Misdirecting users to fraudulent sites for information theft.
Vishing: Voice-based scams using spoofed caller IDs to extract confidential data.
Physical (On-Premises) Attacks
Definition:
Security breaches occurring within organizational premises, involving direct attacks on hardware, software, or sensitive data.
Common Techniques:
Intercepting Discarded Equipment: Accessing discarded devices to extract data.
Piggybacking: Using authorized access to gain entry into restricted areas.
Tampering: Physically altering IT aspects to manipulate data storage and transmission.
Theft: Stealing data or hardware physically.
Supply Chain Attacks
Definition:
Cyber tactics targeting the production and distribution within supply chains to disrupt normal operations.
Methods:
Inserting Malware: Into sold software or firmware.
Using Compromised Devices: Like USB drives embedded with malware.
Vendor Attacks: Compromising vendors to disrupt supply chains.
Watering Hole Attacks: Targeting common sites used by industries to infect systems.
Illustration of Cyberattack Impact
Examples:
Ransomware Attack:
Impact on Customers: Order fulfillment disrupted.
Impact on Vendors: Communication failures.
Impact on Partner Organizations: Financial losses due to ransom.
Mobile Code Attack:
Impact on Customers: Data loss.
Impact on Vendors: Critical data hit.
Impact on Partner Organizations: Resource reallocation.
Malware Attack:
Impact on Customers: Data exposure.
Impact on Vendors: Banking info exposure.
Impact on Partner Organizations: Reputational damage and lawsuits.
Stages in a Cyberattack
Reconnaissance:
Information gathering about target systems.
Gaining Access:
Exploiting vulnerabilities to penetrate targeted systems.
Escalation of Privileges:
Seeking higher access levels within the system.
Maintaining Access:
Sustained presence for prolonged exploitation.
Network Exploitation and Exfiltration:
Stealing or manipulating sensitive data.
Covering Tracks:
Concealing breaches by modifying logs or disabling audit functions.
Risks Related to Cloud Computing
Definition of Cloud Computing:
Storing, using, processing, and sharing data without owning or managing the resources on-premises.
Companies utilize internet service for computing power, often leading to sensitive information exposure.
Security Standing:
Many cloud providers maintain higher security standards than on-premises setups, driven by regulations like GDPR & HIPAA.
Common Risks:
Industry Exposure: Potential exposure to risks from shared environments with other organizations.
Cloud Malware Injection Attacks: Injecting malware into clouds to disrupt services.
Compliance Violations: Risks from reliance on third-party compliance capabilities.
Data Loss: Vulnerable to breaches and data exposure.
Loss of Control: Reduced oversight over IT infrastructure and security upgrades.
Loss of Visibility: Limited awareness of infrastructure vulnerabilities.
Multi-Cloud Management Issues: Challenges in managing multiple cloud solutions.
Intellectual Property Theft: Insufficient controls leading to potential data compromises.
Risks Related to Mobile Technologies
Description of Mobile Risks:
Mobile devices bring risks for users and organizations due to constant internet connections and unique vulnerabilities.
Unique Challenges Include:
Application Malware: Downloading seemingly legitimate applications harboring threats.
Lack of Updates: Vulnerabilities from uninstalled patches and security fixes.
Lack of Encryption: Dependence on passcodes instead of robust encryption.
Physical Threats: Risks of stolen devices exposing data.
Unsecured Wi-Fi Networks: Risks from connection to public networks.
Location Tracking Risks: Using GPS technology for unauthorized tracking.
Risks Related to the Internet of Things (IoT)
Definition of IoT:
A network of smart devices providing automation and control for various applications.
Relevant Cyber Threats:
Device Mismanagement: Increased risk due to insufficient password management.
Device Spoofing: Connecting illegitimate devices to networks.
Escalated Cyberattacks: Using IoT devices to propagate infections across networks.
Expanded Footprint: IoT device proliferation increasing attack surfaces.
Information Theft: Potential exploitation of sensitive data stored in IoT networks.
Outdated Firmware Risks: Weaknesses in IoT devices due to outdated installed function controls.
Threat Modeling
Definition:
The process of identifying, analyzing, and mitigating threats to networks or applications.
Purpose:
Understand and address risks with controls to minimize or prevent impacts.
Key Phases include:
Identify Assets: Inventory assets that require protection.
Identify Threats: Classifying threats based on targeting and intended methods.
Perform Reduction Analysis: Understanding how vulnerabilities interact with assets.
Analyze Impact: Quantifying impacts in terms of dollars and qualitative effects.
Develop Countermeasures: Implementing security measures accordingly.
Review and Evaluate: Regularly reassessing models to adapt to evolving risks.
Threat Methodologies:
PASTA: A systematic approach prioritizing risks based on asset value.
VAST: Integrates threat management into agile methodologies.
STRIDE: A widespread model covering threats across applications and networks.