Information Security Fundamentals Study Guide

Module 1: Introduction to Security Objectives

By the completion of this module, students should be capable of the following:

• Defining information security and explaining its overall importance.
• Identifying various threat actors and their specific attributes.
• Describing different categories of vulnerabilities and attacks.
• Explaining the potential impacts of successful attacks on data and enterprises.

Defining Information Security

• Conceptual Definition of Security:
  • Security is defined as being free from danger, which serves as the ultimate goal of all security efforts.
  • Security is also defined as the process that achieves that freedom from danger.
• The Security-Convenience Relationship:
  • As security measures are increased, the convenience of using a system often decreases.
  • The more secure something becomes, the less convenient it may be for a user to operate.
• Scope of Information Security:
  • Information security involves the tasks of securing digital information in three states:
    • When it is manipulated by a microprocessor.
    • When it is preserved on a storage device.
    • When it is transmitted over a network.
• The CIA Triad (Types of Information Protection):
  • Confidentiality: Ensures that only approved individuals may access specific information.
  • Integrity: Ensures that information remains correct and is completely unaltered.
  • Availability: Ensures that information is readily accessible to authorized users when needed.

Threat Actors and Their Attributes

• General Definition:
  • A threat actor is an individual or entity responsible for cyber incidents targeting the technology equipment of enterprises and users. The term "attacker" is a common synonym.
• Financial Crime Categories:
  • Attacks driven by financial motives are typically divided based on their targets:
    1. Individual users.
    2. Enterprises.
    3. Governments.
• General Categories of Hackers:
  • Black Hat Hackers: Malicious attackers.
  • White Hat Hackers: Ethical security professionals.
  • Gray Hat Hackers: Individuals who may break laws but without malicious intent.
• Profiles of Specific Threat Actors:
  • Script Kiddies: Individuals who wish to perform attacks but lack the technical knowledge to create their own tools. They download and use freely available automated attack software.
  • Hacktivists: Attackers strongly motivated by ideology, principles, or beliefs. They often break into websites to change content as a political statement or perform retaliatory attacks (e.g., disabling a bank's website for not supporting specific groups).
  • State Actors: Government-sponsored attackers launched against foreign foes. They are considered among the deadliest threat actors and often engage in multiyear intrusion campaigns.
    • Advanced Persistent Threat (APT): A class of sophisticated, long-term attacks most commonly associated with state actors, targeting sensitive national security, economic, or proprietary information.
  • Insiders: Employees, contractors, or business partners who manipulate data from a trusted position. These attacks are difficult to recognize because they originate within the enterprise.
    • In 2019, $6/10$ enterprises (or $60\%$) reported being victims of at least one insider attack.
    • Internal focus areas for insiders:
      • Intellectual property (IP) theft: $43\%$
      • Sabotage: $41\%$
      • Espionage: $32\%$
  • Competitors: Launch attacks against an opponent’s systems to steal research or customer lists to gain a competitive advantage.
  • Criminal Syndicates: Small numbers of experienced online criminal networks that act as entrepreneurs, moving from traditional crime to more rewarding, less risky online attacks.
  • Shadow IT: Employees who, frustrated with slow IT acquisition, purchase and install their own equipment or cloud resources, often creating weaknesses and violating company policies.
  • Brokers: Individuals who uncover software weaknesses and sell that knowledge to the highest bidder (attackers or governments) rather than reporting it to the vendor.
  • Cyberterrorists: Attackers who target a nation's network and computer infrastructure (such as the electrical power grid) to cause widespread disruption and panic.

Cybersecurity Vulnerabilities

• General Definition: A vulnerability is the state of being exposed to the possibility of being attacked or harmed.
• Primary Vulnerability Categories:
  • Platforms: Includes hardware devices and the OS running software. Vulnerable platforms include:
    • Legacy platforms (outdated systems).
    • On-premises platforms.
    • Cloud platforms.
  • Configurations: Vulnerabilities caused by improperly implemented settings, resulting in weak security configurations.
  • Third Parties: Risks arising from external entities used for code development or data storage.
    • Vendor Management: The process of monitoring and managing interactions with third parties.
    • System Integration: The connectivity between an organization and a third party. This often involves the principle of the "weakest link."
  • Patches: Although intended to fix issues, they can create vulnerabilities due to:
    • Difficulty in patching firmware.
    • Lack of patches for specific application software.
    • Delays in patching Operating Systems (OSs).
  • Zero Day: A vulnerability exploited by attackers before the developer is aware of it or has issued a patch, providing "zero days" of warning.

Attack Vectors and Social Engineering

• Attack Vectors: The pathways or avenues used by threat actors to penetrate systems. Categories include:
  • Email
  • Wireless networks
  • Removable media
  • Direct access
  • Social media
  • Supply chain
  • Cloud services
• Social Engineering: Eliciting information by exploiting human weaknesses or using influence campaigns to sway sympathy and attention.
• Psychological Principles of Social Engineering:
  • Attackers gain trust by: Providing a reason, projecting confidence, using evasion and diversion, or making the victim laugh.
• Psychological Attack Techniques:
  • Impersonation: Masquerading as a real or fictitious character to trick a victim.
  • Phishing: Using email or web announcements falsely claiming to be from a legitimate source to trick users into surrendering info.
    • Variations: Spear phishing, Whaling, Vishing (voice), Smishing (SMS).
  • Redirection: Directing users to fake lookalike sites for financial gain or data theft.
    • Typo Squatting: Purchasing domain names spelled similarly to actual sites.
    • Pharming: Exploiting how a URL is converted to an IP address.
  • Spam: Unsolicited bulk email.
    • Text-based spam can be filtered, but Image Spam cannot be filtered by traditional text filters.
  • Spim: Spam delivered via Instant Messaging (IM).
  • Hoaxes: False warnings (often regarding "deadly viruses") that trick users into erasing files or changing security settings.
  • Watering Hole Attack: An attack directed toward a specific, small group of individuals who frequent a particular website.
• Physical Social Engineering Procedures:
  • Dumpster Diving: Digging through trash to find information. Items of interest include:
    • Calendars: Reveal when employees are out of town.
    • Hardware (USB/Portable Hard Drives): Often improperly disposed of with data.
    • Memos: Provide context for impersonation.
    • Organizational Charts: Identify authority figures.
    • Phone Directories: Provide targets for impersonation.
    • Policy/System Manuals: Reveal security levels and specific technology used.
  • Google Dorking: An electronic variation of dumpster diving using search engines to find sensitive data posted online.
  • Tailgating: Following an authorized person through an entry door.
  • Shoulder Surfing: Watching a user enter secret information, such as door keypad codes.

Impact of Attacks

• Data Impacts:
  • Data Loss: Destroying data so it cannot be recovered (e.g., erasing research data).
  • Data Exfiltration: Stealing data to distribute or sell it to other parties.
  • Data Breach: Stealing data to disclose it in an unauthorized fashion (e.g., stealing credit card numbers).
  • Identity Theft: Taking Personally Identifiable Information (PII) to impersonate someone else (e.g., using a Social Security number for a loan).
• Enterprise Impacts:
  • Availability Loss: Systems become inaccessible to legitimate users.
  • Financial Loss: Resulting from lost productivity during downtime.
  • Reputation Damage: Negative shift in public perception of the enterprise.

Questions & Discussion

• Icebreaker Question: Why is it important for all computer users, not just IT professionals, to understand the importance of network and computer security?
  • Discussion Requirements: Each student should introduce themselves and explain why they are taking the class. If online, a minimum 100-word response is required on the discussion board.
• Knowledge Check 1: As security increases, the convenience of using a system is also increased.
  • Answer: False. As security increases, convenience usually decreases because users must perform additional tasks to follow security policies.
• Knowledge Check 2: Which type of threat actor is often involved in multiyear intrusion campaigns targeting highly sensitive economic, proprietary, or national security information?
  • Answer: State actor. They are sponsored by governments to gain a competitive or warfare advantage.
• Knowledge Check 3: Which type of attack is NOT a form of social engineering attack?
  1. Watering hole
  2. Hoax
  3. Zero day
  4. Tailgating
  • Answer: Zero day. A zero day is an attack on a software vulnerability before a patch exists, whereas the others rely on human action or psychology.
• Knowledge Check 4: Which type of data impact would result if an attacker stole a list of customers for the purpose of selling the list to a competitor?
  • Answer: Data exfiltration. While it is a type of data breach, exfiltration specifically refers to stealing data for distribution or sale.