Cybercrime and Security Notes

Learning Objectives

  • Definitions: Cybercrime, computer crime, cyberattack, online fraud, online scams
  • Security and cybersecurity principles
  • Password and access controls
  • Types of attacks: Spam, phishing, spear phishing, whaling, spoofing, pretexting, pharming
  • Protecting data: Confidentiality and privacy
  • Ensuring system continuity: Disaster recovery and planning

Importance of Cybercrime and Security

  • Critical for careers in accounting, auditing, and AIS specialization
  • Cyber incidents are ranked as the top business risk globally in 2024.
  • Affects various sectors (government, finance, hospitality, etc.) and all company sizes.

Cyberattacks vs. Cybercrime

  • Cyberattack: Unauthorized actions by threat actors to access, steal data, or damage systems.
  • Cybercrime: Criminal acts facilitated by technology, ranging from direct attacks (e.g., intrusions) to cyber-enabled crimes (e.g., fraud).

Definitions of Cybercrime

  • Pure Cybercrime: Offences defined by NZ Crimes Act (e.g., unauthorized access, damaging systems).
  • Cyber-enabled Crime: Traditional crimes aided by technology (e.g., online scams).

Cybersecurity Overview

  • Focuses on protecting digital assets from threats like ransomware and spyware.
  • Necessitated by an increasing prevalence of cyberattacks on sectors like banking.

Cybercriminal Techniques

  • Methods include exploiting vulnerabilities through various attack techniques (e.g., brute force, social engineering).
  • Common attack vectors: Administrator backdoors, brute force hacks, and social engineering techniques.

Password Security

  • Poor password practices allow easy breaches. Common passwords often take seconds to crack.
  • Strong password policy recommendations include complexity and regular updates.

Social Engineering Tactics

  • Techniques used to manipulate victims into revealing personal information include:
    • Baiting: Enticing users with false promises.
    • Scareware: Creating fake alerts to prompt action.
    • Spoofing: Faking trusted sources to gain access.
    • Phishing: Tricking users through deceptive communications.

Examples of Social Engineering Types

  • Spear Phishing: Targeted attacks on individuals—often with personalized content.
  • CEO Fraud: Impersonating executives to steal sensitive information.
  • Whaling: Targeting high-profile individuals for valuable data.

Data Protection Strategies

  • Use encryption for sensitive data.
  • Implement access controls for authorization and authentication.
  • Regular audits and employee training on cybersecurity awareness.

Case Studies of Data Breaches

  • Ashley Madison: Compromised user data leading to severe privacy violations.
  • Latitude Financial: Exposed personal details of over a million customers including driver's license numbers.
  • ACC breaches: Multiple instances of sensitive information mishandling.

Emerging Threats

  • Deepfakes: AI-generated media that can mislead or manipulate public perception.
  • Increased sophistication in scams utilizing advanced technology.