CN1141 Information Security Fundamentals - Introduction to Cyber Security Notes

Learning Objectives

  • Identify the top threats to a network.
  • Assess the likelihood of an attack on the network.
  • Define key terms commonly used in computer security.
  • Compare and contrast perimeter and layered approaches to network security.
  • Use online resources to secure your network.

Importance of Network Security

  • Data Storage: Individuals and organizations store a significant amount of personal information online.
  • Sensitive Examples:
    • Medical records.
    • Personal identification details: names, addresses, and ID numbers.
  • Consequences of Insecurity: This information can be accessed and exploited by individuals with malicious intent, resulting in cyber crimes.
  • Protection and Awareness: Network security is a critical concern that requires understanding to protect assets and maintain awareness of potential threats.

Threat, Vulnerability, and Risk

  • Threat: Refers to an incident that has the potential to harm a system or the company overall. A threat exploits a vulnerability and can damage or destroy an asset.
  • Vulnerability: Refers to a weakness or gap in protection, specifically in hardware, software, or procedures. It is essentially a way hackers can easily find entry into a system.
  • Risk: Refers to the potential for lost, damaged, or destroyed assets. It is the intersection point where assets, threats, and vulnerabilities meet.

Examples of Threat, Vulnerability, and Risk

  • Scenario 1: Terminated Employee
    • Vulnerability: Terminated employee IDs are not removed from the system.
    • Threat: The terminated employee dials into the company's network and accesses proprietary info.
    • Risk: Unauthorized disclosure of sensitive business information.
  • Scenario 2: Fire Hazard
    • Vulnerability: Improper maintenance of fire fighting equipment.
    • Threat: Fire.
    • Risk: Loss of life and data.
  • Scenario 3: Intruder
    • Vulnerability: Security guard or control measure is not available to counter the threat.
    • Threat: Intruder.
    • Risk: Theft.
  • Scenario 4: Employee Error
    • Vulnerability: Sharing a password with an unauthorized employee.
    • Threat: Employee misuse.
    • Risk: Unauthorized access of information.

Cyber Crimes and Common Network Attacks

  • Crimes Targeting Computer Networks:
    • Computer Viruses: Malicious programs that replicate and spread.
    • Denial-of-Service (DoS) Attacks: Overloading systems to make them unavailable.
    • Malware: Including ransomware, worms, and Trojans.
  • Crimes Using Networks to Offend:
    • Cyberstalking: Harassment using electronic communication.
    • Fraud and Identity Theft: Stealing personal data for financial gain.
    • Information Warfare: Using or damaging information to gain an advantage.
    • Phishing Scams: Tricking users into revealing sensitive information.
  • Common Types of Network Attacks:
    • Malware.
    • Security breaches.
    • Denial of Service (DoS) attacks.
    • Web attacks: Session hijacking, DNS poisoning, and URL spoofing.

Malware Categories and Distribution

  • Definition: Malware is short for 'Malicious Software.' It involves code, scripts, active content, or software programs designed specifically to cause harm.
  • Common Types of Malware:
    • Computer viruses.
    • Ransomware.
    • Worms.
    • Trojan horses.
    • Rootkits.
    • Keyloggers.
    • Dialers.
    • Spyware.
    • Adware.
    • Infostealers.
    • Rogue security software.
  • Malware Distribution Statistics (20242024):
    • Infostealers: 49%49\%
    • Downloaders: 25%25\%
    • Backdoors: 17%17\%
    • Ransomware: 9%9\%
    • Sources: AhnLab, Recorded Future, Kroll, Microsoft.

Assessing Attack Likelihood

  • The likelihood of an attack is not uniform across all systems; it depends on the setup, user behavior, and existing protection levels.
  • Assessment Factors:
    • Is the system connected to the internet?
    • User demographics (staff, students, or the general public).
    • Presence of antivirus software and current updates.
    • The sensitivity or importance of the stored data.
  • Likelihood Table:
    • Phishing: Very High likelihood in environments where students and staff check emails daily.
    • Malware: High likelihood in environments with no antivirus or outdated software.
    • DoS Attack: High likelihood for public websites with no firewall.
    • Spyware: Medium likelihood where users click unknown links or advertisements.
    • DNS Poisoning: Low-Medium likelihood where DNS settings are poorly configured.

Basic Security Terminology: Types of Hackers

  • White Hat Hackers: Ethical hackers who work to improve security systems.
  • Black Hat Hackers: Malicious hackers who exploit systems for personal or financial gain.
  • Gray Hat Hackers: A blend of both White hat and Black hat activities.

Basic Network Security Devices

  • Firewall: Filters traffic entering and exiting the network. It blocks or allows traffic based on a set of configured rules.
  • Proxy Server: Acts as an intermediary between users and the internet. It hides internal IP addresses to enhance privacy and helps enforce perimeter security.
  • Intrusion Detection System (IDS): Monitors network traffic for suspicious activities and policy violations. It generates alerts to a management console.

Key Security Activities

  • Authentication: Verifying identity before granting access (e.g., login with a password).
  • Authorization: Granting specific permissions to perform actions (e.g., restricted file deletion rights).
  • Auditing: Reviewing past user actions by checking system logs.
  • Monitoring: Continuous observation of systems to catch problems early.
  • Encryption: Locking information so only authorized parties can read it.
  • Backup & Recovery: Saving copies of data to restore it after a problem occurs.
  • Patch Management: Fixing software bugs to maintain system safety.
  • Incident Response: Establishing protocols for what to do if a cyberattack or problem happens.

Core Security Principles: The CIA Triad and Least Privilege

  • Confidentiality:
    • Prevents unauthorized disclosure of information.
    • Only authorized parties can access sensitive data.
    • A breach occurs when an unauthorized person views files.
    • Significant for protecting a company's competitive edge and intangible assets.
  • Integrity:
    • Ensures information is accurate and has not been tampered with.
    • Safeguards the completeness of vital information.
    • Data must not be altered or destroyed during transmission and storage.
    • Requires policies so users know how to properly utilize the system.
  • Availability:
    • Guarantees that information and IT resources are accessible to authorized users when needed.
    • Infrastructure must remain robust and fully functional during adverse conditions (e.g., "database conundrum" or "fall-overs").
    • Requires protection against hackers and malicious codes that could block access.
  • Principle of Least Privilege:
    • Grant each user or process only the minimal rights needed to perform their tasks. This reduces the "blast radius" if credentials are compromised.

Security Concepts and Approaches

  • Perimeter Approach:
    • Concentrates security at the network boundary.
    • Aims to block threats before they enter the internal environment.
    • Examples: Firewalls, proxy servers, password policies, CCTV, and security guards.
  • Layered Approach:
    • Implemented at multiple levels, not just the perimeter.
    • Protects every system and device within the network.
    • Assumes perimeter defenses may be bypassed, necessitating additional safeguards throughout the environment.
  • Proactive Approach:
    • Focuses on preventing attacks before they occur through planning and monitoring.
    • Uses tools (like IDS alerts for unsuccessful attack attempts) and policies to identify vulnerabilities and stop breaches early.
  • Reactive Approach:
    • Focuses on responding to incidents after they have occurred.
    • Often limited to logging events and reviewing records post-attack.
    • Offers minimal active prevention and may increase risk due to delayed responses.

Legal Issues and Compliance

  • Privacy Regulations: Directly impact how organizations must protect data (e.g., HIPAA - Health Insurance Portability and Accountability Act, and local cybersecurity laws).
  • Due Diligence: If a system is breached, organizations may be required to prove they exercised due diligence.
  • Liability: Failing to demonstrate proper precautions can lead to civil or legal liability.
  • Compliance: Organizations must implement and document appropriate security controls.

Trusted Online Security Resources

  • CERT (Computer Emergency Response Team): www.cert.org
  • Microsoft Security Advisor: www.microsoft.com/security
  • F-Secure (Threat reports and tools): www.f-secure.com
  • SANS Institute (Training and research): www.sans.org
  • McAfee (Threat intelligence): www.mcafee.com