module2 (1)

Module Overview

  • Instructor: Dr. M. Asha Jerlin

  • Institution: SCOPE R VIT, Vellore Institute of Technology

Definition of Cyber

  • Derived from "Cybernetics"; means governance or piloting.

  • Influences game theory, system theory, and organizational theory.

Types of Cyber Messages

  • Example of a phishing text message from SBI requesting sensitive information:

    • Warning about an account block

    • Contains a suspicious link

Cyber Attacks

  • Surge in cyber attacks across India since the lockdown.

  • Increased vigilance by the Indian government against attacks, particularly from China.

  • Examples of significant ransomware attacks.

Case Study: AIIMS Cyber Attack

  • Incident involving a major cyber attack on the All India Institute of Medical Sciences attributed to a foreign government-backed group.

  • Involvement of the National Investigation Agency (NIA) and Indian Computer Emergency Response Team (CERT-in).

  • Vulnerabilities in the hospital's systems due to unattended servers that were exploited.

Drones Attack: Case Summary

  • Attack targeted Saudi Aramco on September 16, 2019.

  • Caused a significant disruption in oil production, leading to a spike in oil prices.

Summary of Cybersecurity

  • Cybersecurity is a growing concern affecting individuals and organizations alike.

  • Threats span privacy issues, data protection, and operational management.

  • Technology serves a triple role: as a source of threats, an asset to protect, and a defense weapon.

Types of Security Measures

  • Physical Security: protects organizational areas from unauthorized access.

  • Personal Security: safeguards individuals/groups.

  • Communication Security: secures organizational media and content.

  • Network Security: protects components and connections.

  • Information Security: safeguards databases and analytics.

Need for Information Security

  • The shift to electronic documentation increases the risk of unauthorized access and data breaches.

  • Mandatory to ensure data protection through authentication processes and secure networks.

  • Role of analysts: protect, monitor, and manage access to organizational data.

Cybersecurity Overview

  • Cybersecurity: often interchangeable with information security; defends against a range of threats including cyberbullying and cyber terrorism.

  • Cybersecurity focuses on protecting systems, hardware, software, and data from cyber threats.

  • Cyber threats may involve malware, phishing, and unauthorized access.

Key Principles of Information Security

  • Confidentiality: ensuring only authorized personnel can access sensitive information.

  • Integrity: safeguarding against unauthorized modifications.

  • Availability: ensuring authorized users can access information when needed.

Cybersecurity Incidents

  • Threats include unauthorized access, hardware exploitation, and data breaches.

  • Attack types classified into passive attacks (information gathering) and active attacks (damaging resources).

Cyber Threats Definitions

  • Cyber Threat: malicious acts aiming to compromise data integrity and security.

  • Cyber Attack: executed upon a system or an individual with the intent of data theft or disruption.

Risk and Vulnerability Assessment

  • Understanding how risk, threats, vulnerabilities, and attacks interact:

    • Risk = Threat + Vulnerability.

    • Vulnerability is a weakness that could be exploited by a threat.

Cybersecurity Models and Architectures

  • Cryptographic Techniques: fundamental to all security mechanisms, providing encryption and safeguarding data.

  • Various security layers must be applied to protect data and prevent unauthorized access.

Types of Security Attacks

  • Types include viruses, worms, and Trojans, which disrupt or damage systems.

  • Malware like rootkits and spyware pose additional threats by hiding their presence while executing malicious activity.

Specific Examples of Attacks

  • Denial of Service (DoS): floods a network to disrupt services.

  • SQL Injection and XSS: exploit vulnerabilities in web applications.

Data Security Management

  • Protecting data involves addressing the threats and vulnerabilities associated with information assets, ensuring confidentiality, integrity, and availability.


Types of Security Attacks and Examples

  1. Denial of Service (DoS)

    • Definition: A Denial of Service attack aims to make a network resource unavailable to its intended users by overwhelming it with a flood of illegitimate requests.

    • Example: An attacker floods a web server with a high volume of traffic, causing it to crash and become unresponsive to legitimate users.

  2. Distributed Denial of Service (DDoS)

    • Definition: Similar to a DoS attack but utilizes multiple compromised computer systems to launch the attack, amplifying its effects.

    • Example: An attacker uses a botnet, a network of infected computers, to simultaneously send requests to a target server, effectively overwhelming it.

  3. SQL Injection

    • Definition: A type of attack where an attacker exploits vulnerabilities in an application by injecting malicious SQL code into the database query.

    • Example: An attacker enters malicious SQL code into a login form, allowing them to bypass authentication and gain unauthorized access to the database.

  4. Cross-Site Scripting (XSS)

    • Definition: An attack that involves injecting malicious scripts into web pages viewed by users, allowing the attacker to execute scripts in the users' browser.

    • Example: An attacker embeds a JavaScript code within a comment section of a webpage, which executes when other users view the comment, potentially stealing their cookies or session data.


  5. MalwareThis encompasses various types of malicious software that is designed to harm or exploit any programmable device or network, including:

    • Viruses: These attach themselves to clean files and spread throughout a computer system, infecting other files.

      • Example: A user downloads an infected software application that spreads a virus to other files on their system.

    • Worms: Unlike viruses, worms do not require a host program and can replicate themselves to spread across networks.

      • Example: A worm spreads through email attachments and automatically replicates itself to contacts in the user's address book.

    • Trojans: These disguise themselves as legitimate software but perform malicious actions without the user's knowledge.

      • Example: A user downloads an application claiming to clean their system but actually installs backdoor access for attackers.

    • Ransomware: A type of malware that encrypts files and demands a ransom for their release.

      • Example: A hospital's computer system is locked down by ransomware, and a payment is demanded for a decryption key to regain access to important medical records.

    • Spyware: Software that secretly gathers user information without their consent.

      • Example: A spyware program installed on a user's computer tracks their keystrokes and sends the data back to the attacker, who collects sensitive information such as passwords.

    • Rootkits: These allow attackers to gain control of a system while hiding their presence from administrators and security software.

      • Example: An attacker installs a rootkit on a server, enabling them to run commands remotely without alerting security measures.

  6. Man-in-the-Middle (MitM) Attack

    • Definition: An attack where the attacker secretly intercepts and relays messages between two parties who believe they are directly communicating with each other.

    • Example: An attacker intercepts communication between a user and a bank, capturing sensitive credentials like passwords and account numbers.

  7. Phishing

    • Definition: A method of attempting to acquire sensitive information by masquerading as a trustworthy entity in electronic communications.

    • Example: An email appears to come from a legitimate bank, requesting that the recipient click a link to verify their account details, leading them to a fraudulent website designed to steal their credentials.

  8. Credential Stuffing

    • Definition: An attack that uses leaked usernames and passwords from one breach to gain unauthorized access to accounts on other services.

    • Example: An attacker takes email and password combinations from a data leak and uses them to try and log into various online services, exploiting users who use the same credentials across different sites.

  9. Zero-Day Exploit

    • Definition: An attack that occurs on the same day a weakness is discovered in software, before the software developer has had a chance to issue a fix.

    • Example: An attacker identifies a flaw in a popular software application and immediately exploits it before the vendor can release a patch.

  10. Insider Threats

    • Definition: Threats that come from individuals within the organization, such as employees or contractors, who misuse their access to sensitive information.

    • Example: A disgruntled employee intentionally leaks confidential company data or sabotages systems due to personal grievances.


Question Set: Cybersecurity Model Selection

Question 1: 10 Mark Question on Cybersecurity Model Selection

Scenario: A medium-sized healthcare organization has experienced multiple security incidents in the past year, including a data breach involving patient records and a ransomware attack that led to service interruptions. The organization currently lacks a robust cybersecurity framework and is seeking to improve its security posture while ensuring compliance with healthcare regulations.


Question: Based on the scenario provided, suggest an appropriate cybersecurity model for the organization to adopt. Discuss your reasoning and the key components that should be included.Suggested Answer: In response to the scenario, I suggest adopting a Defense in Depth cybersecurity model. This model is suitable for the healthcare organization as it addresses multiple layers of security needed to protect sensitive patient data. Here are the key components to include:

  1. Physical Security: Ensure that servers and sensitive information are housed in secure facilities with access controls.

  2. Network Security: Implement firewalls, intrusion detection/prevention systems (IDS/IPS), and segmentation of networks to limit access to sensitive data.

  3. Data Encryption: Encrypt sensitive data at rest and in transit to protect it from unauthorized access and breaches.

  4. Endpoint Security: Deploy antivirus software, endpoint detection and response (EDR) solutions, and regular updates to mitigate risks from malware and ransomware.

  5. User Training and Awareness: Conduct regular training sessions for employees to recognize phishing attempts and other social engineering tactics.

  6. Incident Response Plan: Develop and test an incident response plan that details how to respond to security incidents, including data breaches and ransomware attacks.

  7. Compliance and Governance: Ensure policies are in place to comply with regulations like HIPAA that govern the handling of patient data.

Question 2: 10 Mark Question on Risk Assessment Model

Scenario: An e-commerce company is facing increased cyber threats, including frequent phishing attacks and attempts to compromise customer accounts. The IT department is overwhelmed, and the management is considering implementing a risk assessment model to better understand and mitigate their exposure to these threats.


Question: Propose a risk assessment model suitable for the e-commerce company. Explain the steps involved and how it will help in managing cybersecurity risks.Suggested Answer: I recommend the NIST Cybersecurity Framework for the e-commerce company, which focuses on identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents. Here are the steps involved:

  1. Identify: Conduct an inventory of assets, including customer data, payment systems, and IT infrastructure. Understand vulnerabilities and potential threats.

  2. Protect: Implement security measures like two-factor authentication (2FA), employee training, and secure payment processing.

  3. Detect: Utilize automated tools to monitor network activity and detect potential threats in real-time.

  4. Respond: Create an incident response strategy that includes communication plans and defined roles for team members during a security incident.


  5. Recover: Establish and test recovery plans to restore operations and minimize damage after an incident.This framework will assist the company in proactively managing cybersecurity risks by providing structured guidelines and ensuring compliance with industry standards.

Question 3: 10 Mark Question on Compliance Model

Scenario: A financial institution is struggling to meet regulatory compliance due to increasingly strict data protection laws. Following a recent audit, there were significant gaps found in their data protection measures. The management wants to implement a compliance model to avoid penalties and enhance their security posture.


Question: Suggest a compliance model that would be suitable for the financial institution, detailing the necessary components and benefits.Suggested Answer: The ISO/IEC 27001 compliance model is well-suited for the financial institution. This international standard provides a systematic approach to managing sensitive company information to ensure it remains secure. Key components include:

  1. Information Security Policy: Develop policies that outline the institution's commitment to protecting data.

  2. Risk Assessment: Regularly conduct risk assessments to identify and address potential threat vectors and vulnerabilities.

  3. Access Control: Implement strict access control mechanisms, ensuring that only authorized personnel have access to sensitive information.

  4. Incident Management: Establish procedures for managing and reporting information security incidents.


  5. Training and Awareness: Conduct ongoing training for employees regarding data protection practices and compliance responsibilities.By adopting the ISO/IEC 27001 model, the institution not only aligns with regulatory requirements but also builds customer trust and protects against potential data breaches.