Cybersecurity

Unit 1: Introduction to Cybersecurity & First Principles

1. Defining Security, Assets, Threats, and Controls

• Security Concept: Protection of valuable assets from harm, misuse, loss, or disruption.

  PPTX

  
  

• Core Terminology:

  • Asset: Something valuable to an individual or organization (e.g., data, money, accounts, services, reputation, intellectual property, AI models).

    PPTX+ 1

    
    

  • Threat: A potential cause of harm or loss (e.g., attackers, accidents, disasters, bugs, malicious insiders).

    PPTX+ 1

    
    

  • Vulnerability: A flaw or weakness in a system that can be exploited (e.g., missing security patch, weak password, misconfigured bucket).

    PPTX+ 1

    
    

  • Attack Vector: The route or path used by a threat actor to exploit a vulnerability (e.g., phishing emails, exposed APIs, stolen laptops).

    PPTX

    
    

  • Control / Mitigation: Safeguards or countermeasures put in place to reduce risk (e.g., MFA, encryption, firewalls, backups).

    PPTX+ 2

    
    

  • Risk: The combination of the likelihood of an event occurring and the severity of its potential impact.

    PPTX+ 1

    
    

• Tradeoffs: Security controls introduce operational costs, usability friction, and complexity.

  PPTX

  
  

2. The CIA Triad

The three fundamental goals of information security:

PPTX

• Confidentiality: Ensures data is accessible only to authorized entities.

  PPTX

  
  

• Integrity: Ensures information and systems are accurate, complete, and protected against improper modification or tampering.

  PPTX

  
  

• Availability: Ensures systems, networks, and data are operational and accessible when needed by authorized users.

  PPTX

  
  

3. First Principles & Core Security Design Principles

• Know What Matters: Identify assets, trust boundaries, users, and critical dependencies.

  PPTX

  
  

• Assume Systems Fail: Design architectures under the assumption that individual controls or components will fail.

  PPTX

  
  

• Minimize Trust: Limit access strictly to what is necessary.

  PPTX

  
  

• Make Risk Visible: Maintain logging, continuous monitoring, and testing to observe failures.

  PPTX

  
  

• Specific Design Principles:

  • Least Privilege: Users and applications receive only the minimum permissions necessary to complete their functions.

    PPTX

    
    

  • Defense in Depth: Deploy multiple layered controls so that the failure of a single mechanism does not cause total compromise.

    PPTX

    
    

  • Secure Defaults: Out-of-the-box configurations default to the highest security setting.

    PPTX

    
    

  • Fail Safely: When a component fails, it defaults to a secure state rather than an open/unprotected state.

    PPTX

    
    

  • Minimize Attack Surface: Disable unnecessary features, services, and open ports to reduce entry points.

    PPTX

    
    

  • Separation of Duties: Divide critical tasks among multiple individuals or components to prevent single-point control or fraud.

    PPTX

    
    

  • Verify, Then Trust Carefully: Inspect and authenticate identity, input data, and behavior explicitly.

    PPTX

    
    

4. Threat Modeling & The STRIDE Framework

• Threat Modeling Loop:

  1. What are we building or protecting?

     PPTX

     
     

  2. What can go wrong?

     PPTX

     
     

  3. What will we do about it?

     PPTX

     
     

  4. Did we do enough?

     PPTX

     
     

• STRIDE Threat Modeling Categories:

Unit 2: Ethics, Society, and Responsible AI

1. Four Ethical Lenses & Professional Duties

• Ethical Frameworks / Lenses:

  • Consequentialism: Judging the moral correctness of actions strictly by their outcomes or results (Mill, Bentham).

    PPTX

    
    

  • Deontology: Judging actions by their adherence to explicit duties, rules, or obligations, regardless of outcome (Kant, Ross).

    PPTX

    
    

  • Virtue Ethics: Judging actions based on the internal character traits and virtues they foster (Aristotle).

    PPTX

    
    

  • Care / Relational Ethics: Judging actions based on how well they preserve and honor human relationships and vulnerability.

    PPTX

    
    

• Three Professional Duties:

  • Competence: Maintain current technical skills and decline responsibilities that cannot be safely performed.

    PPTX

    
    

  • Integrity: Communicate risks truthfully to stakeholders, even when the news is unwanted.

    PPTX

    
    

  • Non-Maleficence: "First, do no harm" — avoid actions that leave people or systems worse off.

    PPTX

    
    

• Professional Codes of Ethics: ACM Code, IEEE/IEEE-CS, (ISC)² Code (emphasizes protecting society first), and ISACA.

  PPTX

  
  

2. Privacy vs. Security & Regulatory Landscape

• Privacy vs. Security Differentiation:

  • Privacy: The right of individuals to control how information about themselves is collected, used, shared, and retained (freedom from observation).

    PPTX

    
    

  • Security: Technical and operational protections (Confidentiality, Integrity, Availability) applied to safeguard assets from threats (freedom from attack).

    PPTX+ 1

    
    

• The "Nothing to Hide" Fallacy: Incorrectly assumes privacy is only meant to conceal wrongdoing. Ignores issues of data aggregation, context collapse, future reinterpretation, and chilling effects on civil liberties.

  PPTX

  
  

• Major Regulatory Standards:

  • GDPR (EU): Requires explicit consent, data minimization, right to erasure, and levies fines up to 4% of global annual revenue.

    PPTX

    
    

  • CCPA / CPRA (California): Grants consumer rights to opt out of data sales, know collected data, and request deletion.

    PPTX

    
    

  • HIPAA (US Health): Regulates privacy and security of health data; requires breach notification within 60 days.

    PPTX

    
    

  • FERPA (US Education): Protects the privacy of student educational records.

    PPTX

    
    

3. Vulnerability Disclosure Models

• Full Disclosure: Publicly publishing bug details immediately without notifying the vendor first. Max pressure on vendors, but arms attackers prior to patch availability.

  PPTX

  
  

• Coordinated Disclosure:

  • Security researchers report vulnerabilities privately to the vendor first.

    PPTX

    
    

  • Vendor is given time to develop and test a patch (standard timeline: ~90 days).

    PPTX

    
    

  • Public release of patch, CVE identifier, and credit occurs simultaneously.

    PPTX

    
    

  • Safe Harbor: Commitments by vendors not to pursue legal action under laws like the CFAA against researchers acting in good faith.

    PPTX

    
    

4. Dual-Use Technology & AI Ethics

• Dual-Use Technology: Tools or techniques that serve defensive, legitimate purposes as well as offensive/harmful applications (e.g., Nmap, Burp Suite, AI foundation models).

  PPTX

  
  

• AI Offensive Applications: Automated phishing generation, voice/video cloning (vishing, deepfakes), automated credential/secret scanning, polymorphic malware generation, and adversarial ML attacks.

  PPTX

  
  

• AI Defensive Applications: SOC triage and alert summarization, log anomaly detection, automated code vulnerability auditing, and automated incident response support.

  PPTX

  
  

• Academic Integrity Guidelines (RIT Policy D08.0):

  • GenAI use without instructor permission constitutes unauthorized assistance.

    PPTX

    
    

  • Permitted AI assistance requires explicit citation.

    PPTX

    
    

  • Generating code or analysis without understanding it line-by-line is prohibited.

    PPTX

    
    

• Governance Frameworks: NIST AI Risk Management Framework (AI RMF 100-1), ISO/IEC 42001, EU AI Act.

  PPTX

  
  

Unit 3: Security Risk Analysis & Governance

1. The Risk Equation & Core Definitions

• Risk Formula:

  Risk=Asset+Threat+Vulnerability

  (Risk is the potential for loss when a threat exploits a vulnerability on a valuable asset).

  PPTX

  
  

• Goal of Risk Analysis: To quantify and evaluate risk in order to prioritize security investments and operational decisions—not to eliminate risk entirely.

  PPTX

  
  

2. Quantitative vs. Qualitative Risk Analysis

• Quantitative Analysis: Uses numeric data and financial values to calculate exact monetary impact.

  PPTX

  
  

  • Single Loss Expectancy (SLE): The financial loss expected each time a threat occurs.

    PPTX

    
    

    SLE=Asset Value (AV)×Exposure Factor (EF)

    (Where Exposure Factor is the percentage of the asset lost in an incident).

    PPTX

    
    

  • Annualized Rate of Occurrence (ARO): The estimated frequency with which a threat occurs per year.

    PPTX

    
    

  • Annualized Loss Expectancy (ALE): The expected annual financial loss for a specific risk.

    PPTX

    
    

    ALE=SLE×ARO

• Qualitative Analysis: Uses categorical ratings (e.g., High, Medium, Low) based on expert judgment. Faster and easier when precise monetary data is unavailable.

  PPTX+ 1

  
  

• Risk Score Matrix:

  Risk Score=Probability (Likelihood)×Impact (Consequence)

  (Typically scored on a scale from 1–10 each).

  PPTX

  
  

3. Four Risk Response Strategies

1. Avoid: Modify business processes so the risk no longer applies (e.g., offloading payment processing to a third party to avoid holding credit card data).

   PPTX

   
   

2. Mitigate: Implement security controls to reduce the likelihood or impact of the risk (e.g., enforcing MFA, network segmentation).

   PPTX+ 2

   
   

3. Transfer: Shift the financial burden of the risk to a third party (e.g., purchasing cyber insurance).

   PPTX

   
   

4. Accept: Consciously and formally document the decision to live with the risk due to low probability, low impact, or high mitigation costs.

   PPTX

   
   

4. Classification of Security Controls

• By Nature:

  • Physical: Locks, fences, environmental suppressors, badge access.

    PPTX

    
    

  • Procedural/Administrative: Security policies, training, background checks, incident response plans.

    PPTX+ 1

    
    

  • Technical/Logical: Firewalls, ACLs, EDR/XDR, encryption, access control lists.

    PPTX+ 2

    
    

  • Legal/Regulatory: Compliance requirements, vendor contracts, privacy legislation.

    PPTX

    
    

• By Timing/Function:

  • Directive: Mandates or guides required behavior (policies, user agreements).

    PPTX

    
    

  • Preventative: Stops unauthorized or bad actions before they occur (access control, blocking ports).

    PPTX+ 1

    
    

  • Detective: Identifies and flags security incidents in progress (IDS, audit logging).

    PPTX+ 2

    
    

  • Corrective: Limits damage and restores systems during/after an event (isolating infected hosts, backups).

    PPTX+ 2

    
    

  • Forensic: Enables post-incident investigation and reconstruction of events (cloud/system logs).

    PPTX

    
    

5. Governance Frameworks & Strategic Assessment

• NIST Cybersecurity Framework (CSF) 2.0 Core Functions:

  1. Govern: Establishes organizational context, cybersecurity strategy, risk tolerance, and executive accountability.

     PPTX

     
     

  2. Identify: Inventories assets, systems, data, and organizational risks.

     PPTX

     
     

  3. Protect: Deploys safeguards to ensure delivery of critical services (access control, training, data security).

     PPTX

     
     

  4. Detect: Implements mechanisms to identify cybersecurity events promptly.

     PPTX

     
     

  5. Respond: Takes action regarding detected cybersecurity incidents.

     PPTX

     
     

  6. Recover: Restores capabilities or services impaired by a security incident.

     PPTX

     
     

• Other Major Frameworks:

  • ISO/IEC 27001: International standard for Information Security Management Systems (ISMS); critical for global supply chains.

    PPTX

    
    

  • SOC 2: Trust services criteria audit framework for cloud, SaaS, and service providers.

    PPTX

    
    

  • NIST SP 800-37: Risk Management Framework (RMF) used by US federal agencies and contractors.

    PPTX

    
    

• PESTLE Risk Context Analysis: Framework to identify non-technical macro-environmental risks across Political, Economic, Social, Technological, Legal, and Environmental categories.

  PPTX

  
  

• Risk Register: A central, active tracking document listing identified risks, their probability/impact scores, assigned owners, and current remediation status.

  PPTX

  
  

• Core vs. Non-Core Risks: Core risks directly threaten an organization's central operational mission and must always be prioritized over non-core risks.

  PPTX

  
  

Unit 4: Networking Fundamentals & Protocols (Part I & II)

1. OSI Model Layers & Encapsulation

Networking architecture breaks complex communications into 7 modular layers:

PPTX

• Encapsulation: As data moves down the OSI stack (from Layer 7 to Layer 1), each layer adds its own header information.

  PPTX

  
  

• Decapsulation: When data is received, it travels up the OSI stack, and each layer removes its corresponding header.

  PPTX

  
  

2. Local vs. Remote Communication & Addressing

• Addressing Requirements: Network traffic delivery requires 4 essential addresses: Source MAC, Destination MAC, Source IP, and Destination IP.

  PPTX

  
  

• Local Communication: Occurs when the source and destination are on the same subnet. Traffic is delivered directly using Destination MAC addresses.

  PPTX+ 1

  
  

• Remote Communication: Occurs when the destination IP resides on a different network. The sender encapsulates the packet with the Default Gateway's MAC address as the destination MAC, passing the packet to the router for forwarding.

  PPTX+ 2

  
  

• Address Resolution Protocol (ARP): Translates a known Layer 3 IP address into a Layer 2 MAC address on local segments. Switches maintain a MAC Address Table / CAM Table mapping MAC addresses to physical switch ports.

  PPTX+ 1

  
  

• Subnet Masks: Binary bitmasks used by hosts to determine whether a destination IP is local or remote by performing a bitwise logical AND operation.

  PPTX

  
  

3. Dynamic Host Configuration Protocol (DHCP)

• Purpose: Automatically assigns network configuration information to devices entering a network.

  PPTX

  
  

• The DORA Exchange:

  1. Discover: Client broadcasts a packet looking for available DHCP servers (Source: 0.0.0.0, Destination: 255.255.255.255).

     PPTX

     
     

  2. Offer: DHCP server broadcasts or unicasts a proposed IP address and lease terms.

     PPTX

     
     

  3. Request: Client broadcasts an acceptance of the offered address.

     PPTX

     
     

  4. Acknowledge (ACK): Server confirms the assignment and hands over full network configuration.

     PPTX

     
     

• Configuration Parameters Handed Out: Assigned IP Address, Subnet Mask, Default Gateway IP, DNS Server IP, and Lease Duration.

  PPTX

  
  

• Rogue DHCP Threat: An unauthorized DHCP server on the network that responds to Discover packets faster than the legitimate server, handing out malicious gateway or DNS settings to perform Man-in-the-Middle (MitM) attacks.

  PPTX

  
  

4. Domain Name System (DNS)

• Purpose: Resolves human-readable domain names (FQDNs) into routable IP addresses.

  PPTX+ 1

  
  

• Resolution Steps (Client Local Cache First):

  1. Browser Cache / OS DNS Cache

     PPTX

     
     

  2. Recursive Resolver (ISP or designated enterprise DNS)

     PPTX

     
     

  3. Root Nameservers (directs query to TLD servers)

     PPTX

     
     

  4. Top-Level Domain (TLD) Nameservers (handles .com, .edu, etc.)

     PPTX

     
     

  5. Authoritative Nameservers (holds the actual DNS records for the specific domain)

     PPTX

     
     

• Time To Live (TTL): A numerical value in seconds determining how long resolvers and hosts are permitted to cache a DNS record before re-querying.

  PPTX

  
  

5. Routing, Network Address Translation (NAT), and Proxies

• Routing: Routers inspect destination IP addresses and query internal Routing Tables to make "next-hop" forwarding decisions. Routers strip the incoming Layer 2 frame header and apply a new Layer 2 frame header for each outgoing link.

  PPTX+ 2

  
  

• Private IP Ranges (RFC 1918): Non-routable addresses on the public internet:

  PPTX

  
  

  • 10.0.0.0/8

  • 172.16.0.0/12

  • 192.168.0.0/16

• NAT (Network Address Translation): Maps internal, private IP addresses to a public IP address.

  PPTX

  
  

  • Maintains a NAT Translation Table tracking source IPs and ephemeral source port numbers.

    PPTX

    
    

  • Rewrites outgoing packet source IP/ports and incoming packet destination IP/ports, making internal hosts invisible to public destinations.

    PPTX

    
    

• Proxies: Application-layer intermediaries that terminate client connections and make requests on their behalf.

  PPTX+ 1

  
  

  • Forward Proxy: Positioned on the client side for content filtering, monitoring, and caching.

    PPTX

    
    

  • Reverse Proxy: Positioned in front of web servers to handle load balancing, TLS termination, and protect internal resources.

    PPTX

    
    

Unit 5: Network Security Controls & Countermeasures

1. Network Protocol Vulnerabilities across TCP/IP Layers

• Layer 1 (Physical): Radio frequency jamming, signal eavesdropping.

  PPTX

  
  

• Layer 2 (Data Link): MAC address spoofing, unauthenticated ARP responses causing ARP Poisoning / ARP Cache Poisoning.

  PPTX

  
  

• Layer 3 (Network): IP spoofing, unauthenticated routing protocols, machine-in-the-middle positioning.

  PPTX

  
  

• Layer 4 (Transport): Predictable TCP sequence numbers leading to TCP Session Hijacking or sequence prediction attacks.

  PPTX

  
  

• Layer 5-7 (Application): Unauthenticated DNS responses leading to DNS Cache Poisoning, email spoofing.

  PPTX

  
  

2. Traffic Filtering: Firewalls & Access Control Lists (ACLs)

• Firewall Concept: Enforces boundary access-control policies between trusted and untrusted networks. A firewall does not fix a host's vulnerability; it prevents unauthorized network access to the vulnerable service.

  PPTX+ 1

  
  

• Stateful Inspection: Tracks active connection states (e.g., TCP handshakes) and allows inbound traffic only if it is a legitimate response to an established outbound request.

  PPTX

  
  

• ACL Types & Rules:

  • Standard ACL: Filters traffic based solely on Source IP address.

    PPTX

    
    

  • Extended ACL: Filters traffic based on Source IP, Destination IP, Protocol type (TCP/UDP), and Port numbers.

    PPTX

    
    

  • Implicit Deny: The mandatory final rule in every ACL that automatically drops any traffic not explicitly permitted by a preceding rule.

    PPTX

    
    

3. Intrusion Detection & Prevention Systems (IDS / IPS)

• IDS (Intrusion Detection System): Operates passively (e.g., via a span/mirror port); monitors traffic and generates alerts upon detecting suspicious patterns without stopping traffic.

  PPTX

  
  

• IPS (Intrusion Prevention System): Deployed inline with network traffic; actively inspects and drops malicious packets in real time.

  PPTX

  
  

• Detection Methodologies:

  • Signature-Based: Compares network traffic against known attack patterns or signatures. Highly accurate for known threats, but completely blind to zero-day attacks.

    PPTX+ 1

    
    

  • Anomaly-Based: Establishes a baseline of normal network activity and flags statistical deviations. Effective for detecting zero-day threats, but prone to false positives.

    PPTX+ 1

    
    

  • Policy-Based: Flags traffic that violates organizational security rules regardless of threat level.

    PPTX

    
    

4. Network Isolation & Segmentation

• VLAN Segmentation: Logically divides Layer 2 broadcast domains on switches to restrict lateral movement of attackers.

  PPTX

  
  

• Demilitarized Zone (DMZ): A perimeter network segment hosting public-facing services (e.g., web servers) to isolate them from the sensitive internal network.

  PPTX

  
  

• Air Gapping: Complete physical and logical separation of a system from all external networks.

  PPTX

  
  

• Purdue Model: A structural framework used in Operational Technology (OT) and Industrial Control Systems (ICS) to segment IT networks from physical plant floor controls using layered DMZs.

  PPTX

  
  

5. Wireless & Cellular Security

• Signature Vulnerability of Wireless: Radio waves broadcast open signals through physical barriers, making the physical medium accessible to any nearby receiver.

  PPTX

  
  

• Wi-Fi Security Evolution:

• PHY Layer Security Mechanisms: Beamforming (spatial targeting), Spread Spectrum (frequency hopping), and RF Fingerprinting.

  PPTX

  
  

• Cellular Threats: IMSI Catchers (fake cell towers that harvest device identifiers and perform MitM attacks) and SIM cloning.

  PPTX

  
  

Key Exam Formulas & Decision Quick-Reference

Quantitative Risk Formulas

• SLE=Asset Value (AV)×Exposure Factor (EF)

  
  

  PPTX

  
  

• ALE=SLE×Annualized Rate of Occurrence (ARO)

  
  

  PPTX

  
  

• Risk Score=Probability (1–10)×Impact (1–10)

  
  

  PPTX

  
  

Decision Framework Matrix