Information- Security

Information Security: Definitions and Goals

• Security is the state of being free from danger; it is the goal of security and the measure taken to ensure safety (the process of security).
• As security is increased, convenience is often decreased: the more secure something is, the less convenient it may be to use.
• By the end of this module you should be able to define information security, explain its principles, identify threat actors and their motives, describe how attacks occur, and understand their impact; and list various information security resources.

Principles of Security (CIA Triad and Access Control)

• The three types of security principles are protections, and the CIA triad: Confidentiality, Integrity, Availability.
• Confidentiality: ensures that only approved individuals may access information.
• Integrity: ensures information is correct and unaltered.
• Availability: ensures information is accessible to authorized users.
• Controlling access to information involves:
  • Authentication: verifying that a user’s credentials are authentic.
  • Authorization: granting permission for a user to take a particular action.
  • Accounting: recording who accessed the network, what resources were accessed, and when they disconnected.

Security Controls

• A security control is a safeguard employed within an enterprise to protect the CI of information.
• Types of controls include:
  • Deterrent controls
  • Preventive controls
  • Detective controls
  • Compensating controls
  • Corrective controls
  • Directive controls

Cybersecurity vs Information Security

• Cybersecurity typically involves practices, processes, and technologies to protect devices, networks, and programs that process and store data in electronic form.
• Information security protects processed data that is essential in an enterprise environment.

Confidentiality in Practice (Exam Cue)

• Question: Which CIA element ensures that only authorized parties can view protected information?
• Answer: Confidentiality.
• Examples of confidentiality tools: encryption of credit card numbers on a web server; door locks to prevent access to servers; access controls.
• Confidentiality can involve a range of tools from software to physical security.

Threat Actors and Their Motives

• A threat actor is an individual or entity responsible for attacks (also called attacker).
• Target categories in financial crime include individuals, enterprises, and governments.
• Threat actors can be categorized as:
  • Unskilled attackers: lack technical knowledge; use easy-to-use tools that are freely available or cheap; motivation is usually data exfiltration or service disruption.
  • Shadow IT: bypassing corporate approval for technology purchases; motivation is often ethical, but security is weakened.
  • Organized crime: highly centralized groups engaged in illegal activities; moved into cybercrime; motivation is financial gain.
  • Insiders: company employees, contractors, or business partners; motivation could be revenge or blackmail; hard to recognize attacks.
  • Hacktivists: ideology-driven actors; aim to disrupt or spread political messages; may break into websites and alter content or disrupt services.
  • Nation-state actors: state-sponsored attackers; conduct multi-year intrusion campaigns targeting sensitive information; use advanced tools (APT).
  • Others:
  • Competitors: steal information for competitive advantage (e.g., product research, customer lists).
  • Brokers: sell weaknesses to others.
  • Cyber terrorists: attack a nation’s network to cause disruption and panic (e.g., critical infrastructure).

Shadow IT: Ethical but Risky

• Shadow IT is bypassing corporate approval for technology purchases.
• Employee motivation is often ethical (sound moral principles) but can weaken security.
• Question: What is the motivation of an employee who practices shadow IT?
• Answer: Ethical.

Threat Vectors and Attack Surfaces

• A threat surface (attack surface) is the digital platform that threat actors target for exploits.
• Some attack surfaces are mainstream and consistently targeted; others are specialized and categorized (e.g., communications and supply chain).
• Common communications tools: email, text, instant messages, voice calls.
• Supply chain as a risk: a network that moves a product from creation to end user; each link can be a threat factor.
• Malware and supply chain infections can occur when software or hardware is compromised during manufacturing, storage, or distribution.
• Open source software risk: attackers can add malicious code to open source projects, which are then downloaded by victims.

Vulnerabilities: Where Attacks Exploit Systems

• A vulnerability is the state of being exposed to potential attack or harm.
• Cybersecurity vulnerabilities are categorized into:
  • Software
  • Hardware
  • Misconfigurations
  • Zero-day vulnerabilities
• Software vulnerabilities: predominantly found in OS software; attacks may include malicious updates.
• Hardware vulnerabilities: include difficulty patching firmware, legacy platforms, end-of-life (EOL) hardware.
• Misconfigurations: improper configuration settings leading to vulnerabilities.
• Zero-day vulnerabilities: exploited before anyone else knows they exist; zero days of warning; considered extremely serious.

Impact of Attacks

• A successful attack results in several negative impacts, which can be classified as data impacts and overall effects:
  • Availability loss: systems become inaccessible, leading to lost productivity and financial loss.
  • Data loss: destruction of data that cannot be recovered.
  • Data exfiltration: stealing data to distribute to others.
  • Data breach: unauthorized disclosure of data.
  • Identity theft: stealing personal information to impersonate someone (e.g., Social Security numbers, credit card numbers).
  • Reputational impact: damage to public perception of the enterprise.
  • Financial loss: direct/indirect costs associated with attacks.
  • Other data-related harms: deletion of patient data in healthcare, compromised research data, etc.

Information Security Resources

• Defenders have external cybersecurity resources to help ward off attacks, including frameworks, regulations, legislations, standards, benchmarks/guides, and information sources.

Frameworks

• An information security framework is a set of documented processes to define policies and procedures for implementing and managing security controls.
• The NIST Cybersecurity Framework (CSF) components:
  • Framework Core
  • Implementation Tiers
  • Profiles
• Core functions: $ext{Identify}, ext{Protect}, ext{Detect}, ext{Respond}, ext{Recover}$

Regulations and Legislations

• Regulations: regulatory compliance is the process of adhering to regulations.
• Categories of regulations:
  • Broadly applicable regulations
  • Industry-specific regulations
  • US state regulations
  • International regulations
• Legislations: laws enacted by governing bodies (national, territorial, state) that relate to information security; complexity can lead to a “hold pogue” of not always good cybersecurity outcomes.

Standards

• A standard is a document approved by a recognized standardization body that provides frameworks, rules, guidelines, or characteristics for products and processes.
• Example: PCI DSS (Payment Card Industry Data Security Standard).

Benchmarks / Secure Configuration Guides

• Benchmarks or secure configuration guides are provided by hardware manufacturers or software developers.
• They serve as guidelines for configuring devices or software to be resilient to attacks.
• These are typically platform/vendor-specific.

Information Sources

• Request for Comments (RFCs): documents authored by technology bodies, with input from engineers and scientists.
• Data feeds: continuously maintained databases of the latest cybersecurity incidents.
• Common data feeds include vulnerability feeds that provide information on the latest vulnerabilities.
• Adversary TTPs (Tactics, Techniques, and Procedures): database of threat actor behaviors and how they conduct attacks.

Knowledge Check (Key Takeaway)

• Question: What is another name for attack surface?
• Answer: Threat vector.
• Explanation: An attack surface is also called a threat vector; both refer to the digital platforms threat actors target for exploits.