Cybersecurity and Information Security Summary

الفضاء السيبراني وأمن المعلومات

1. The Cyberspace

  • Importance: The cyberworld enables information activities for the real world.
  • Special Features:
    • Cost: Lower costs.
    • Speed: Faster operations.
    • Safety: More safety.
    • Quality: Better quality.
    • Opportunities: Wider opportunities.
    • Availability: 24/7 accessibility.
  • Activities:
    • Digital Economy: Includes e-trade and e-work.
    • Digital Industry: Covers both hardware and software.
    • E-Government: Focuses on quality, agility, efficiency, and effectiveness.
  • Impact:
    • Administrative.
    • Social.
    • Knowledge-based.
    • Economic.
    • Political.
    • Development of an e-society and digital economy.
  • Assessment Example (e-Gov):
    • EGDI (E-Government Development Index).
      • HCI (Human Capital Index) (1/3)(1/3).
      • TII (Telecom Infrastructure Index) (1/3)(1/3).
      • OSI (Online Services Index) (1/3)(1/3).

2. Cybersecurity

  • Framework: A general structure for cybersecurity.
  • Essential Requirements:
    • Confidentiality: Ensuring that information is not disclosed to unauthorized entities.
    • Integrity: Protecting the accuracy and completeness of assets.
    • Availability: Ensuring accessibility and usability upon demand by an authorized entity.
  • Additional Requirements:
    • Reliability: Consistency in behavior and results.
    • Accountability: Responsibility of an entity for its actions and decisions.
    • Authenticity: Verifying that an entity is what it claims to be.
    • Non-repudiation: Proving the occurrence of a claimed event or action and its originating entities.
  • Foes & Friends:
    • Hackers:
      • White Hat: Friends who conduct tests and seek to prevent breaches.
      • Grey Hat: Not enemies but may want to make a point.
      • Black Hat: Enemies with the goal of causing harm.

3. Assets

  • Basic Assets:
    • Information/Info Services: Information that is stored, processed, or communicated.
    • Software: Computer programs.
    • Hardware: ICT equipment.
    • People: Skills and experience.
    • Intangible Assets: Reputation and image.
  • Critical Infrastructure Assets (CI):
    • Critical public services infrastructure.
    • Critical Information Infrastructure (CII).
    • Examples: Banks, electricity, transportation, communication, education, water, healthcare, sanitation, and other critical services.

4. Risks

  • Malicious Objectives:
    • Spying: Monitoring activities and exploiting them.
    • Destruction: Damaging ICT/CII/CI infrastructure.
    • Theft: Stealing information and using it (identities, cards, etc.).
  • Sources:
    • Social Engineering: Circumventing security measures.
    • Cyberwarfare: Direct or proxy warfare that may lead to actual war.
    • Malicious Software (Malware).
    • Hackers.
  • Event: Occurrence of a particular set of circumstances.
  • Info. Sec. Event: Identified state of a system, service, or network indicating a possible breach of IS policy, failure of controls, or a previously unknown security-relevant situation.
  • Info. Sec. Incident: A single or series of unwanted or unexpected IS Events with a significant probability of compromising business operations and threatening IS.
  • Info. Sec Risk: Potential that a threat will exploit a vulnerability of an asset, causing harm to the organization.
  • Threats: Potential cause of an unwanted incident that may result in harm to a system or organization.
  • Vulnerability: Weakness of an asset or control that can be exploited by a threat.
  • Attack: Attempt to destroy, expose, alter, disable, steal, or gain unauthorized access to an asset.
  • Examples:
    • Spam: Unsolicited messages that may contain malicious programs or phishing attempts.
    • Phishing: Deceptive attempts to acquire sensitive information.
    • Data Breach: Unauthorized access or distortion of data for malicious purposes.
    • Identity Theft: Impersonating someone to gain benefits.
    • Information Leakage: Data breach of CIA frequently causes information leakage from PII (Examples: financial data, personal health information PHI
    • Personal Identifiable Information (PII)

5. Protection Controls

  • Objective: A statement describing what is to be achieved as a result of implementing controls.
  • Control: A safeguard or countermeasure.
  • Access Control: Ensuring that access to assets is authorized and restricted based on business and security requirements.
  • Types of Controls:
    • Preventive Control: Contributing to preventing risk.
    • Detective Control: Contributing to discovering risk.
    • Corrective Control: Contributing to correcting risk.
  • Control Impact:
    • Impact on: Confidentiality / Integrity / Availability (May be other requirements).

6. A Comprehensive View

  • Dimensions: People/Organization/State/World.
  • Key Requirements: Confidentiality/Integrity/Availability (CIA).
  • Elements: Strategy, Technology, Organization, People, Environment (STOPE).
  • Target: CIA.
  • Means: PDC (Prevent, Detect, Correct).

7. Future Outlook

  • Building expertise and collaboration toward an effective cyberspace.