Week 2 to 8

What are 3 ISS? (3)

Acronym: ISS

Death, proprietary information, privacy and theft

Theft, loss of confidence, and validity

Lost productivity, disruption of C2, defense, and emergency services.

Concepts of ISS (3)

System that stores, transmit, and process information.

The protection of information.

The protection of systems that store, transmit, and process information.

It is our assurance (confidence) in the protection of our information / Information Security Services.

Acronym: IA

Making sure our information is protected from unauthorized disclosure.

Making sure the information we process, transmit, and store has not been corrupted or adversely manipulated.

Making sure that the information is there when we need it and gets to those who need it.

Generally concerned with confidentiality

Generally concerned with availability

• The term adopted by the USG

• The virtual environment of information and interactions between people.

• Telecommunications Network Infrastructure

• Information Systems

• Internet

It is an approach to cybersecurity in which a series of defensive mechanisms are layered in order to protect valuable data and information.

Defense in Depth Layered Security (Onion Model (7))

It is the protection and proper handling of sensitive information

Acronym: PII

Example of PII (5)

It is the process of identifying, assessing, and mitigating (reducing) risks to an acceptable level.

It must be identified, classified and analyzed to assess potential damage (loss) to company.

It is difficult to measure and quantify, however, we must prioritize the risks and attempt to address them.

Defensing against unauthorized actions that would compromise or cripple information systems and networks. It protect, monitor, analyze, detect, and respond to network attacks, intrusions, or disruptions.

CIA Triad (Information Security Concepts)

Operational Model of Computer Security

Users should have only the necessary (minimum) rights, privileges, or information to perform their tasks (no additional permission)

“Deny all” authorization and access (backlisted) unless specifically allowed (white list) Default security rule for firewalls, routers, etc.

Ensures tasks are broken down and are accomplished / involve by more than one individual. Check and balance system.

Rotation individuals through jobs/tasks. Organization does not become dependent on a single employee.

Described as always using simple solutions when available. Protection mechanism should be small and simple.

Refers to the concept that each and every request should be verified.

States the mechanisms used to access resources should be dedicated and not shared.

Refers to the users’ acceptance of security measures.

• Defense in Depth

• Redundancy

• No single point of Failure

Control what a subject can perform or what objects the subject can interact.

• Verify the identity of a subject. (Who You Are)

• Involves identification

• Passwords, cards, biometrics (fingerprints), etc.

• Digital Certificates

Verifies what a subject is authorized to do.

Talk individuals into divulging information that they normally would never have. Used to gain information on identities, access, or authorization.

Constraints of behavior on systems and people. Specifies activities that are required, limited, and forbidden

Required characteristics of a system or process. Often the same as or similar to the policy. Specifies what should be done, not how to do it.

What products, technical methods will be used to support policy.

Step by step instructions

Classifications of Information (6)

Seven Domain of a Typical IT Infrastructure (7)

This domain includes people or employees. An HR department maintains records on employees. These can be manual records, such as folders held in filing cabinets, or files held on servers.

It includes PC’s used by employees either typical desktop PC’s, mobile computers, or laptops.

Assets in the Workstation Domain have Two Risks to Address (2)

An organization has a significant investment in these systems.

As ___________, fixes, and patches are released, they need to be applied to the systems.

It includes all the elements used to connect systems and servers together.

Acronym: LAN

Acronym: WAN

It is the area where your internal LAN connects to the WAN.

This domain includes any servers that have direct access to the Internet.

This give users access to an internal network via an external location.

Example of Remote Access Domain

When used, clients and servers have modems and access to phone lines.

When used, the server has a public IP address available on the Internet.

Acronym: VPN

It includes servers used to host server applications.

Example of System/Application Domain (3)

This can be a single _______ server. It can also be a larger __________ solution, including both front-end and back-end server configurations.

This can be an Oracle or Microsoft SQL server. It can be a single server or a group of servers.

It host web sites and serve them to Web clients. A single ______ server can host a single Web site or hundreds of Websites.

It is the essential foundation of an effective information security program.

Are sanctioned by senior management

Built on sound policy and carry the weight of policy

Procedures and guidelines include detailed steps required to meet the requirements of standards.

The policy development project can be guided by the ________ process.

Obtain support from senior management, and active involvement of IT management, specifically the CIO

It produce New or recent risk assessment or IT audit documenting the current information security needs of the organization.

• How the policies will be distributed

• How verification of the distribution will be accomplished

• Specifications for any automated tools

• Writing the policies

• Making certain the policies are enforceable as written

• Policy distribution is not always straightforward

Maintain and modify the policy as needed to ensure that it remains effective as tool to meet changing threats

Type of Information Security Policy (3)

It is the network of physical objects or “things” embedded with electronics, software, sensors, and network connectivity, which enables these objects to collect and exchange data.

Acronym: IoT

The _________ in the context of IOT, is an entity or physical object that has a unique identifier, an embedded system and the ability to transfer data over a network.

Evolution of IoT (3)

• Static Web Pages

• No interaction / content distribution from the users

• Proprietary protocols and applications

• Publication oriented

• Dynamic Content

• Connecting with other people via social networking

• Community tagging

• Voting

• Circles

• E-commerce boom

• Intelligent and Omnipresent

• Increase in Open Standards

• MOOCs (Massive Open Online Course)

• Advanced protocols and algorithms

• Context based Content generation using MachineLearning, AI etc.

Conceptualized in the early 2000’s, at MIT’s Auto-ID lab by Kevin Aston

Conceptualized in the early 2000’s, at MIT’s Auto-ID lab by ____________________

It is a system where items in the physical world, and sensors within or attached to these items, are connected to the Internet via wireless or wired internet connections

“The number of transistors in a dense integrated circuit doubles approximately every two years”

According to ________________ IoT is simply the point in time when more “things or objects” were connected to the Internet than people.

The IoT Stack - Architectural Reference Model (5)

Recreating the functionality of real-world objects at the Machine level. Ease of reusability, if it possesses well defined representation

A software infrastructure that glues together the networking hardware, operating system, network stacks and applications. It sits between the underlying protocols and the application layer.

Challenges and Solutions of IoT (6)

It is the next to IoT

Acronym: IoE

It is defined as a specific set of codes or an application, specifically designed to harm and/or to gain access to a targeted computer, or spread across multiple computers; over the use of a network or a data storage device.

Malicious software consists of any harmful piece of program.

Different Types of Malwares (8)

The First Malware of the World

The first malware was a virus that appeared in the realms of computer, and that virus is known as the _______________.

The _________ virus appeared on Apple Mac in 1982, and was created by Rich Skrenta from Pennsylvania, United States.

The “Elk Cloner” virus appeared on Apple Mac in _________, and was created by Rich Skrenta from Pennsylvania, United States.

First Most Damaging Virus

This was programmed by two brothers; Amid Farooq Alvi and Basit Farooq Alvi from Lahore, Pakistan in 1986.

This was programmed by two brothers; Amid Farooq Alvi and Basit Farooq Alvi from Lahore, Pakistan in _________.

It was the first full-stealth virus on MS-DOS. It infects 360KB-, 5.25-inch floppy disks.

_______ focused targeting on Colleges and Universities

_______ started targeting businesses

Malicious hackers are bow attacking computers and networks at a rate of one attack every ___________ (University of Maryland)

______ of surveyed organizations were affected by a successful cyber attack in 2019 (CyberEdge Group 2020 Cyberthreat Defense Report)

Top 10 Most Valuable Information to Cyber Criminals

Top 10 Biggest Cyber Threats to Organizations

Piece of software that infects programs Modifies them to include a copy of the _______, replicates and goes on to infect other content, easily spread through network environments

When attached to an executable program a __________ can do anything that the program is permitted to do

Specific to operating system and hardware, takes advantage of their details and weaknesses

Virus Components (3)

• Means by which a virus spreads or propagates

• Also referred to as the infection vector

• Event or condition that determines when the payload is activated or deactivated

• Sometimes known as a logic bomb

• What the virus does (besides spreading)

• May involve damage or benign but noticeable activity

Virus Classifications (4)

Infects a master boot record or boot record and spreads when a system is booted from the disk containing the virus

Infects files that the operating system or shell considers to be executable

Infects files with macro or scripting code that is interpreted by an application

Infects files in multiple ways

(Virus Countermeasure) Ideal solution but difficult

(Virus Countermeasure) Best approach is to be able to do the following:

Determine & locate virus

Identify the specific virus that infected

Remove all traces of the virus from the infected program

The ___________ is a comprehensive approach to virus protection developed by and subsequently refined by Symantec.

The motivation for this development has been the rising threat of Internet-based virus propagation, and the need to acquire a global view of the situation.

• Programs that actively seeks out more machines to infect

• Each infected machine servers as an automated launching pad for attacks on other machines

___________ are spread via software vulnerabilities or phishing attacks. Once a it has installed itself into your computer’s memory, it starts to infect the whole machine and in some cases, the whole network.

They can infect large numbers of computers fast, consuming bandwidth and overloading your web server.

It is a computer that’s been infected with malware so it can be controlled remotely by a hacker

The bot __________, can then be used to launch more attacks or to become part of a collection of bots ________

These are popular with hacker show-offs (the more bots you collect, the mightier the hacker you are) and cyber criminals spreading ransomware.

It can include millions of devices as they spread undetected.

It help hackers with all manner of malicious activities, including:

• DDoS

• Keylogging, screenshots and webcam access

• Spreading other types of malware

• Sending spam and phishing messages

It is malicious program that disguises itself as a legitimate file, because it looks trustworthy

_____ themselves are a doorway. Unlike a worm, they need a host to work.

Once you’ve got the _______ on your device, hackers can use it to:

• Delete, modify and capture data

• Harvest your device as part of a botnet

• Spy on your device

• Gain access to your network

It denies or restricts access to your own files. Then it demands payment (usually with cryptocurrencies) in return for letting you back in.

It is a malware which affected MS operating systems that did not have the latest patch installed for a known vulnerability.

It is one of the better known types of malware. It serves pop-ups and display ads that often have no relevance to the victim.

Some users will put up with certain types of __________ in return for free software (games for example).

It can also deliver Spyware and is often easily hacked, making devices that have it installed a soft target for hackers, phishers and scammers

It secretly records your online activity, harvesting your data and collecting personal information such as usernames, passwords and surfing habits.

It is a common threat, usually distributed as a freeware or shareware has an appealing function on the front end with a covert mission running in the background that you might never notice.

It’s often used to carry out identity theft and credit card fraud.

Once on a victim’s computer, it relays the data to advertisers or cybercriminals.

Some of this installs additional malware that make changes to your settings.

It is a type of social engineering attack, rather than a type of malware. It is a common method of cyber attack.

It is successful since the emails sent, text messages and web links created look like they’re from trusted sources.

They’re sent by criminals to fraudulently acquire personal and financial information.

Some are highly sophisticated and can fool even your most savvy users, especially in cases where a known contact’s email account has been compromised and it appears you’re getting an instruction from your boss or IT colleagues.

Warning Signs of Malware (3)

It is the process of identifying risk, assessing risk, and taking steps to reduce risk to an acceptable level.

This approach determines the processes, techniques, tools and team roles and responsibilities for a specific project.

The most common approach to risk management is to manage individual risks recorded and assessed in a ______.

Although this approach is relatively simple and likely to add value if implemented competently, it should be assumed to be best practice.

Approaches to Risk Management (3)

This approach can be used from the outset of a project.

This approach involves modelling the implications of a project plans to obtain a risk-based forecast for the project cost and/or the completion dates for key milestones.

This may be particularly valuable information at key project authorization points when governance requirements include confidence forecasts. In some cases, it may also be possible to apply similar modelling techniques to the project’s products.

This is the common-practice approach of using a single-pass approach to identifying a list of risks and entering them into a _______ for assessment and risk response planning.

It is a systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency.

Acronym: BIA

How to conduct a BIA? (4)

It is the process involved in creating a system of prevention and recovery from potential threats to a company.

Acronym: BCP

The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster.

This is generally conceived in advance and involves input from key stakeholders and personnel.

It involves defining any and all risks that can affect the company's operations, making it an important part of the organization's risk management strategy.

This may include natural disasters—fire, flood, or weather-related events—and cyber-attacks.

It is a plan for business continuity in the event of a disaster that destroys part or all of a business's resources, including IT equipment, data records and the physical space of an organization.

Acronym: DRP

It does more than just tell you about the state of security of your IT infrastructure; it can facilitate decision-making on your organizational security strategy.

This strategies are designed to eliminate, reduce or control the impact of known risks intrinsic with a specified undertaking, prior to any injury or fiasco.

Appropriate risk reduction methods cannot be developed until the possible hazards, disadvantages or losses are thoroughly evaluated. The steps included in risk evaluation are as follows.

Risk _________ must include whether the risk is, first and foremost, preventable. These risks come from within — they can usually be managed on a rule-based level, such as employing operational procedures monitoring and employee and manager guidance and instruction.

Determine the probability and significance of certain "risky" events. Anticipated risks can (and should) be rated according to their degree of probability.

Risk mitigation planning strategies and implementations should be developed for risks categorized as high or medium probability. Low risks may be tracked or monitored for impact but are less important in this step.

An overview of Risk Management (3)

Identify, examine, and understand threats in systems currently in place

Identify, examine, and understand threats facing the organizations

_________ of interest within an organization to manage risks that are encountered.

It is a malicious act that seeks to steal or damage data or discompose the digital network or system. Threats can also be defined as the possibility of a successful cyber-attack to get access to the sensitive data of a system unethically.

Types of Threat (3)

Malware, phishing, and accessing someone’s account illegally, etc. are examples of ________ threats.

________ threats are considered human errors, for example, forgetting to update the firewall or the anti-virus could make the system more vulnerable.

__________ can also damage the data, they are known as _________ threats.

In cybersecurity, a ____________ is a flaw in a system’s design, security procedures, internal controls, etc., that can be exploited by cybercriminals.

In some very rare cases, cyber ___________ are created as a result of cyberattacks, not because of network misconfigurations. Even it can be caused if any employee anyhow downloads a virus or a social engineering attack.

Types of Vulnerability (4)

This vulnerability is caused when there are some flaws in the network’s hardware or software.

When an designer designs an ____________ with a policy that grants every program/user to have full access to the computer, it allows viruses and malware to make changes on behalf of the administrator.

Users’ negligence can cause vulnerabilities in the system.

This can control can also cause vulnerabilities in the system.

It is a potential consequence of the loss or damage of assets or data caused by a cyber threat.

Risk C

Types of Risks (2)

__________ cyber risks are those which come from outside an organization, such as cyberattacks, phishing, ransomware, DDoS attacks, etc.

_________ cyber risks come from insiders. These insiders could have malicious intent or are just not be properly trained.

Take advantage of vulnerabilities in the system and have the potential to steal and damange data.

Known as the weakness in hardware, software, or designs, which might allow cyber threats to happen.

The potential for loss or destruction of data is caused by cyber threats.

It may or may not be intentional

It is the potential for loss, damage or destruction of assets or data caused by a cyber threat.

It is a process that magnifies the likelihood of a negative event, such as the exploit of a vulnerability.

It is a weakness in your infrastructure, networks or applications that potentially exposes you to threats.

It is an elemental part of an organization's risk management procedure, designed to support appropriate security levels for its data systems and data.

Types of risk management (3)

This concern multiple forms of budgetary, schedule, personnel, resource, and user-associated problems.

This concern potential issues, implementation, interfacing, testing, and maintenance problems.

This involves risks of building an excellent product that no one required, losing budgetary or personnel commitments, etc.

It is a risk that includes errors because of the system, human intervention, incorrect data, or because of other technical problems.

Types of Operational Risks (5)

We can also refer to this as a fat finger input error.

This includes system glitches

Sometimes, information is missing from the source itself because of data lag or restrictions.

These include effects from an external environment like political scenarios, weather changes, syndromes affecting living beings, outdated technology, etc.

There have been cases where intentional conflict of interests has arisen, resulting in an illegal profit to trade executors.

Barriers to Collecting Operational Threats (4)

It is therefore defined as the corrective actions, prevention or remedies put in place to combat or reduce IT threats on a computer, server or network. 'IT threats' is a very broad term that envelops physical, software, and hardware threats that any IT system may encounter.

This is when the strategies employ techniques that prohibit the occurrence of a threat on the weaknesses of the system.

This is when the strategies employ techniques that identify existing system threats.

This is when the strategies employ techniques that correct or reduce the impact of detected threats.

Ensure that the only devices connected to the organization’s network are those items provided by the organization.

Organizations should have a documented patching policy as well as a systematic, accountable, and documented set of processes and procedures for handling patches.

Operating systems should be hardened to improve the ability to withstand attacks.

New viruses are discovered every day. It is therefore recommended to set anti-virus applications to automatically update signature files and scan engines whenever the vendor publishes updates

Implement a _____________ to document and review firewall and other network changes before they are implemented.

Consider implementing _____________ running on each internal computer and especially laptops assigned to mobile users

Routine __________ is a valuable practice for every organization.

Implement outbound application __________ to prevent users from inadvertently being directed to malicious web sites.

Filter the following attachment types at your email gateway unless required for business use.

Administrators should not rely solely on AV software and email filtering to detect worm infections.