SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING

D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Introduction to Cyber Security (BCCY1001 / BSCY1001) )

SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

UNIT – IV
Risk Analysis, Threat Modeling
Security Controls
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Risk

Risk = Chance of something bad happening

Formula:
Risk = Threat × Vulnerability × Impact

Simple example:

Weak password → hacker access → data loss

SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Important Parts of Risk

Asset → What you want to protect

Example: Customer data, servers, money
Threat → What can harm it
Hacker, malware, insider employee
Vulnerability → Weakness
Weak password, outdated software
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

What is Risk Analysis?

Process of identifying and evaluating risks

Helps prioritize what to fix first

SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Types of Risk Analysis

Qualitative (High / Medium / Low)

Quantitative (Numerical values)
. Risk Analysis Steps
•Identify assets
•Identify threats
•Identify vulnerabilities
•Assess impact
•Prioritize risks
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Risk Analysis Example

Asset: Bank account system

Threat: Hacker
Vulnerability: Weak password
Impact: Money theft
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

What is Threat Modeling?

Identifying possible attacks before they happen

Think like a hacker

SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Why Threat Modeling?

• Prevent attacks early

• Reduce cost of fixing issues later
•Identify threats
SHARDA SCHOOL OF COMPUTING SCIENCE AND
•Identify vulnerabilities ENGINEERING
•Plan defenses D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Threat Modeling Steps

Identify system
Identify threats
Identify vulnerabilities
Plan defenses
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

STRIDE Model
S – Spoofing (fake identity)
T – Tampering (data change)
R – Repudiation (deny action)
I – Information Disclosure
D – Denial of Service
E – Elevation of Privilege
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Threat Modeling Example

Login system
Threat: Password guessing
Solution: Account lock after 3 attempts
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

What are Security Controls

•Measures to protect systems

•Reduce risks
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Types of Security Controls

Preventive (stop attack)

Detective (find attack)

Corrective (fix after attack)

SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Examples of Security Controls

Firewall → Preventive

Antivirus → Detective

Backup → Corrective
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Real-life Example

ATM system
PIN → Preventive
CCTV → Detective
Bank recovery → Corrective
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Relationship Between Concepts

Risk Analysis → Finds risks

Threat Modeling → Finds attacks

Security Controls → Protect system

SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Benefits

Better security

Reduced loss

Improved trust
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Challenges
•Time-consuming
•Requires knowledge
•Constant updates needed
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Security Policies

Policies = Top-level rules

They guide:
Employees
IT teams
Management
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Types of Policies
[Link] Policies
Password policy
Access control policy

Example:
“Password must be 12 characters with symbols”
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

2. Technical Policies
Firewall rules
System configurations

3. Operational Policies
• Backup procedures
• Incident handling
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Incident Response
Focus = minimize damage
Detailed Flow:
1. Preparation
Tools ready
Team trained
2. Identification
Alert from SOC
Suspicious activity
👉 Example:
Login from unknown country
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

3. Containment
Two types:
Short-term → disconnect system
Long-term → apply fixes
4. Eradication
Remove malware
Delete attacker access
5. Recovery
Restore backups
Monitor system
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

SOC (Security Operations Center)

SOC Team Levels
Level 1 (L1)
Monitor alerts
Basic triage

Level 2 (L2)
Investigate attacks

Level 3 (L3)
Advanced experts
Handle complex threats
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Security Frameworks
Functions Explained Deeply:
[Link]
Know assets, risks
[Link]
Access control, training
[Link]
Monitoring systems
[Link]
Incident handling
[Link]
Restore operations
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

ISMS = Information Security Management System

Cycle (PDCA):
•Plan → Identify risks
•Do → Implement controls
•Check → Audit
•Act → Improve
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

PDCA =
👉 Plan what to do → Do it → Check if it worked
→ Improve it

It is a continuous improvement cycle used to improve

processes, including cybersecurity systems like ISO 27001.
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

ISO 27001 (formally ISO/IEC 27001:2022, Information

security management systems – Requirements) is an
international standard defining how organizations
establish, implement, maintain, and continually improve
an Information Security Management System (ISMS).
Published jointly by the International Organization for
Standardization (ISO) and the International Electro
technical Commission (IEC)
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Real-Life Example (Company)

Imagine a bank:
•Plan → Identify risk of fraud
•Do → Add fraud detection system
•Check → Monitor transactions
•Act → Improve detection rules
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

GDPR (General Data Protection Regulation)

Focus:
Protect personal data
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Personal Data
Name
Email
IP address

Data Subject Rights:

Access data
Delete data
Correct data
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS

Imagine an e-commerce company:

•Risk Management → identifies payment fraud risk
•Threat Modeling → finds API vulnerabilities
•Security Controls → adds encryption, MFA
•SOC → monitors attacks 24/7
•Incident Response → handles breach
•Frameworks → follow ISO 27001 & NIST
•Compliance → follow GDPR
SHARDA SCHOOL OF COMPUTING SCIENCE AND ENGINEERING
D E P A R T M E N T O F C O M P U T E R S C I E N C E A N D APPLICATIONS