Cyber Security Management

c
1. Introduction

Sosina M.
1
Course outline
⁻ Introduction
⁻ Cryptography and encryption
⁻ Authentication techniques
⁻ Network security, cloud security and application security
⁻ Mobile security and common vulnerabilities
⁻ Firewall and intrusion detection
⁻ Case studies

Cybersecurity Management 2
 Introduction

Cybersecurity Management 3
Cybersecurity

❑Cybersecurity is a collection of defensive technologies, processes and practices

designed to protect cyberspace (networks, computers, programs and information) from
attack, damage or unauthorized access

❑Cybersecurity solutions have to encompass the entire security challenge

▪ “You are not secure if you are not completely secure.”

Cybersecurity Management 4
Cyberspace

❑The cyberspace infrastructure consists of

▪ Hardware nodes - sourcing, transmitting, and receiving elements
▪ Software - protocols
▪ Human - users of information
▪ Information that is either in a state of rest at a node or a state of motion in the linking
media

Cybersecurity Management 5
Cyberspace
Communication networks
❑Network elements may be each independently connected on the network or connected
in small clusters, which are in turn connected together to form bigger networks via
connecting devices
❑Connecting devices
▪ Hub, Switch, bridge, router, gateway

Cybersecurity Management 6
Cyberspace

Communication protocols
❑In computer networks, protocols provide logical sequences of detailed instructions
❑Network models/protocol stacks
▪ TCP/IP
▪ Open System Interconnection (OSI)
❑The Internet is a network of communicating computing elements that uses a TCP/IP
interoperability network model

Cybersecurity Management 7
Cyberspace
❑TCP/IP protocol stack

Cybersecurity Management 8
Cyberspace

Cybersecurity Management 9
Vulnerabilities
❑the flaws in a system or its design that allows an attacker to execute malicious
commands, access data in an unauthorized way and/or conduct various denial-of-
service attacks
▪ weaknesses in system hardware or software, weaknesses in policies and procedures used
in the systems and weaknesses of the system users themselves
❑Hardware
▪ Many of the hardware-based attacks have the ability to escape detection methods
▪ E.g., hardware trojan – malicious and deliberately stealthy modification made to
electronic devices
o A hardware Trojan might cause an error detection module to accept inputs that should be
rejected
o A Trojan might insert more buffers in the chip’s interconnections and hence consume more
power, which in turn could drain the battery

Cybersecurity Management 10
Common vulnerabilities and exposures
❑Software defects
▪ Cyber attacks utilize the software bugs in their benefits to cause the systems to behave
unintended ways
▪ The majority of cyberattacks today still occur as a result of exploiting software
vulnerabilities caused by software bug and design flaws
❑Network infrastructure and protocols
▪ The cyber space infrastructure was developed in reaction to the changing needs of
developing communication between computing elements
▪ The hardware infrastructure and corresponding underlying protocols suffer from weak
points
o Open architecture
o Nature of the communication protocols
▪ One of the most common network attacks occurs by exploiting the limitations of the
commonly used network protocols Internet Protocol(IP),Transmission Control
Protocol(TCP)or Domain NameSystem(DNS)

Cybersecurity Management 11
Emerging threats
❑Social media
❑Cloud computing
❑Smartphones
❑Critical infrastructure

Cybersecurity Management 12
Cyber attacks

❑Cheaper, convenient and less risky than physical attacks

❑Requires a few expense beyond a computer and internet connections
❑Unconstrained by geography and distance
❑Difficult to identify and prosecute- due to anonymous nature of internet

Cybersecurity Management 13
Attacks classification
❑Cryptographic attack
▪ Breaks cryptography to retrieve the plaintext without the key
❑Access attack
▪ The perpetrator procures ingress to the host’s machine where they have no right to use
with the intent to manipulate information
❑Reconnaissance attack
▪ The perpetrator maps with targeted systems to scan any vulnerability in the machine to
gather information
❑Active attack
▪ An attack, while transmission of data alters the content and affects the operations thereby
serve as an intercessor, leads to severe damage

Cybersecurity Management 14
Attacks classification
❑Passive attack
▪ The attacker’s main aim is to collect the information by listening to a conversation
between hosts through several means
❑Phishing attack
▪ An act of sending fallacious messages via many ways such as emails, text messages, etc.
that tends to become from the legitimate resource, thereby, deceive users and obtain
sensitive and confidential information such as login passwords, card numbers
❑Malware attack
▪ An attack where a perpetrator deliberately installed malicious software on the host’s
computer intending to not only proliferate virus, nonetheless but also infect and harm the
computer, thereby, gain private data

Cybersecurity Management 15
Malware
❑Malware is simply malicious code that often masquerades as a part of some useful
software/message/document/data, and exploits any and all existing vulnerabilities
within the system
o Used primarily to steal sensitive personal and business information
❑Spyware
▪ a type of malware that received its name based on its main intention of monitoring (spying
on) a user’s activity without the user’s consent.
▪ The activity monitored varies among different spyware samples, but the overall goal is to
steal information.
o Information stolen from spyware-infected systems can include typed keys, form data, e-mail
addresses, credentials, etc
❑Viruses
▪ It is essentially a piece of software that is capable of infecting other programs by self-
replicating and modifying the OS or the application’s portable executable (PE) files
o spread by infecting executables or other files
Cybersecurity Management 16
Malware
❑Worms
▪ Computer worms constitute a large class of malicious code that spreads between
computers by distributing copies of themselves in a variety of ways
o it spreads to other systems by duplicating itself without attaching to other files.
❑Trojans
▪ A Trojan horse is a useful program or command, such as a game, utility or software
upgrade that contains hidden malware.
▪ This malware performs some unwanted or harmful function, permits an attacker to gain
access where they are not allowed, and is used to propagate a virus/worm or install a
backdoor

Cybersecurity Management 17
Malware
❑Botnets
▪ A Botnet is a network of hosts capable of acting upon a given set of instructions. They are
typically large, e.g., up to millions of computers, and remotely controlled by a botmaster.
o A Zombie is a program that secretly takes over another Internet-attached computer and then
uses that computer to launch attacks that are difficult to trace to the botmaster.
o Zombies, that exploit vulnerabilities and propagate automatically, are used in denial-of-
service attacks, SPAM, or the collection of confidential information using this massive horde
of computers

Cybersecurity Management 18
Malware
❑Malware spreading mechanisms
▪ Spam
o Refers to sending irrelevant, inappropriate and unsolicited messages (e.g., email spam)
▪ Phishing
o Is a way of attempting to acquire sensitive information by masquerading ass a trustworthy
entity
o Deceiving a user into visiting a malicious website claiming to be from legitimate source
o E.g., Misspelled URLs
▪ Download
o Unintended downloads of malware from the internet
o For example, when a user visits a website, while viewing an email message by user or when
users click on a deceptive pop-up window

Cybersecurity Management 19
Common Attacks
❑Almost every known network security attack is either one of these basic types or a
combination of several basic types

❑Eavesdropping
▪ the purpose of eavesdropping is to intercept data from network traffic using a networking
device and a packet sniffer
o A packet sniffer - a program for monitoring incoming network traffic, e.g., TCPdump and
Wireshark
▪ Countermeasure for eavesdropping- data encryption
o Converts the plaintext data into ciphertext data

Cybersecurity Management 20
Cryptanalysis
❑The art of finding useful information from ciphertext data without knowing the
decryption keys
❑For example, in a substitution cipher that substitutes plaintext letters with ciphertext
letters
▪ If a ciphertext message reveals a certain statistical structure, then one may be able to
decipher It
▪ By comparing the frequency of each character in the ciphertext data and known statistical
frequency of each character in the language
o E.g., in the English language, the letter "e“ has the highest frequency. Thus, the character
that has the highest frequency in the ciphertext data is likely to correspond to the plain text
letter “e”

Cybersecurity Management 21
Social Engineering
❑Social engineering is a method of using social ski11s to pilfer secret information from
the victims
▪ E.g., attackers may send disguised email messages to people as if these messages were
from banks, credit card companies, or other financial institution that people may pay
attention to People who receive such messages are told that there was a security breach in
their accounts, and so they are required to verify their account information for security
purposes
o They are then directed to a masqueraded Website to enter their user names and passwords

Dear customer,
We're sorry, but you reached the maximum number of attempts allowed to login into your US Bank account. For your protection,
we have locked your account. Consequently, we placed a temporary restriction on your account. We did this to protect your
account from any fraudulent activity.
Please click below and complete the steps to Remove Limitations. This allows us to confirm your identity and unlock your US
Bank online account
[Link]
If we do no receive the appropriate account verification within 48 hours, then we will assume this US Bank account is
fraudulent and will be suspended.

Cybersecurity Management 22
Man-in-the-middle Attacks
❑the attacker tries to compromise a network device between two or more users. Using
this device
▪ can intercept, modify, or fabricate data transmitted between users

Cybersecurity Management 23
IP-Spoofing

❑Internet Protocol spoofing (IP-spoofing) is a technique used to set up an attack on

computer network communicating elements by altering the IP addresses of the source
element in the data packets by replacing them with bogus addresses
▪ The attacker intercepts IP datagrams, modifies their source IP addresses and forwards
them on

Cybersecurity Management 24
SYN Flooding
❑SYN flooding exploits an implementation side effect of three-way handshake
procedure in the TCP protocol
❑The attacker sends to a large number of crafted SYN packets, each requesting to
establish TCP connections
▪ Fills the target computer's TCP buffer with a large volume of SYN control packets
o making the target computer unable to establish communications with other computers
❑The source address contained in the SYN packet is a legitimate IP address
❑The victim’s computer is obliged to send an ACK packet to the source IP address and
Waits tor an ACK packet to be sent back
❑However, the host computer is not reachable, and so it will not respond

Cybersecurity Management 25
Denial of Service Attacks
❑The goal of denial of service attacks is to block legitimate users from getting services
they can normally get from servers
❑E.g., SYN flooding, smurf attack

Cybersecurity Management 26
Distributed Denial of Service Attacks

Cybersecurity Management 27
Cyber security

❑Cybersecurity concerns with the understanding of surrounding issues of diverse cyber

attacks and devising defense strategies that preserve confidentiality, integrity and
availability of any digital and information technologies
❑Cyber security relies upon the care that individuals can take and conclusions they
conduct while they organize, manage and utilize computer systems and internet

Cybersecurity Management 28
Cyber security
❑Information Classification
▪ Confidentiality, Integrity, Availability & Consent
❑Cybersecurity Defense Points
▪ Data, devices, applications, systems and networks
❑Cybersecurity Control Types
▪ Physical, Procedural, Legal & Technical
❑Cybersecurity Control Modes
▪ Preventive, Detective & Corrective

Cybersecurity Management 29
Security goals
❑Security involves the following three elements
❑Confidentiality
▪ Assurance that information is not disclosed to unauthorized individuals, processes, or
devices
o The information must have protections capable of preventing some users from accessing it
o limitations must be in place to restrict access to the information to only those who have the
authorization to view it.
o An authentication system must be in place to verify the identity of those with access to the
data
❑ Integrity
▪ ensuring that stored data are accurate and contain no unauthorized modifications
❑Availability
▪ Timely, reliable access to data and information services for authorized users

Cybersecurity Management 30
Physical security
❑A facility is physically secure if it is surrounded by a barrier like a fence, has secure areas
both inside and outside, and can resist penetration by intruders.
❑Mechanisms to guaranteed physical security
▪ Deterrence
o It works by creating an atmosphere intended to frighten intruders. E.g., warnings of severe
consequences if security is breached.
▪ Prevention
o is the process of trying to stop intruders from gaining access to the resources of the system. E.g.,
use of access items like keys, access cards, biometrics,
▪ Detection
o occurs when the intruder has succeeded to gain access to the system.
o E.g., Signals from the detection process include alerts to the existence of an intruder.
o these alerts can be real time or stored
▪ Response
o is an aftereffect mechanism that tries to respond to the failure of the first three mechanisms.
o It works by trying to stop and/or prevent future damage or access to a facility.

Cybersecurity Management 31