Introduction to Cybersecurity
Cybersecurity Fundamentals
Learning Objectives
By the end of lessons you will be able to:
Explain the fundamentals of cybersecurity
Identify threat actors, attacks, and mitigation
Describe security policies, procedures, standards, and
baseline
Elaborate the cybersecurity mitigation methods
Fundamentals of Cybersecurity
What Is Cybersecurity?
A set of technologies used for protecting systems, networks, and programs from digital
attacks, damage, and unauthorized access.
Unauthorized
Attack Access
Address Damage
Threats
Why Cybersecurity?
Presence of crime
syndicates
Presence of cyber
Increased demand armies
to protect data
Presence of
Increased rate financial frauds
of cyber crime
The world relies on technology more
than ever before, and as a result digital
data creation has surged.
Information Security and Cybersecurity
Information Security Cybersecurity
Refers to processes and tools designed to Is a set of techniques used to protect the integrity
protect sensitive information of networks, programs, and data
Encompasses paper documents and digital
Is a component of information security
and intellectual property
Cyber Crime Statistics
25+ million records 300 billion passwords
exposed everyday in exist worldwide in 2020
2018
Cyber Crime to cost 24,000 malicious
$6 trillion in 2021 mobile apps blocked
daily
Healthcare: 60% of fraud
Ransomware attacks originates from
will quadruple mobile devices
Factors Affecting Cybersecurity
Technology Business Plans
Platforms and tools 1 Nature of business
Network connectivity 2 Risk tolerance
Level of IT complexity 3 Industry trends
New or emerging security tools 4 Mergers and acquisitions and partnerships
Operational support for security 5 Outsourcing service providers
CIA Triad
Information must be available
on demand
CIA Triad
Authorized parties can
access the information
CIA Triad
Authorized people can add,
remove, or alter information
Governance, Risk Management, and Compliance (GRC)
Scope of GRC
Governance, Risk Management, and Compliance of every organization is different and varies based on the
type of organization.
It depends on organization mission, size, industry, culture, and legal regulations.
Regulations Size
Mission
Culture Industry
Responsibility of GRC
The ultimate responsibility of the GRC program is to protect their assets and operations IT, including their
infrastructure and information.
GRC
The board of directors and senior management of an organization are
responsible for Governance.
Governance
Provides strategic direction
Risk Management
Ensures that the objectives are achieved
Compliance Ascertains whether risk is being managed
appropriately
Verifies that the organization's resources are being
used responsibly
GRC
It is the process by which the organization manages risks to acceptable
levels. These risks may include investment risk, physical risk, and cyber risk.
Governance
Risk Management
Compliance
GRC
It is the act of adhering to mandated requirements defined by laws and
regulations.
Governance
Risk Management
Compliance
Roles of Cybersecurity
Cybersecurity Roles
The success of a cybersecurity role is ultimately the responsibility of the board of directors.
Security
Board of Directors Management
Executive Cybersecurity
Committee Practitioners
Approaches to Cybersecurity
Compliance-based security Risk-based security Ad-hoc approach
Cybersecurity: Key Terms
Cybersecurity: Key Terms
Inherent risk
Residual risk
Illustration: Basics of Cybersecurity
Threat Actors, Attacks, and Mitigation
Threat Actor
A threat actor or malicious actor is a person or entity that is responsible for an event or incident that
impacts or has the potential to impact the safety or security of another entity.
Threat Actor Categories
Script kiddies Nation states APT
Hactivist Insiders
Threat Actor
categories are:
Organized crime Competitors
Threats to a System
Main threats to an organization should be considered.
Natural
Supply system Man-made Sociopolitical
environmental
threats threats threats
threats
Malware
Malware is any software that is intentionally designed to cause damage to a computer,
server, client, or computer network.
Types of Malware
Worms Rootkit
Viruses Backdoor
Trojans Logic bombs
Spyware Ransomware
Adware
Worms
Worms are self-replicating codes designed to penetrate computer systems.
Virus
Virus is a malicious code that replicates by attaching to an executable code.
Trojans
Trojans are programs that claim to perform one function but does another, typically
malicious.
Spyware
Spyware is a software aimed to steal personal or organizational information.
Adware
Adware is a software that displays endless ads and pop-up windows.
Rootkit
Rootkits are designed to modify the operating systems’ operations to facilitate non-standard functionality.
Backdoor
Backdoor provides the attacker with unauthorized remote access to a system by
exploiting security vulnerabilities.
Logic Bombs
Logic bombs infect a system and lie dormant until they are triggered by a specific condition.
Ransomware
Ransomware attempts to extort money from the user by infecting and taking control of a victim's machine.
Malware Attacks
Kovter WannaCry Zeus or Zbot
Ghost Mirai
Denial-of-Service Attack
The purpose of DoS is to prevent access to the target system.
Distributed Denial-of-Service
It is a denial-of-service attack employing multiple attacking systems.
Distributed Denial-of-Service
The goal of DDoS is to prevent access to a specific system.
DoS/DDoS Attacks
GitHub: 1.35 Tbps
GitHub was hit with 1.35 terabits per
second of traffic.
DoS/DDoS Attacks
Cloudflare: 400 Gbps
The attack was directed at a single computer with vulnerability.
Application Layer Attacks
They target computers by causing a fault in the operating system or applications.
Application Layer Attacks
They refer to a type of malicious behavior designed to target the top layer in the OSI model.
Application Layer Attacks
Cross-site scripting Buffer overflow Domain hijacking
DNS spoofing SQL injection DoS/DDoS
Software Codes and Security
Programmers are responsible to write safe and high quality codes.
Software Codes and Security
Source codes are statements written using a computer programming language.
Software Codes and Security
Code review is a systematic examination or peer review of source code.
Find mistakes Improve software quality
Software Testing Methods
Evaluates the security of
software in a runtime
environment
Static Testing
Dynamic Testing
Evaluates the security of
software without running it
Software Testing Methods
In March 2018, hackers hit Saks Fifth Avenue and Lord & Taylor, stealing debit and credit cards.
5 million records breached
Software Testing Methods
In May 2018, the concert and sporting event ticketing website, ticketfly was vandalized,
taken down, and disrupted for a week.
Security Attacks
In August 2018, Russian hackers made millions selling credit card details stolen from almost
245,000 British Airways customers.
Social Engineering
It is the art of manipulating people, so they give up their confidential information violating
the security principle.
Social Engineering Attack Categories
There are several attack categories of social engineering.
Spear Phishing
Phishing Whaling Phishing
Social Engineering Attack Categories
Phishing Spear Phishing Whaling Phishing
It is a fraudulent attempt to It is targeted to a specific It targets wealthy and
obtain sensitive information. group or an individual. prominent individuals.
Social Engineering Attack: Ethereum Classic
In 2017, Ethereum Classic website was hacked resulting in the loss of thousands of dollars in
cryptocurrency.
Social Engineering Attack: Ethereum Classic
Impersonated Redirected the domain
Ethereum owner to their server
Gained access to Extracted cryptocurrency
domain registry from the victims
Security Policies and Procedures
Security Management Plan
Initiates and defines Senior Management
policies
Releases standards and
Middle Management policy guidelines
Operations Management/IT Team
Implements the controls
and policies
End Users
Must comply with the
organization’s functions
Types of Security Management Plan
Strategic Plan Tactical Plan Operational Plan
Types of Security Management Plan
Strategic Plan Tactical Plan Operational Plan
● Is a long-term plan
● Defines security posture
● Is valid for five years and is
renewed annually
● Helps understand security
functions
● Helps in risk assessment
Types of Security Management Plan
Strategic Plan Tactical Plan Operational Plan
● Is a mid-term plan
● Provides detailed goals
● Is updated every year or two
● Is technology oriented
Types of Security Management Plan
Strategic Plan Tactical Plan Operational Plan
● Is a short-term plan
● Is highly detailed
● Is updated monthly or
quarterly
● Spells out how to accomplish
goals
Security Policy
• Is a strategic plan
• Defines the scope of security
• Outlines security objectives
and framework
• Identifies the functional areas
• Outlines security goals and
practices
• Assigns responsibilities and
requirements
• Defines risk levels
Types of Security Policy
Focuses on issues relevant to every
aspect of the organization
Organizational
policy
Issue-specific System-specific
policy policy
Focuses on individual
Focuses on a specific service,
systems
department, or function
Security Policy Framework
Standard
Procedure
Guideline ● Defines the minimum level of
security
● Is system specific
Baseline ● Establishes the common
secure state
Security Policy Framework
Standard
● Offers recommendations on
Procedure
implementation
● Serves as an operating guide
Guideline ● Is customized for each unique
system
Baseline
Security Policy Framework
Standard
● Is the final element of formalized
security policy structure
Procedure
● Describes actions for implementing
the security mandates
● Is system and software specific
Guideline
● Ensures integrity of the business
process
Baseline
Security Policy Framework
● Defines the compulsory
requirements
Standard
● Provides a course of action
● Is a tactical document
Procedure
Guideline
Baseline
Due Care and Due Diligence
Due Care Due Diligence
● Reasonable care is taken in ● Is about practicing the activities
protecting the organization that maintain the due care effort
● Pertains to the legal duty of the ● Pertains to best practices that a
organization company should follow
● Lack of due care is considered ● Might not be legally liable
negligence
Cybersecurity Mitigation Methods
Information Technology Control
An IT control is a procedure or policy that provides a reasonable assurance that:
IT used by an organization is The organization is in
operating as intended compliance with laws
and regulations
Data is reliable
Countermeasure
It is an action or method that is applied to prevent, avert, or reduce potential threats to:
Computers Networks Servers Operating
Information
systems
systems
Countermeasure
It helps to mitigate or reduce the potential risk.
Control Categories
Administrative Technical Physical
controls controls controls
Administrative Controls
These are procedures and policies used to define employee actions toward sensitive information.
Technical Controls
These are hardware or software mechanisms used to protect important and
confidential assets.
Physical Controls
These are security measures designed to deny unauthorized access.
Physical Controls
Detective
Deterrent Corrective
Preventive Recovery Compensating
Defense in Depth or Layered Approach
It is the act of using multiple layers of security controls to protect the integrity of information.
Defense in Depth or Layered Approach
Its intent is to provide increased security through intentional redundancy based
on multi-layered security approach.
Personnel Procedural
Technical Physical
Defense in Depth or Layered Approach
Identity Management
It is an organizational process for identifying, authenticating, and authorizing individuals or
groups of people.
Identified Authenticated Authorized
Identity Management
It enables the right users to access the right resources at the right time for the right reasons.
IAM Components
Authentication Authorization
The components of
IAM are:
User Management Central user repository
Identification and Authentication
Identification Authentication
Identify a user or an application in Prove that a user or an application
the system is genuine
Identification and Authentication
Something you know Something you have
Password Token card
Something you are or do Where you are
Biometric Location
Multi-Factor Authentication
It is an authentication method where a user is granted access after
presenting two or more evidences.
Two-Factor Authentication
It is a subset of multi-factor authentication, confirming that users are
granted access with a combination of two different factors.
Multi-Factor Authentication
It is an authentication method where a user is granted access after
presenting two or more evidences.
Authorization
It is the process of determining what types of activities, resources, or
services a user is permitted.
Authorization
A user may be authorized for different types of activity once authenticated.
Accountability
It is the traceability of actions performed on a system to a specific system entity.
Accountability
User identification and authentication User ID and password destroy
support accountability accountability
Auditing
It is a manual or a systematic measurable technical assessment of a system or application.
Reviewing
Interviewing staff applications and OS
access controls
Analyzing physical
Performing security
access to the
vulnerability scans
systems
Monitoring
It is a manual or a systematic measurable technical assessment of a system or application.
Defining the behavior types Taking actions on alerts
to trigger alerts as needed
Patch Management
It involves acquiring, testing, and installing multiple patches to an administered computer system.
Patch Management Tasks
Maintain knowledge of Decide appropriate patches Ensure that patches are
available patches for particular systems installed properly
Test systems Document all
after installation associated procedures
Patch Management: Example
The outbreak of WannaCry ransomware became large and intense
because of a missing security patch.
System Hardening
It is a collection of tools, techniques, and best practices to reduce vulnerability.
Technology
Systems
applications
Infrastructure Firmware
System Hardening: Purpose
It eliminates security risks and secures a system by reducing its attack surface.
System Hardening Activities
Use encryption
Update security Remove unnecessary
patches and hotfixes programs and user
on time accounts
Hardening
activities for
Monitor security a computer Create strong
bulletins system passwords
includes:
Install anti-virus and
Close certain ports spyware protection
system
Deny file sharing
Change Control
It is a systematic approach to manage all changes made to a product or system.
Change Control: Purpose
All changes are
documented
No unnecessary Services are not disrupted
changes are made
Resources are used
efficiently
Change Control: Purpose
Possible
Formal RFC Implementation
rollback
Change Change approval Review
request board
Asset Management
It is the systematic process of developing, operating, maintaining, upgrading,
and disposing of assets cost-effectively.
Asset Management Lifecycle
Procurement 1 2 Deploy and discover
Retirement and disposal 5 3 Maintain
4 Support
Data Management
Data is the smallest piece of information in any form.
Text documents Images
Audio clips Software programs
Data Management
It is an administrative process to ensure the accessibility, reliability, and timeliness of the data for its users.
Storing data
Protecting data
Validating data
Acquiring data Processing
data
States of Data
They describe the different modes whereby data is used by a computing equipment.
Three Basic States of Data
Data at rest Data in transit Data in use
Information Lifecycle
Acquisition: Indexed
system data
Disposal: Stored data for Archival: Backup,
destruction protection, and retention
Use: Challenges in
protection
Information Lifecycle
It is an ongoing It helps ensure data is
process protected
Metadata must be at the It helps indicate the level of data
right classification level protection
Classification level must be attached
to the information lifecycle
Encryption
It describes the different modes whereby data is used by a computing equipment.
Encryption
Encryption
Protects data in transit over Protects information stored
networks on computers
Deters and detects Verifies the authenticity of a
alterations of data transaction
Cryptography
Cryptography is the science of protecting information by encoding it into an
unreadable format.
Cryptography
Factors Influencing Effective Encryption
The non-existence of
back doors
Algorithm strength, The inability to decrypt an
secrecy, and difficulty entire cipher text
of compromising a key
Types of Encryption
Symmetric Encryption Asymmetric Encryption
Symmetric Encryption
Symmetric encryption is based on the same key or private key to encrypt plain text
and decrypt ciphertext.
• Uses one key to encrypt and • Shares the key with the
decrypt receiver
• Uses less processing power
Symmetric Encryption
Common private key cryptography systems:
Data Encryption Standard (DES) Advanced Encryption Standard (AES)
64-bit 128-bit to 256-bit
Asymmetric Encryption
Solves the problem of sharing the key with the receiver
Asymmetric Encryption
Services of cryptography:
Authentication Non-repudiation Confidentiality
Validates the Prevents denial Controls who reads
sender’s identity of action the data
Incident Response
It is an organized approach to address and manage the aftermath of a security breach.
Incident Response: Goals
Reduces damage, recovery Manages potential
time, and costs disruption to IT service
Has normal service Minimizes the adverse
operations within SLAs impact on business
operations
Security Training
It is an organized approach to addressing and managing the aftermath of a security breach
or cyber attack.
Security Awareness
It is the process of exposing people to security issues so that they may be able to recognize
them and better respond to them.
Key Takeaways
Cybersecurity refers to a set of techniques used to protect the integrity
of network programs and data from attack, damage, and unauthorized
access.
Malware is a software that is designed to cause damage to a
computer, server, client, or network. The types of malware
include worm, spyware, virus, trojan, and logic bomb.
Strategic plan, tactical plan, and operational plan are the types of
security management plans.
Change control is a systematic approach for managing all
changes made to a product or system.
