1.

The Core Triad: Threat, Vulnerability, and Risk

This is the foundational framework of cybersecurity. Understanding the
relationship between these three concepts is the first step to managing
security.

 Threat: A potential cause of an unwanted incident that may harm a

system. It is a danger that has not yet happened but has the potential
to.

o Real-world Example: A hurricane (Natural threat), a phishing

email from a cybercriminal (Intentional threat), or an
employee accidentally sending a sensitive file to the wrong
person (Unintentional threat).

 Vulnerability: A weakness or gap in a system's defenses that a

threat could exploit. A vulnerability is a known weakness in an asset (like
hardware, software, or a procedure) that can be exploited by one or more
threats. It is a gap in your defenses.
Real-world Example: An unpatched software flaw (like the one
o
used in the WannaCry ransomware), a misconfigured cloud
storage bucket that is publicly accessible, or a lack of employee
training on identifying phishing attempts.
 Risk: The potential for loss or damage when a threat successfully
exploits a vulnerability. It's often conceptualized as: Risk = Threat ×
Vulnerability
o Real-world Example: The risk of a data breach exists because of
the threat of hackers and the vulnerability of the unpatched
software. The resulting loss could be financial (fines),
reputational (loss of customer trust), or legal (lawsuits).

2. The STRIDE Model for Threat Classification

Microsoft's STRIDE model is an excellent way to categorize different types of
threats, helping to identify what you need to defend against.

 S - Spoofing: Impersonating someone or something else.

 o Example: Email spoofing, where an attacker sends an email that
appears to be from your CEO asking for an urgent wire transfer.
 T - Tampering: Modifying data or code maliciously.
o Example: A hacker altering a website's HTML to change a bank
account number on a payment page to their own.
 R - Repudiation: The ability for a user to deny they performed an
action.
o Example: An employee denies having deleted a critical file
because the system lacks robust logging and audit trails to prove
it.
 I - Information Disclosure: Exposing data to unauthorized
individuals.
o Example: The VA laptop theft mentioned in the text, where 26.5
million sensitive records were exposed due to the physical theft
of hardware.
 D - Denial of Service (DoS): Making a service unavailable to its
intended users.
o Example: Overwhelming a popular website's servers with a
massive flood of fake traffic, making it crash and become
inaccessible to legitimate customers.
 E - Elevation of Privilege: Gaining unauthorized higher-level
permissions.
o Example: An attacker exploits a bug in an application to gain
"root" or "admin" access on a system, allowing them to install
malware or access all data.

3. Levels of Vulnerability & Attack Vectors

The chapter breaks down vulnerabilities into three key layers:

a) Hardware Level:

 Concept: Physical components are vulnerable to theft, destruction,

and environmental damage.
 Real-world Example: Theft of unsecured laptops (as in the VA case), a
disgruntled employee pouring liquid into a server, or a natural flood
destroying a data center.

b) Software Level:
  Concept: Code can be deleted, modified, or corrupted. Malicious code
can be inserted.
 Real-world Examples:
o Trojan Horse: Downloading a fake "game" or "cracked
software" that secretly installs a keylogger.
o - a specific type of Trojan horse that can be used to spread its
'infection' from one computer to another.

1. Software Controls (Primary Defense):

o Use Antivirus Software,
o Keep Software & OS Updated Enable automatic updates.
o Enable a Firewall: A firewall can block unauthorized network
traffic, preventing a worm from spreading into or out of your
network.
o Be Skeptical of Email Attachments: Never open attachments
from unknown senders. Be wary of unexpected attachments
even from known contacts (their account may be compromised).
o Regular Backups

c) Data Level:

 Concept: Data is the ultimate target. Attacks aim to breach its CIA
Triad:
o Confidentiality: Preventing unauthorized access. Example: A
hacker exfiltrates customer databases.
o Integrity: Preventing unauthorized alteration. Example: A
student hacks into a university system to change their grades.
o Availability: Preventing authorized users from accessing
it. Example: Ransomware encrypts a hospital's patient records,
making them unavailable until a ransom is paid.

Step-by-Step Guide to Implementing a Basic Security

Posture
This guide translates the chapter's concepts into actionable steps for an
individual or a small business.

Step 1: Identify Your Assets & Their Value

  Action: Make a list. What do you need to protect? (e.g., Customer
database, financial records, proprietary software code, employee
laptops).
 Why: You can't protect what you don't know you have. This helps you
prioritize based on value (see the Principle of Adequate
Protection).

Step 2: Identify Threats & Vulnerabilities

 Action: For each asset, ask: "What could go wrong?" (Threats) and
"What weaknesses make that possible?" (Vulnerabilities).
o Example: Asset: Employee
Laptops. Threat: Theft. Vulnerability: Lack of full-disk
encryption and physical cable locks.
o Use the STRIDE model as a checklist to ensure you cover
different threat types.

Step 3: Assess the Risk

 Action: For each Threat-Vulnerability pair, estimate the likelihood and

potential impact (financial, reputational, operational). A simple
High/Medium/Low scale is a good start.
 Why: This tells you what to fix first. Focus on High-Likelihood, High-
Impact risks.

Step 4: Implement Controls (Methods of Defense)

This is where you actively reduce risk. The chapter mentions several key
control categories:

 Physical Controls: Mitigate hardware threats.

o Actions: Install locks on server room doors, use laptop cable
locks, implement badge access systems.
 Software Controls: Mitigate software and data threats.
o Encryption: Encrypt sensitive data at rest (on laptops/drives)
and in transit (using HTTPS, VPNs).
o Access Control: Implement the principle of least privilege.
Users and software should only have the minimum level of
access needed to perform their job.
o Antivirus/Anti-malware: Use it and keep it updated.
o Patch Management: This is critical. Regularly update operating
systems and applications to fix known vulnerabilities. The
WannaCry attack exploited systems that had not applied a
available patch.
 Administrative Controls: Mitigate human error and define
processes.
 o Policies: Create an Acceptable Use Policy and a Data Handling
Policy.
o Training: Conduct regular cybersecurity awareness training for
all employees (e.g., how to spot phishing emails). This addresses
the biggest threat: insiders.
o Backups: Maintain regular, automated, and tested backups of
critical data. This is your primary defense against ransomware
and data loss.

Step 5: Monitor, Review, and Improve

 Action: Security is not a one-time task. Subscribe to security news

feeds. Regularly review logs if possible. Re-assess your risks
periodically (e.g., annually or when major changes occur).
 Why: The threat landscape is constantly changing. New vulnerabilities
are discovered daily. A static defense will quickly become obsolete.