Cyber Security
Mian Rashid Manzoor
History
1960s: The Beginning
ARPANET: The Advanced Research Projects
Agency Network (ARPANET), the precursor to the
modern internet, was developed by the U.S.
Department of Defense. Early computer security
focused on physical security and protecting the
large mainframe computers of the time.
First Cyber Incident: In 1971, the first known
computer virus, the Creeper virus, was created by
Bob Thomas. It was designed as an experimental
self-replicating program that infected DEC PDP-10
mainframes.
History
1970s: Early Developments
Multics: The Multiplexed Information and
Computing Service (Multics) project in the
late 1960s and early 1970s introduced many
concepts of modern computer security, such
as access control and user authentication.
Computer Security Act of 1977:
Established by the U.S. government, this act
laid the groundwork for securing federal
computer systems.
History
1980s: Emergence of Cyber security
Industry
First Antivirus Software: The first antivirus
software was created in the 1980s in
response to the growing number of computer
viruses. The Reaper program was an early
example of a virus hunter.
Morris Worm (1988): One of the first major
computer worms to spread across the
internet, created by Robert Tappan Morris. It
caused significant disruption and led to the
creation of the Computer Emergency
History
1990s: Rise of the Internet and Cyber Threats
World Wide Web: The invention of the World Wide
Web in 1989 by Tim Berners-Lee brought the internet
to the masses, leading to an explosion in connectivity
and, subsequently, cyber security threats.
Firewall Development: The first commercial
firewalls were developed in the early 1990s,
providing a critical layer of network security.
Encryption and Secure Communications: The
adoption of encryption protocols like SSL (Secure
Sockets Layer) began to secure online
communications.
History
2000s: The Era of Advanced Persistent Threats
Sophisticated Attacks: Cyber threats became more
sophisticated, with the rise of advanced persistent threats
(APTs), targeting large organizations and governments.
Data Breaches: High-profile data breaches became more
common, with significant incidents such as the TJX breach
in 2007, where millions of credit card records were stolen.
Legislation and Standards: Governments and
organizations began to implement more rigorous
cybersecurity regulations and standards, such as the
Sarbanes-Oxley Act and the Payment Card Industry Data
Security Standard (PCI DSS).
History
2010s: The Explosion of Cybersecurity Challenges
Ransomware: Ransomware attacks, where hackers
encrypt victims' data and demand payment for the
decryption key, became widespread.
Cyber Espionage and Warfare: State-sponsored
cyber attacks and espionage became prominent, with
notable incidents like the Stuxnet worm, which
targeted Iran’s nuclear facilities.
Cloud Security: The widespread adoption of cloud
computing introduced new security challenges and led
to the development of cloud security practices and
technologies.
History
2020s: Current Trends and Future Directions
Zero Trust Architecture: The concept of Zero Trust, which
assumes that threats could be both external and internal, and
requires verification for all access requests, gained popularity.
AI and Machine Learning: These technologies began to be
used more extensively in cybersecurity for threat detection and
response.
Increased Regulation: Regulations such as the General Data
Protection Regulation (GDPR) in Europe and the California
Consumer Privacy Act (CCPA) in the U.S. highlighted the
growing importance of data privacy and security.
IoT Security: As the Internet of Things (IoT) expanded,
securing connected devices became a critical concern.
Key Concepts and Innovations
Intrusion Detection Systems (IDS) and
Intrusion Prevention Systems (IPS): Tools
for detecting and preventing network threats.
Encryption: Essential for securing data in
transit and at rest.
Multi-Factor Authentication (MFA):
Strengthening user authentication processes.
Threat Intelligence: Gathering and
analyzing information about potential threats
to preempt attacks.
IDS
In cyber security, IDS stands for Intrusion
Detection System.
An IDS is a device or software application
that monitors a network or systems for
malicious activity or policy violations.
Any detected activity or violation is typically
reported to an administrator or collected
centrally using a security information and
event management (SIEM) system.
An IDS can be classified into two main types:
IDS
IDS
Network Intrusion Detection System (NIDS):
Monitors network traffic for suspicious activity.
Analyzes the traffic passing through the entire
subnet and matches the traffic that is passed on
the subnets to the library of known attacks.
Host-based Intrusion Detection System
(HIDS):
Runs on individual devices or hosts.
Monitors the inbound and outbound packets
from the device only and alerts the user or
administrator of suspicious activity.
Key Functions of IDS:
Monitoring and Analyzing Traffic:
An IDS inspects incoming and outgoing network traffic.
Looks for signatures of known attacks or deviations from normal behavior.
Alerting:
When suspicious activity is detected, an IDS generates alerts to inform
administrators.
Alerts can be configured to trigger notifications, log events, or integrate
with other security tools.
Logging:
Detailed records of suspicious activities are maintained.
Logs can be used for forensic analysis, compliance, and improving security
measures.
Detection Methods:
Signature-based Detection: Uses predefined attack patterns or
signatures.
Anomaly-based Detection: Establishes a baseline of normal behavior and
detects deviations from this baseline.
Benefits of Using an IDS:
Early Detection of Threats: Helps in identifying
potential security breaches before they can cause
significant harm.
Improved Security Posture: Enhances overall
network security by constantly monitoring and
analyzing traffic.
Compliance: Helps organizations comply with
regulatory requirements by providing necessary
logging and reporting capabilities.
Forensic Analysis: Assists in the investigation of
security incidents by providing detailed logs and
alerts.
Challenges of IDS:
False Positives: Incorrectly identifying
benign activities as malicious, leading to
unnecessary alerts and potential alert fatigue.
False Negatives: Failing to detect actual
malicious activities, which can result in
undetected security breaches.
Resource Intensive: Monitoring and
analyzing large volumes of network traffic
can be resource-intensive, requiring
significant processing power and storage.
Examples of IDS Tools:
Snort: An open-source network intrusion
detection system capable of performing real-
time traffic analysis and packet logging.
Suricata: An open-source threat detection
engine capable of real-time intrusion
detection, inline intrusion prevention, and
network security monitoring.
OSSEC: An open-source host-based intrusion
detection system (HIDS) that performs log
analysis, integrity checking, rootkit detection,
time-based alerting, and active response.
Thanks!