Scribd
Upload
33 views

Introduction

Uploaded by

Raksa Kun
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
33 views

Introduction

Uploaded by

Raksa Kun
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 28

WEEK 1

Introduction Cyber Security

Overview of Computer/Cyber Security and


Current threat report summary

Na Sambathchatovong
2015nsbctvong@gmail.com
012561046
2023
CONTENTS

I. WHAT IS CYBER SECURITY?


II. GOALS OF INFORMATION SECURITY
III. WHAT ARE THE CHALLENGES?
IV. WHAT DO WE NEED?
V. THE HARSH REALITY IN FIGURES
VI. RECOMMENDATIONS
VII. BEST PRACTICE FOR TARGETED
ORGANIZATION
WHAT IS CYBER SECURITY?

CYBER SECURITY: Protection of the cyberspace against cyber threats and


vulnerabilities

CYBER SPACE: Complex of activities carried out through networks of


computers; more precisely it's a cyber ecosystem (computer systems and devices,
critical infrastructures, entire economic processes, and users, their data, their
interests).

It's not just computers or smart phones, it's not just the Internet, it's the network of
small computers and its sensors in your car, it's your pace-maker sending
information to your doctor, it's the network of controllers regulating industrial
control systems etc.
WHAT IS CYBER SECURITY?

CYBER THREAT: typical threats include unauthorized access, destruction, system overrun
and takeover, propagation of malicious code, data thieving and fabrication, … The attacks
are "cyber" themselves.

E.g., if your computer is stolen, that's not a breach of cyber security. If anybody manages to
access data on your stolen computer, that is an issue for cyber security.

CYBER VULNERABILITY: the presence of weaknesses or loopholes in systems which


may lead (systematically) to cyber attacks.
GOALS OF INFORMATION SECURITY
CONFIDENTIALITY

Confidentiality: Protects information and system from unauthorized access.


Disclosure attacks seek to undermine confidentiality.

Confidentiality Control:
 Access Control Restrict
 Encryption
 Steganography: Hide information within images or other files.
INTEGRITY

Integrity: Protects information and systems from unauthorized modification.


Alteration attacks seek to undermine integrity.

Sources of Integrity failures:


 Intentional Alteration
 User Error
 Software or Hardware Error
 Acts of Nature

Integrity Control:
 Hash functions (MD5) if any change make to file detection
 Digital Signature: Achieve goal of non-repudiation
AVAILABILITY

Availability: Ensures that information and systems are available for authorized users when
needed.
Denial attacks seek to undermine availability.

Availability Failure:
 Malicious attackers
 Component failure
 Application failures
 Utility failures

Availability Controls:
 Redundant Components
 High availability
 Fault Tolerance
 OS and application patch also enhance availability
WHAT ARE THE CHALLENGES?

Rather than mentioning a few specific problems, it is convenient to put in focus the fact that
the organization of our society and our lives are by now largely computer-supported, and this
creates a very significant vulnerability to all sorts of attacks to very different aspects of what
we do. For instance, it concerns

NATIONAL SECURITY: attacks to critical infrastructures such as Transport, Energy and


Communications can have devastating effects, and are now regular part of warfare and terrorist
scenarios;

GOVERNMENT AND PUBLIC BODIES: the robustness to intrusion and tamper of electronic
services, which typically hold very sensitive information;

THE ECONOMIC PROCESSES: the protection of industrial secrets and practices, the
confidentiality of business information and tenders; the viability of the network economy, just
think of the banking
system.

THE CITIZEN: the privacy and legitimate use of personal data against de-anonymisation and
impersonation attacks from all sources; the challenged from cybercrime.
WHAT ARE THE CHALLENGES?

Government says that a lot can be achieved by educating users. Similarly, Government
points out that Cyber Security is a board level responsibility for companies.

Yet, to put the burden on the end-users is somehow unfair. The issue we face can be
extraordinarily complex and subtle.
WHAT DO WE NEED?

 Carry out the research to come up with systematic countermeasure, with security
frameworks and infrastructures able to react quickly to new attacks.

 Identify and develop the cyber security professionals to go our there on the network and
patrol it, to be the good guys in the cyberspace.

 EDUCATION is an EMERGENCY.

 The legal framework is important too.

 All this in the respect of the rights of the citizen. The risk of falling into hyper-restrictive
regulations exists. That is why I believe that research (both in Law and technical) will
help also in this respect, by empowering us.
THE HARSH REALITY IN FIGURES (MANDIANT 2011)
UPDATED DATA (2012)
A MOST SHOCKING FIGURE
MORE TRENDS (2013)

Advanced attack groups are


increasingly taking advantage of
outsourcing relationships to gain
access to the organizations they are
targeting.

Attackers can steal data faster when


they know what they want

Observable relationship between


strategic priorities of some states,
their state-owned enterprises, and
data stolen thru cyber intrusion

Attackers shift from spear phishing


attacks to exploits on websites used
by targets, to install, malware and
gain access to systems
UPDATED DATA (2013)
UPDATED DATA (2013)
UPDATED DATA (2014)
UPDATED DATA (2014)
UPDATED DATA (2015)
UPDATED DATA (2015)
UPDATED DATA
RECOMMENDATIONS
BEST PRACTICE FOR TARGETED ORGANIZATION

1. employ dedicated “cyber incident” handler team — even if one person only!—
whose full time job is to chase intruders.

2. equip the team with tools to collect and analyze network data.

3. understand that this is a daily job, count the number of incidents, measure the
response time.

4. establish “incident team” partnership with other relevant organizations.


Q&A

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy