Essentials Lec 1 - Lec 6 Flashcards
What is cyberspace?
“Cyberspace is composed of all the computerised networks in the world, as well as of all computerised end points, including
telecommunications networks, special purpose networks, the internet, computer systems, and computer-based systems. The concept
also includes the information stored, processed, and transmitted on the devices and between these networks.”
What is cybersecurity?
“Cyber security comprises technologies, processes and controls that are designed to protect systems, networks and data from cyber
attacks.” — “Effective cyber security reduces the risk of cyber attacks, and protects organisations and individuals from the
unauthorised exploitation of systems, networks and technologies.”
If it works, nothing happens. Is there a threat or are actors not interested? How can we tell? Focus on measurable outcomes. “A lot of
people still seem to think that you can solve the problem of cyber security with a couple of boxes, a bit of electronics and some clever
programming.”
Why do we care about cybersecurity
Protection of critical national infrastructure (clean drinking water, electricity, internet, etc.)
- Privacy and sensitive data
- Financial reasons
What is the three-layer model? Governqnce
- Outer layer — Governance - In between — Socio-technical: people interacting with that technology - Middle — Technical
What is the CIA-triad?
Protection of data: CIA triad -
Confidentiality: information only available to authorised entities. Not only through hacking.
This could also be for instance wrong attachment in an email, data screens in public
displays, materials not removed correctly (e.g. secure bins), Grindr and Strava -
Integrity: can we trust the data, the whole data and noting but the data? No changes made
to data without detection. This includes changing data, adding data and deleting data. e.g.
millennium bug -
Availability: data available when needed. Systems up and running, people who should have
access have access and others not. e.g. Maastricht University ransomware attack
What is Data Backup?
a copy of computer data taken and stored elsewhere so that it may be used to restore the original after a data loss
event. Primary data failures can be the result of hardware or software failure, data corruption, or a human-caused event, such as a
malicious attack (virus or malware), or accidental deletion of data. —> 3-2-1 (3 copies, 2 local, 1 in a galaxy far far away. e.g. DropBox,
TimeMachine, USB storage.
What is MFA?
Multi-factor authentication: Multi-factor authentication is an authentication method in which a computer user is granted access only
after successfully presenting two or more pieces of evidence to an authentication mechanism: knowledge, possession, and inherence.
Something you know (e.g. password) have (e.g. a token, bank card) and are (e.g. fingerprint, iris, facial recognition).
- Upside: increased security - Downside: often a bit more fuss
What is a VPN?
VPN: A virtual private network extends a private network across a public network, and enables users to send and receive data across
shared or public networks as if their computing devices were directly connected to the private network. It is a secure connection over
an insecure network. When would you want one? What might the dangers be? (e.g. your data can be sold).V
What is Encryption?
is the process of encoding a message or information in such a way that only authorised parties can access it and those who
are not authorised cannot. Encryption itself does not prevent interference but denies the intelligible content to a would-be interceptor.
Not just messages, but files as well. Helps with the CIA triad. Also helps in starting a cyber attack(!).
What is End to End encryption?
End-to-end encryption is a system of communication where only the communicating users can read the
messages. An example can be found within WhatsApp. But do we want it? Think about the issue with the FBI.
What is PKI?
Public-key encryption: a cryptographic system that uses two pairs of keys: 1) public keys which may be disseminated widely, and 2)
private keys only for the owner. Share the public key, keep your private key secret! Used to encrypt/ decrypt messages.
What is ARPANET?
he Advanced Research Projects Agency Network (ARPANET) was an early packet-switching network and the first network to
implement the TCP/IP protocol. It was created to make it easier for people to access computers and to have a more effective
communication method for the military as a response to Sputnik I (1957). Also for the protection of critical infrastructure. ARPA’s goal
was to link different computers together, both to increase overall computer power and to decentralise information storage. As the
network development progressed, protocols for inter-networking were developed by which multiple separate networks could be joined
into a network of networks
What are the three aspects of ARPANET?
- Formulating technological problems and solutions
- Sense of relevance of community of users
- Open architecture of system, so that anyone can build on this
Explain the “Architecture and First Steps” phase of the internet
Packet switching versus circuit switching (Leonard Kleinrock) -
Joseph Licklider envisioned a network in three ways:
1. Combination of hardware and software
2. Interaction between man and machine
3. Network of people (everyone can bring their expertise to the table) - 1965: packet switching used for first message between two computers
What were the first long distance connections?
‘Long’ distance connections: End of 60’s, most of the technology had been invented, but no centralisation — 1969: first link between
UCLA and SRI. They tried to send a message, this message came to be “LO” (they tried to say login, but the system crashed).
When did mainstream usage of the internet start?
Mainstream use of Internet
- 1991: First webpage (CERN)
— 1993: Mosaic, first popular browser, UN/US websites
- Cambridge develops webcam for critical process supervision as early as in 1991 (coffee machine)
- Hotmail starts in 1996, Google starts in 1998
What are the Pro’s and Con’s of the internet?
Pro’s:
- Faster services
- Connectivity
- Availibility of information
Con’s:
- Privacy
- Accumulation of Data
- Dark Web
What are the layers of the TCP/IP model (IMPORTANT)
What is the Case Study: Cambridge Analytica about?
Case study: Cambridge Analytica was a British political consulting firm which combined misappropriation of digital assets, data
mining, data brokerage, and data analysis with strategic communication during the electoral processes. The Facebook–Cambridge
Analytica data scandal was a major political scandal in early 2018 when it was revealed that Cambridge Analytica had harvested the
personal data of millions of people’s Facebook profiles without their consent and used it for political advertising purposes.
- Made Brexit /Trump happen
- Targeted advertising
- Facebook personality test
- Data of 50,000,000 users
What is the OCEAN acronym in the Cambridge Analytica Case Study
Big five personality traits
1. Openness to new experiences
2. Conscientiousness
3. Extraversion
4. Agreeableness
5. Neuroticism
What did camrbidge analytica do with the collected data?
After data collection -Machine learning
*Using computers to detect patterns in data -For example weather predictions, possible risks or mapping spreading of
diseases
*Use these patterns to create algorithms
*Algorithms to make predictions on ‘new’ data
*Training and testing the algorithm -Divide data in ‘training data’ and ‘test data’ to assess the quality of algorithm
-Creating algorithms to predict
*Demographics, personality, interests, etc.
-More data collection and algorithm improvement/ extension
What were the consequences of Cambridge Analytica’s actions
Consequences
-Anything you do online is tracked, collected and stored
-Just because you don’t actively share data, doesn’t mean your friends don’t either
-Algorithms allow for prediction of ‘hidden’ information
-Targeted advertising, but who knows?
-How much would you charge for your data?
-What about future technology that is applied to current data?
What happened to Cambridge Analytica after the controversy?
What happened to Cambridge Analytica?
What is Cybersecurity?
Cybersecurity is both cause and target-related security:
Security = protection against intentional harm caused by
human(s) or object of harm is non-human,
What are examples of intentional and accidental harm in cyberspace?
Attack, exploit, disruption, theft (Intentional)
Error, failure, outage (Accidental)
How can harm be done through cyberspace?
Harm to society via cyberspace (4 Ways)
- Intentional physical harm: sabotage, critical infrastructure (e.g.
hacking Rijkswaterstaat). - Intentional informational harm: crime, espionage, privacy,
disinformation (e.g. Brexit, Trump election 2016). - Accidental physical harm: critical infrastructure (e.g. the problem
with the matrix signs at the highway) - Accidental informational harm: privacy, misinformation (e.g.
How can someone analyse a cyber incident?
The Cyber Accidents model.
1. Actor
Somebody or something instigates a chain of event
2. Cause
Then there is the actual cause
3. Effect
Name the 4 main examples of actors in the Cyber Accidents Model
- Human Being
- Animals
- Nature
- System
What errors can a Human Being cause according to the Cyber Accidents Model
- Execution Errors
a. Slips: Not paying enough attention
b. Lapse: you do not remember something but usually you do - Planning Error
a. Rule-based mistakes: it worked in other situations, so i can apply it now
b. Knowledge-based mistakes: we simply do not get it
What errors can a Animal cause according to the Cyber Accidents Model
Mainly disruption of physical infrastructure
What errors can Nature cause according to the Cyber Accidents Model
Flooding, Overheating,
What errors can a System cause according to the Cyber Accidents Model
Complexity and inadequate procedures can cause incidents.
What are the 6 causes of an accident in the Cyber Accidents Model?
- Design Error
a. A mistake that is
waiting to happen
because of a poor
design.
b. e.g.: seen in
aviation. - Programming Error
a. Coding error/
software error.
b. e.g.: bugs - Configuration Error
a. This occurs when
somebody changes
or updates the
settings. - Use Error
a. Using hard/software
in the wrong way
(badly or with
wrong purposes).
b. e.g. email to the
wrong person or
persons. - Breakage
a. Something breaks
(it no longer
functions) or broken
by someone or
something.
b. e.g.: something
breaks. - Removal Error
a. The process of
eliminating the
causes of error in a
manufacturing
process.
b. e.g.: discard
computer without
wiping the disk.
What are the effects of a accident in the Cyber Accidents Model
- Outage
a. Internet outage can occur due
to censorship, cyberattacks,
disasters or errors. - Misinformation
a. False or inaccurate
information, especially that
which is deliberately intended
to deceive. - Data Leak
a. A data breach is the intentional
or unintentional release of
secure or private/confidential
information to an untrusted
environment. - Malfunction
a. (of a piece of equipment or
machinery) fail to function
normally.
What is the Internet?
Internet
-Globally distributed computer network
-Voluntary connected autonomous networks
-Decentralised architecture
What are the three layers of Internet Governance?
- Economic / Societal (the users)
- Logical (The software)
- Infrastructure (The hardware)
How was the internet governed in the early days?
Origins and Evolution:
The Internet began as a government project, and by the mid-1970s, it evolved into a distributed network with the invention of TCP/IP.
Data packets could take various paths, bypassing traditional barriers and control mechanisms.
Early Governance:
The Internet Engineering Task Force (IETF), established in 1986, played a key role in its development.
There was no central government or grand design initially.
Why Governance?:
Since 1969 (during ARPANET and NSFNET), governance was necessary for:
Establishing standards for device interoperability.
Coordinating unique Internet addresses.
Addressing security issues
What is internet governance and the difference with national governance?
What is Internet governance: decentralised vs. centralised:
What is the Theory of Planned Behaviour?
- Theory of planned behaviour: A theory that links one’s beliefs and behaviour.
The theory states that intention toward behaviour, subjective norms, and
perceived behavioural control, together shape an individual’s behavioural
intentions and behaviours.
* Attitude
* Subjective norm: what are the people around you doing?
* Perceived behavioural control
What is the Protection motivation theory
The protection motivation theory proposes that
people protect themselves based on four factors: the perceived severity of a
threatening event, the perceived probability of the occurrence, or vulnerability,
the efficacy of the recommended preventive behaviour, and the perceived self
efficacy.
What is the Health Belief Model?
Health belief model: The health belief model (HBM) is a social psychological
health behaviour change model developed to explain and predict health
related behaviours, particularly in regard to the uptake of health services.
What is the COM-B model?
the COM-B model proposes that people need sufficient
Capability, Opportunity, and Motivation to perform a desired behaviour. If even
a single component is lacking, then people will be less likely to perform the
desired behaviour
