guest lecture Flashcards
Intro to cybersecurity :
Definitions of Cybersecurity :
Cyber security, also referred to as information technology security, focuses on protecting computers, networks, programs and data from unintended or unauthorized access, change or destruction. University of Maryland University College
The state of being protected against the criminal or unauthorized use of electronic data, or the measures taken to achieve this. ‘some people have argued that the threat to cybersecurity has been somewhat inflated’ Oxford Dictionary
Intro to cybersecurity :
ITU-T X.1205 Definition
Cybersecurity is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user’s assets.
Organization and user’s assets include connected computing devices, personnel, infrastructure, applications, services, telecommunications systems, and the totality of transmitted and/or stored information in the cyber environment.
Cybersecurity strives to ensure the attainment and maintenance of the security properties of the organization and user’s assets against relevant security risks in the cyber environment.
The general security objectives comprise the following:
o Availability
o Integrity, which may include authenticity and non-repudiation
o Confidentiality
Intro to cybersecurity :
Rapid Pace of Change
1940s: The first computer is built
1956: First hard-disk drive weighed a ton and stored five megabytes
1991: Space shuttle had a one-megahertz computer
2006: Pocket devices hold a terabyte (one trillion bytes) of data
etc. etc. – driverless cars, autopilot everywhere
(think of security and privacy implications)
Move towards full AI
Intro to cybersecurity
Introductory thoughts on Cybersecurity
Cybersecurity has become a fundamental area of concern in the last 10 years;
Last 10 years may be arbitrary has seen the rise of ‘mass connectivity
Previously it was a case of a PC or laptop at home, now users have multiple access devices, smartphones, tablets etc.
What was a corporate concern has become an issue for everybody, people have become their own ‘IT Managers’; Organisations talk about the ‘consumerisation of IT’, bring your own devices etc.
intro to cybersecurity :
The changing World of IT Security
Originally machines were ‘dumb terminals’
Transitioned to defined endpoints on networks
‘Home Computing’ limited to basic devices and applications (some exceptions like minitel)
Security was a consideration for most organisations, but limited connectivity typically meant limited risk :
Viruses transferred ‘by hand
Timeline of viruses First 25 years of Computer
Viruses Virus introduced to hardware
Landscape of threat has now changed completely
intro to cybersecurity :
IT Security Landscape has moved beyond basic Malware
Types of threat :
Viruses
Spam
Adware (Mobile/adware)
Ransomware (HSE, French hospital hit by a ransomware attack | Cybernews)
Phishing attacks
Denial of Service/Distributed denial of service
Spoofing/pretexting/phishing/spear phishing etc. etc.
Intro to cybersecurity :
Risk Management – from the Corporate to the Personal
eCommerce has now extended way beyond the Ryanair website
Our online identities are critical for pretty much all interactions with Financial Services, the State etc
Intro to cybersecurity :
The nature of cyber/online crime is becoming ever more inventive
Tethered endpoints are one thing, however;
The network has exploded, computers are everywhere, corporate networks have become entirely mobile and are made up of all manner of device
The “attack surface” has changed
More people are doing more things online
More devices are coming online
Intro to cybersecurity :
Rate of change is high – Third Industrial Revolution
Privacy and security were not factored in as major requirements in the establishment of machines, networks and internetworks
eCommerce was driven by commerce, not concern for user security or privacy :
Security was addressed in
comparatively basic terms
Consider the equivalent in car safety
From slow beginnings and a disappointing start, mass connectivity is now a fact and has conferred huge benefits with a series of attendant disadvantages and possibly unexpected side-effects
Intro to cybersecurity :
AI and Machine Learning
Artificial Intelligence (AI), Robotics, and Motion:
AI suited to narrow, specialized skills
Robotic devices often special-purpose devices, and may require AI to function
Motion sensing devices are used to give robots the ability to walk, trigger airbags in a crash and cushion laptops when dropped
Year on year more talk about AI and machine learning
Lots of talk about ethics/including profiling
Intro to cybersecurity :
Benefits are accompanied by Risks
Great possibilities and opportunities to businesses of all sizes, and convenience to consumers
Benefits are accompanied by risk however
In today’s digital economy, many enterprises have embraced technology without understanding fully the issues of control that are involved with successful operation of these technologies
Likewise, consumers are exposed to a vast, and increasing, range of risks; credit card fraud on insecure ecommerce websites, identity theft, breaches of privacy etc.
Intro to cybersecurity :
What is Risk?
Risk is the possibility of loss or injury, to someone or something that creates a hazard
In the digital enterprise losses or injury can occur in the form of stolen, corrupted, misused, altered or falsely generated data
Attacks on hardware or software may render systems unable to operate properly
Unauthorised use of hard/software may translate into lost revenue or slow response time for users
Intro to cybersecurity :
Risk in the Digital Economy
Risk is viewed as the possibility of loss of confidential data, or the destruction, generation or use of fatal programmes that physically, mentally or financially harm another party as well as hard hardware
Intro to cybersecurity :
What is Risk Management
Identify Risks, including their probabilities and impacts
Identify possible solutions to these risks
Implement the solutions targeting the highest-impact, most-likely risk
Monitor the risks to learn for future risk
Intro to cybersecurity :
Where to begin?
The ‘endpoint’ :
Desktop, laptop, tablet, mobile phone, connected object (Internet of Things?)
Identity Management, disk encryption, Anti-virus/Anti-spam (could be AI based)
The ‘perimeter’ or ‘network edge’ :
Firewalls, intrusion detection/prevention
The network is everywhere
Intro to cybersecurity :
Cloud Computing is
Based on a utility model …
Outsource risk management
Off-premise rather than on-premise
Subscription rather than license based
All the user needs is a connection
Intro to cybersecurity :
What is IoT ?
Dell’s definition; “IoT is an ecosystem where sensors, devices, and equipment are connected to a network and can transmit and receive data for tracking, analysis and action” … and from the IEEE “… IoT … is not a second internet. Rather it is a network of items-each embedded with sensors-which are connected to the Internet”
Issues arising include :
Security & Data Governance
Data Analytics complexity (overload, latency, security)
Lack of Standards
Diversity of solutions and providers (suppliers, hosting etc.)
Where to get return-on-investment (launch, manage, monetize)
Intro to cybersecurity :
IoT example :
Implantable biomedical devices, pacemakers, insulin pumps … already established …
Point-of-sale terminals, Industrial Control Systems …
The economics of IoT mean that more devices are being developed faster …
Nature of devices could escape the notice of risk managers; consider data leakage from a networked navigation system
IoT can get in under the radar …
