Lecture 4 - Cybersecurity

Question 1

What are the problems of cybersecurity according to van den Bergh?

Answer 1

1. But difficult to understand.
2. A complex beast
3. Who fixes it and how? (shared responsibility and privately owned)

Question 2

Where lies the focus of cybersecurity?

Answer 2

Protection of Systems, Networks & Data -> Against intentional threats

Focus is on Intentional Threat, Cyber Threats and about object of harm (affecting systems).

Question 3

What are examples of accidental and intentional forms of harm in cyberspace.

Answer 3

Accidental: Error, Outage, Failure
Intentional: Attack, Disruption, Theft Exploit

Question 4

What are the 3 phases of Cyber Security Incidents?

Answer 4

1. Preventing Incidents
2. Detecting incidents
3. Responding to incidents

Question 5

What doesd the Preventing Incidents phase of Cyber Security Incidents entail?

Answer 5

1. Preventing incidents
   a. Risk management
   i. The dominant way of thinking about Cyber Security
   b. Behaviour change
   i. E-learnings etc
   c. Governance
   i. Policy

Question 6

What does the detection phase of cyber security incidents entail?

Answer 6

2. Detection: noticing incidents
   a. average time between intrusion and detection is +- 9 Months
   b. Solution: high-quality logging & monitoring

Question 7

What does the incident response phase of cyber security incidents entail?

Answer 7

a. 4 Phases:
i. Analysis
ii. Containment
iii. Recovery
iv. Learning & Adjustment

Question 8

How can you analyse who or what causes a cyber incident?

Answer 8

Cyber Accidents Model

Question 9

What are the 3 sequential elements in the Cyber Accidents Model?>

Answer 9

Actor -> Cause -> Impact

Question 10

What are examples of actors in the cyber incident model?

Answer 10

• Human Being
• Nature
  o Storms etc disturbing critical infrastructure
• Animal
  o Animals interfering with wiring
• System
  o Exploding batteries, shorting

Question 11

What are the two types of causes in human errors?

Answer 11

• Execution Error
  o Things you actually do wrong (by accident)
  o Two types
   Slip
• Ex. Falling of the stairs, because you lost focus
• Ex. Losing a USB stick with important data
   Lapse
• You know the rule, you know how to do, but you forget momentarily
• Planning Error
   Rule-based mistake
• In principle the rule is correct, but not applicable to this situation
   Knowledge-based mistakes
• No knowledge about cyber security, so not noticing that default password needed to be changed.