MODULE 1 - CERTIFICATION CYBER OPS ASSOCIATE Flashcards
Hijacked People
Sarah stopped by her favorite coffee shop to grab her afternoon drink.
She placed her order, paid the clerk, and waited while the baristas worked furiously to fulfill the backup of orders.
Sarah pulled out her phone, opened the wireless client, and connected to what she assumed was the coffee shop’s free wireless network.
However, sitting in a corner of the store, a hacker had just set up an open “rogue” wireless hotspot posing as the coffee shop’s wireless network.
When Sarah logged onto her bank’s website, the hacker hijacked her session and gained access to her bank accounts.
Another term for rogue wireless hotspots is “evil twin” hotspots.
Search the internet on “evil twin hotspots” to learn more about this security threat.
Ransomed Companies
Rashid, an employee in the finance department of a major publicly held corporation, receives an email from his CEO with an attached PDF.
The PDF is about the company’s third quarter earnings.
Rashid does not remember his department creating the PDF.
His curiosity is piqued, so he opens the attachment.
The same scenario plays out across the organization as dozens of other employees are successfully enticed to click the attachment.
When the PDF opens, ransomware is installed on the employees’ computers and begins the process of gathering and encrypting corporate data.
The goal of the attackers is financial gain, because they hold the company’s data for ransom until they are paid.
Targeted Nations
Some of today’s malware is so sophisticated and expensive to create that security experts believe only a nation state or group of nations could possibly have the influence and funding to create it.
Such malware can be targeted to attack a nation’s vulnerable infrastructure, such as the water system or power grid.
This was the purpose of the Stuxnet worm, which infected USB drives. These drives were carried by five Iranian component vendors into a secure facility that they supported.
Stuxnet was designed to infiltrate Windows operating systems and then target Step 7 software. Step 7 was developed by Siemens for their programmable logic controllers (PLCs).
Stuxnet was looking for a specific model of the Siemens PLCs that controls the centrifuges in uranium processing facilities. The worm was transmitted from the infected USB drives into the PLCs and eventually damaged many of these centrifuges.
Zero Days, a film released in 2016, documents what is known about the development and deployment of the Stuxnet targeted malware attack. Search for Zero Days to find the film or information about the film.
Threat Actors Threat actors include, but are not limited to, amateurs, hacktivists, organized crime groups, state-sponsored, and terrorist groups.
Threat actors are individuals or groups of individuals who perform cyberattacks.
Cyberattacks are intentional malicious acts meant to negatively impact another individual or organization.
– Amateurs
– Hacktivists
– Financial gain
– Trade Secrets and Global Politics
Amateurs : Amateurs, also known as script kiddies, have little or no skill.
They often use existing tools or instructions found on the internet to launch attacks.
Some are just curious, while others try to demonstrate their skills by causing harm.
Even though they are using basic tools, the results can still be devastating.
https://snipboard.io/gu1eQm.jpg
Threat Actors
Threat actors include, but are not limited to, amateurs, hacktivists, organized crime groups, state-sponsored, and terrorist groups.
Threat actors are individuals or groups of individuals who perform cyberattacks.
Cyberattacks are intentional malicious acts meant to negatively impact another individual or organization.
– Amateurs
– Hacktivists
– Financial gain
– Trade Secrets and Global Politics
Hacktivists :
Hacktivists are hackers who protest against a variety of political and social ideas.
Hacktivists publicly protest against organizations or governments by posting articles and videos, leaking sensitive information, and disrupting web services with illegitimate traffic in distributed denial of service (DDoS) attacks.
https://snipboard.io/0tRmbe.jpg
Threat Actors
Threat actors include, but are not limited to, amateurs, hacktivists, organized crime groups, state-sponsored, and terrorist groups.
Threat actors are individuals or groups of individuals who perform cyberattacks.
Cyberattacks are intentional malicious acts meant to negatively impact another individual or organization.
– Amateurs
– Hacktivists
– Financial gain
– Trade Secrets and Global Politics
Financial gain :
Much of the hacking activity that consistently threatens our security is motivated by financial gain.
These cybercriminals want to gain access to our bank accounts, personal data, and anything else they can leverage to generate cash flow.
https://snipboard.io/ZCPuFK.jpg
Threat Actors
Threat actors include, but are not limited to, amateurs, hacktivists, organized crime groups, state-sponsored, and terrorist groups.
Threat actors are individuals or groups of individuals who perform cyberattacks.
Cyberattacks are intentional malicious acts meant to negatively impact another individual or organization.
– Amateurs
– Hacktivists
– Financial gain
– Trade Secrets and Global Politics
Trade Secrets and Global Politics :
In the past several years, we have heard many stories about nation states hacking other countries, or otherwise interfering with internal politics.
Nation states are also interested in using cyberspace for industrial espionage.
The theft of intellectual property can give a country a significant advantage in international trade.
Defending against the fallout from state-sponsored cyberespionage and cyberwarfare will continue to be a priority for cybersecurity professionals.
https://snipboard.io/IA2wS8.jpg
How Secure is the Internet of Things?
The Internet of Things (IoT) is all around us and quickly expanding.
We are just beginning to reap the benefits of the IoT. New ways to use connected things are being developed daily.
The IoT helps individuals connect things to improve their quality of life.
For example, many people are now using connected wearable devices to track their fitness activities.
How many devices do you currently own that connect to your home network or the internet?
How secure are these devices?
For example, who wrote the firmware?
Did the programmer pay attention to security flaws?
Is your connected home thermostat vulnerable to attacks? What about your digital video recorder (DVR)?
If security vulnerabilities are found, can firmware in the device be patched to eliminate the vulnerability?
Many devices on the internet are not updated with the latest firmware.
Some older devices were not even developed to be updated with patches.
These two situations create opportunity for threat actors and security risks for the owners of these devices.
How secure are these devices?
For example, who wrote the firmware?
Did the programmer pay attention to security flaws?
Is your connected home thermostat vulnerable to attacks?
What about your digital video recorder (DVR)?
If security vulnerabilities are found, can firmware in the device be patched to eliminate the vulnerability?
Many devices on the internet are not updated with the latest firmware.
Some older devices were not even developed to be updated with patches.
These two situations create opportunity for threat actors and security risks for the owners of these devices.
In October 2016, a DDoS attack against the domain name provider Dyn took down many popular websites.
The attack came from a large number of webcams, DVRs, routers, and other IoT devices that had been compromised by malicious software.
These devices formed a “botnet” that was controlled by hackers. This botnet was used to create an enormous DDoS attack that disabled essential internet services.
Dyn has posted a blog to explain the attack and their reaction to it. Search on “Dyn Analysis Summary of Friday October 21 Attack” to learn more about this record-breaking attack.
For an explanation of the dangers of not securing IoT devices, search for Avi Rubin’s TED talk, “All Your Devices can be Hacked.” Dr. Rubin is a Professor of Computer Science at Johns Hopkins University.
Threat Impact
– PII,
– PHI, and
– PSI The economic impact of cyberattacks is difficult to determine with precision.
However, it is estimated that businesses will lose over $5 trillion annually by 2024 due to cyberattacks.
PII :
Personally identifiable information (PII) Personally identifiable information (PII) is any information that can be used to positively identify an individual.
Examples of PII include:
Name
Social security number
Birthdate
Credit card numbers
Bank account numbers
Government issued ID Address information (street, email, phone numbers)
PII : Personally identifiable information (PII)
Personally identifiable information (PII) is any information that can be used to positively identify an individual.
Examples of PII include:
Name
Social Security Number
Birthdate
Credit card numbers
Bank account numbers Government issued ID Address information (street, email, phone numbers)
One of the more lucrative goals of cybercriminals is obtaining lists of PII that can then be sold on the dark web.
The dark web can only be accessed with special software and is used by cybercriminals to shield their activities.
Stolen PII can be used to create fake financial accounts, such as credit cards and short-term loans.
PHI : Protected Health Information
A subset of PII is protected health information (PHI).
The medical community creates and maintains electronic medical records (EMRs) that contain PHI.
In the U.S., handling of PHI is regulated by the Health Insurance Portability and Accountability Act (HIPAA).
In the European Union the General Data Protection Regulation (GDPR) protects a broad range of personal information in including health records.
PSI : Personal Security Information (PSI)
Personal security information (PSI) is another type of PII.
This information includes usernames, passwords, and other security-related information that individuals use to access information or services on the network.
According to a 2019 report by Verizon, the second most common way that threat actors breached a network was by using stolen PSI.
Most hacks on companies and organizations that have been reported in the news involved stolen PII or PHI.
Recent examples are:
In 2019, an online graphic design tool website experienced a data breach in which PII for approximately 137 million users was viewed by hackers with user details for 4 million accounts appearing on the internet.
In 2020, a major Chinese social media company was hacked resulting in theft of PII, including phone numbers, stolen from 172 million users.
The theft did not include passwords, so the data was available for a low price on the internet.
In 2019, a company that makes games that are played on Facebook was hacked and the PII of 218 million users was stolen.
Lost Competitive Advantage
Companies are increasingly worried about corporate espionage in cyberspace.
The loss of intellectual property to competitors is a serious concern.
An additional major concern is the loss of trust that comes when a company is unable to protect its customers’ personal data.
The loss of competitive advantage may come from this loss of trust rather than another company or country stealing trade secrets.
Lost Competitive Advantage
Companies are increasingly worried about corporate espionage in cyberspace.
The loss of intellectual property to competitors is a serious concern.
An additional major concern is the loss of trust that comes when a company is unable to protect its customers’ personal data.
The loss of competitive advantage may come from this loss of trust rather than another company or country stealing trade secrets.
Politics and National Security
It is not just businesses that get hacked. In February 2016, a hacker published the personal information of 20,000 U.S.
Federal Bureau of Investigation (FBI) employees and 9,000 U.S. Department of Homeland Security (DHS) employees.
The hacker was apparently politically motivated.
Politics and National Security
The Stuxnet worm was specifically designed to impede Iran’s progress in enriching uranium that could be used in a nuclear weapon. Stuxnet is a prime example of a network attack motivated by national security concerns.
Cyberwarfare is a serious possibility. State-supported hacker warriors can cause disruption and destruction of vital services and resources within an enemy nation.
The internet has become essential as a medium for commercial and financial activities. Disruption of these activities can devastate a nation’s economy.
Controllers, similar to those attacked by Stuxnet, also are used to control the flow of water at dams and the switching of electricity on the power grid.
Attacks on such controllers can have dire consequences.
