P1:L1 The Security Mindset Flashcards
Why Security?
We worry about security when we have something of value and there is a risk that it could be harmed.
Why Cyber Security?
- Individuals store a lot of sensitive data online
- If stolen, criminals can profit from it.
- Societies rely on the internet
- Nefarious parties could profit by controlling it
Why Cyber Security?
Smart grids rely on cyber systems
-Whoever controls the grid controls the community infrastructure
Business and government propriety information is often stored on the internet.
-Unauthorized access could be economically or politically disasterous
There are 2 kinds of companies…
those that have been hacked and know it
and those that have been hacked and don’t know it
What is the security mindset
Who are the bad actors, what could they exploit… what will that attack be?
Threat source: who wants to do harm to us in our online lives?
Cybercriminals
they want to profit from our sensitive data for financial gain
Hacktivists
Activists who do not like something you are or something you do
Nation-states
Countries do it for political advantage or for espionage
Threat actors
exploit vulnerabilities to launch attacks
Attacks
lead to compromises or security breaches
Vulnerabilities
can be found in software, networks, and humans (weakest link)
Questions to ask when in the security mindset?
For example… when Target was “breached”
1) what is of value? (Credit card data)
2) What is the threat source? (Cyber Criminals)
3) What vulnerability was exploited? (Phishing attack)
Hacked/stolen data worth on the black market (as of March 2015):
1) 3 digit security code on your credit card = $2
2) Credit card information = $5 - $45
3) PayPal/Ebay account = $27
4) Health information = $10
3 security requirements of sensitive information to strive for
1) Confidentiality (sensitive… should not be disclosed - only to authorized)
2) Integrity (Should not be changed or corrupted only to authorized)
3) Availability (Critical to use… if it goes away or can not be accessed… this is bad)
The CIA :-)\other conseqences (Stuxnet, physical)
What security requirement is violated in a “data breach?”
Confidentiality
