TUTORIAL 1 - INTRO TO INFOCOMM SECURITY Flashcards
examples of recent attacks
USB flash drive malware/USB killer
WINVote voting machine tampering
Vtech security breach
stolen data from European Space Agency
IRS fraud
Hyatt Hotels Corporation hacked
reasons for successful attacks
widespread vulnerabilities
configuration issues
poorly designed software
hardware limitations
enterprice-based issues
what are the tasks and goals of information security
tasks of securing info in digital format:
manipulated by microprocessor
preserved on storage device
transmitted over network
goal:
to ensure that protective measures properly implemented to ward off attacks & prevent total collapse of system when attacked
as security ↑, convenience ↓
3 types of info protection (CIA)
confidentiality: only approved individuals may access info
integrity: info is correct & unaltered
availability: info accessible to authorised users
what are the information security layers
products layer
form security around data
Eg. door locks, net sec eq, etc
people layer
those who implement & use sec products to protect data
policies & procedures layer
plans & policies etablished by enterprise to ensure that people crrectly use the products
what are the different types of terminologies
asset
threat
threat actor
vulnerability
threat vector
risk
Identity Theft
what is the definition of the (ATT) terminology
asset: item with value
threat: action that may cause harm
threat actor: person/element who can cause threat ( individuals who launch attacks against other users & their pcs )
what does vulnerability mean
flaw/weakness that allows threat agent to bypass security
what is a threat vector
means which attack can occur
define risk
situation that involves exposure to some danger
what are some risk response techniques
accept: risk acknowledged but no steps taken to address yet
transfer: transfer risk to 3rd party
avoid: identify risk but make decision not to engage in activity
mitigate: address risk by making risk less serious
what is an identity theft
stealing another person’s personal info, usually for financial gain
what are the types of identity theft
steal person’s SSN (social security no.)
create new credit card acc to charge purchases & leave unpaid
file fraudulent tax returns
what importance does information security hold
preventing data theft
thwarting identity theft
avoiding legal consequences of not securing info
maintaining productivity
foiling cyberterrorism
what is preventing data theft
it is the primary objective of an organization’s information security
it involves stealing proprietary
(owned) business information
it also involves stealing credit card numbers
examples of avoiding legal consequences through laws protecting electronic data privacy
Health Insurance Portability & Accountability Act of 1996 (HIPAA)
Sarbanes-Oxley Act of 2002 (Sarbox)
Gramm-Leach-Billey Act (GLBA)
Payment Card Industry Data Security Standard (PCI DSS)
state notification & security laws
California’s Database Security Breach Notification Act (2003)
what are the types of singapore laws for information security
data privacy
- personal
data protection act 2012
cybersecurity
- cybersecurity act 2018
cybercrime
- computer misuse act (Cap. 50A)
define cyberterrorism
any premeditated, politically motivated attack aginst info, pc systems, programs & data
what is cyberterrorism designed to do and who may be potential targets
cause panic
provoke violence
result in financial catastrophe
banking industry, military installations, power plants, air traffic control centers & water systems
what are the different type of attackers
threat actor
Script Kiddies
Hacktivists
Nation State Actor
Advanced Persistent Threat
Insiders
what are threat actor’s crimes and variations
financial cybercrime - divided into 2 categories
1st category focuses on individuals as victims
2nd category focuses on enterprises & gov
they have 4 types of variations:
attributes
funding & resources
whether internal/external to enterprise/org
intent & motivation
what are the script kiddies
individuals who want to attack computers yet lack the knowledge of computers & network needed to do so
download automated hacking software (scripts) from websites
40% of their attacks require low/no skills
what are the hacktivists and what crimes do they commit
they attack for ideological reasons generally not as well-defined as cyberterrorist’s motivation
crimes:
breaking into website & changing contents on site to make political statement
disabling website belonging to bank as bank stopped accepting payments deposited into accounts belonging to hactivists
what is a nation state actor
they are attackers commissioned by govs to attack enemies’ info systems
may target foreign govs/citizens of gov that are considered hostile/threatening
known for being well-resourced & highly trained
