Unit 4. FOUNDATIONS OF IT SECURITY

Question 1

The primary objective of information security

Answer 1

Confidentiality, Integrity, Availability
These terms, described as the “CIA triad” by Saltzer & Schroeder (1975), describe the central goals of information security:
* confidentiality: This is the need to ensure that sensitive or private information remains
protected from unauthorized access and disclosure. It also extends to the concept of
privacy, empowering individuals to control how their information is collected, stored,
and shared.
* integrity: This is ensuring that information is altered only in authorized and specified
ways, and that unauthorized modification or destruction is prevented. System integrity
ensures that a system functions as intended, free from any deliberate or inadvertent
manipulation.
* availability: This is the aim of providing prompt and reliable access to information and
systems for authorized users, while preventing any denial of service to these users
(DoS)

Question 2

An effective information security strategy

Answer 2

An effective information security strategy should prevent the opposite of the CIA principles: disclosure (unauthorized exposure), alteration (unauthorized changes), and denial (restricted access to authorized users). Security measures must defend against these threats.

Question 3

What are the three key concepts used in information security to determine the scale and appropriateness of defensive measures, and how do they help organizations assess their security investments?

Answer 3

The three key concepts are threat, vulnerability, and risk. These concepts help organizations evaluate the necessary level of investment in security by providing a baseline to assess their current protection measures. As threats evolve, vulnerabilities emerge, and risks change, organizations must continuously adjust their security investments to maintain adequate protection.

Question 4

Attack Forms and Protective Measures

Answer 4

Main Points:
1. Importance of Safeguarding Information Assets
* Protecting data and computer system integrity requires understanding and defending against attacks.
2. Definition of an Attack
* An attack is an attempt to disable computers, steal/modify data, or exploit a compromised system for further attacks.
3. Methods Used by Attackers
* Attackers use malware and deceptive techniques (e.g., phishing).
4. Types of Attacks
* Passive attacks (e.g., eavesdropping).
* Active attacks (e.g., data alteration or system disruption).
5. Defensive Measures
* Organizations must implement protective strategies to prevent or counteract attacks.

Question 5

Main Points on Passive Attacks

Answer 5

1. Definition:
   
   • Passive attacks involve monitoring and intercepting data without modifying it.
   • The goal is to obtain sensitive information from transmitted data.
     2. Types of Passive Attacks:
   • Release of Message Contents:
   • Attackers eavesdrop on communication channels (e.g., emails, phone calls, files).
   • Example: Stealing trade secrets by intercepting confidential emails.
   • Traffic Analysis:
   • Attackers analyze patterns in data transmission (e.g., login frequency, message length).
   • Even if the data is encrypted, metadata can still reveal user behavior.
     3. Challenges in Detection:
   • Passive attacks are hard to detect since they don’t alter data.
     4. Mitigation Strategies:
   • Encryption helps protect data from being read if intercepted.
   • However, encryption alone may not prevent traffic analysis, as metadata can still reveal communication details.

Question 6

Main Points on Active Attacks

Answer 6

1. Definition:
   
   • Active attacks involve modifying or creating false data to disrupt systems or deceive users.
     2. Types of Active Attacks:
   • Masquerade:
   • Attackers impersonate legitimate users using stolen credentials.
   • Can involve capturing and replaying authentication data.
   • Replay:
   • Attackers capture and retransmit data (e.g., login credentials) to bypass security.
   • Modification of Messages:
   • Attackers alter, delay, or reorder messages to disrupt system integrity.
   • Example: Changing product prices on an e-commerce site.
   • Denial of Service (DoS):
   • Attackers overwhelm a system, making it unavailable to users.
   • Distributed Denial of Service (DDoS): Uses multiple devices to flood a target server.
     3. Challenges & Mitigation:
   • Active attacks are difficult to prevent due to various vulnerabilities.
   • Defense strategies focus on detecting attacks and recovering from disruptions.

Question 7

Key Security Techniques:

Answer 7

• Encryption: Maintains confidentiality by making data inaccessible to unauthorized users (e.g., AES, 3DES, RSA, ECC).
  
  • Hashing: Ensures data integrity by detecting modifications (e.g., SHA-2, SHA-3, BLAKE2).
  • Authentication: Verifies user identity to prevent unauthorized access (e.g., passwords, biometrics, token authentication, digital signatures).
  • Digital Certification: Uses trusted third parties (Certification Authorities - CAs) to confirm entity identity via digital certificates.
  • Digital Signatures: Provide authentication, integrity, and non-repudiation by verifying the sender and ensuring message authenticity.

Question 8

Main Points on the Importance of Cybersecurity

Answer 8

Main Points on the Importance of Cybersecurity
1. Growing Need for Cybersecurity
* Protecting personal information is increasingly challenging due to the rise in online users and digital reliance.
* Two key factors fueling cybercrime:
* Proliferation of mobile technology & smart devices.
* Widespread use of social media.
2. Impact of Mobile Technology on Data Security
* Smartphones store sensitive personal data (bank details, passwords, communication history, location).
* Growth of the Internet of Things (IoT) expands data collection (wearables, vehicle sensors).
3. Risks Posed by Social Media
* Social networks encourage sharing personal data, often exposing users to privacy risks.
* Many online platforms collect and monetize user data, opposing restrictions on data processing.
4. Cybercrime Growth and Security Concerns
* The combination of social media and smart devices has led to an increase in cybercrime.
* Protecting personal information requires strong cybersecurity measures.
5. What Cybersecurity Involves
* Cybersecurity protects systems, networks, and data.
* It includes technological measures (encryption, firewalls, anti-malware).
* Education is equally important to raise awareness and improve digital safety.

Question 9

Main Points on Vulnerabilities, Threats, and Protective Measures in the Online Environment

Answer 9

1. Vulnerabilities and Threats in the Online Environment
   
   • No system is completely secure; all have weaknesses.
   • Organizations must identify vulnerabilities and analyze cyber threats to mitigate risks.
   • Cybersecurity evolves rapidly as cybercriminals and defenders continuously adapt.
2. Sources of Cybersecurity Intelligence
   
   • OWASP, CVE, NVD track vulnerabilities in software and web applications.
   • ENISA (EU) and CISA (US) publish reports on cybersecurity threats and mitigation strategies.
   • Verizon’s Data Breach Investigations Report (DBIR) provides insights into data breaches.
3. Categories of Online Threats
   
   • Malware: Harmful software that compromises systems (e.g., viruses, worms).
   • Social Engineering: Manipulating people to gain unauthorized access (e.g., phishing, identity theft).
   • Phishing: Tricking users into providing sensitive information.
   • Advanced Fee Fraud: Scams like the Nigerian Prince scam.
   • Identity Theft: Stealing personal data for financial fraud.
   • Information-Based Threats:
   • Misinformation: False information spread without intent to deceive.
   • Disinformation: Deliberately false information used to mislead and manipulate opinions.
4. Protective Measures for Personal Computers & Internet Use
   
   • Security Software: Use anti-malware tools, based on behavioral detection.
   • Regular Updates: Software updates patch vulnerabilities to prevent exploitation.
   • Password Security & 2FA: Secure, unique passwords + two-factor authentication enhance security.
   • Secure Network Usage: Avoid public Wi-Fi or use VPNs and encryption.
   • Safe Downloads: Download files only from trusted sources.
   • Backup Discipline: Regular backups prevent data loss in case of cyberattacks.
   • Cybersecurity Education: Awareness and training reduce risks of falling victim to cyber threats.
5. Conclusion
   
   • Proactive cybersecurity measures are essential in protecting personal data and assets.
   • A combination of technology, good practices, and awareness is key to staying secure online.

Question 10

Main Points on Cybersecurity and Critical Infrastructure Protection

Answer 10

1. Definition of Critical Infrastructure
   
   • Critical infrastructure includes physical and virtual public systems whose disruption can have catastrophic societal consequences.
   • Various legislative frameworks exist to protect critical infrastructure:
   • EU: European Programme for Critical Infrastructure Protection (EPCIP).
   • US: National Infrastructure Protection Plan (NIPP).
2. Threats to Critical Infrastructure
   
   • Critical infrastructure faces threats from cybercriminals and politically motivated attackers.
   • Advanced Persistent Threats (APTs) are well-funded cyberattacks by nation-states targeting infrastructure.
   • Many critical systems (e.g., power plants, water treatment facilities) rely on Industrial Control Systems (ICSs), making them vulnerable to:
   • DDoS attacks
   • Ransomware
   • Zero-day exploits
   • Example: The Colonial Pipeline ransomware attack (2021) disrupted energy supplies in the US Southeast.
3. Strategies for Protecting Critical Infrastructure
   
   • Security measures focus on availability, redundancy, and resilience:
   • Redundancy: Ensuring backup systems and alternative network routes exist.
   • Real-time monitoring: Continuous tracking and quick responses to irregularities.
   • Incident response protocols: Skilled specialists oversee security operations.
4. Critical Infrastructure Protection in the EU and US
   
   • EU:
   • EPCIP protects key sectors (e.g., energy, ICT, transportation, water, healthcare).
   • NIS2 Directive (2023) strengthens cybersecurity by expanding protection rules to all digitally interconnected sectors.
   • Private-sector firms, including IT providers, must secure their supply chains.
   • US:
   • NIPP (Department of Homeland Security - DHS) secures vital assets such as:
   • National monuments
   • Critical manufacturing
   • Defense infrastructure
   • The plan aims to identify, detect, deter, disrupt, and prepare for threats.
5. Conclusion
   
   • Protecting critical infrastructure is a collaborative effort between governments, businesses, and societies.
   • Disruptions in one sector can trigger cascading effects across interconnected systems, requiring robust cybersecurity frameworks.