Introduction to Cybersecurity Fundamentals

Introduction to Cybersecurity Fundamentals

• 1.
  Cybersecurity Fundamentals Luis Herrera,CRISC, CEH, ITILv3 14-Apr-2017
• 2.
  2 IBM Security Agenda •World vision of breaches & statistics • What is Cybersecurity? • What is Information Security? • Protect Digital Assets • Key Concepts • Cybersecurity Roles • Cybersecurity Concepts • Risk Management • Essential Terminology • Threat Agents
• 3.
  3 IBM Security World’sBiggest Data Breaches
• 4.
  4 IBM Security DataBreach Statistics
• 5.
  5 IBM Security Whatis Cybersecurity? • The protection of information assets by addressing threats to information processed, stored and transported by internetworked information systems. Information Security Cybersecurity
• 6.
  6 IBM Security Whatis Information Security (InfoSec)? • Infosec deals with information, regardless of its format (it encompasses paper documents, digital and intellectual property in people's minds, and verbal or visual communications. • Cybersecurity on the other hand, is concerned with protecting digital assets, everything from networks to hardware and information processed, stored or/and transported by internetworked information systems.
• 7.
  7 IBM Security ProtectingDigital Assets • The NIST (National Institute of Standards and Technology) & ENISA (European Union Agency for Network and Information Security) have identified 5 key functions necessary for the protection of digital assets Identify • Use organizational understanding to minimize risk to systems, assets, data and capabilities Protect • Design safeguards to limit the impact of potential events on critical services and infrastructure Detect • Implement activities to identify the occurrence of a cybersecurity event Respond • Take appropriate action after learning of a security event Recover • Plan for resilience and the timely repair of compromised capabilities and services
• 8.
  8 IBM Security KeyConcepts • It is important to understand the elements of Information Security
• 9.
  9 IBM Security CybersecurityRoles • Governance ̶ It's the responsibility of the board of directors and senior management of the organization. Provide strategic direction, ensure that objectives are achieved, ascertain whether risk is being managed appropriately and verify that the organization's resources are being used responsibly, are goals of the governance program • Risk Management ̶ It's the process by which an organization manages risk to acceptable levels, it requires the development and implementation of internal controls to manage mitigate risk throughout the organization, including financial and investment risk, physical risk and cyberrisk • Compliance ̶ The act of adhering to mandated requirements defined by laws and regulations, this also includes contractual obligations with clients, partners and internal policies
• 10.
  10 IBM Security CybersecurityConcepts • Risk: ̶ The combination of the probability of an event and its consequence (ISO/IEC 73:2009). Risk is mitigated through the use of controls or safeguards. • Approaches •Also known as standards-based security, this approach relies on regulations or standards to determine security implementations. Controls are implemented regardless of their applicability or necessity, which often leads to a “checklist” attitude toward security. Compliance- based •Risk-based security relies on identifying the unique risk a particular organization faces and designing and implementing security controls to address that risk above and beyond the entity’s risk tolerance and business needs. Risk-based •An ad hoc approach simply implements security with no particular rationale or criteria. Ad hoc implementations may be driven by vendor marketing, or they may reflect insufficient subject matter expertise, knowledge or training when designing and implementing safeguards. Ad-hoc
• 11.
  11 IBM Security RiskTreatment
• 12.
  12 IBM Security RiskTreatment (Contd) Risk Reduction/Mitigation Implement controls and/or countermeasures Risk Retention/Acceptance If the cost of the mitigation controls is higher than the cost of the impact the risk represents Risk Avoidance/Terminate Terminate the activity giving rise to risk Risk Transfer Purchase insurance to address the risk, which will be transferred to the insurance company
• 13.
  13 IBM Security Whatis Residual Risk? • The risk that still remains after countermeasures and controls have been implemented. • If residual risk is greater than the acceptable risk level, then it should be further treated with the option of additional mitigation through implementing more stringent controls
• 14.
  14 IBM Security EssentialTerminology Vulnerability Existence of a weakness, design, or implementation error that can lead to an unexpected event compromising the security of the system Asset Anything that represents value for the organization and is worth protecting Threat Anything capable of acting against an asset in a manner that can result in harm Backdoor A mean of regaining access to a compromised system by installing SW or configuring existing SE to enable remote access Brute Force Attack Trying all possible combinations of passwords or encryption keys until the correct one is found Buffer Overflow When an app tries to store more data in a buffer (temporary data storage area) than it was designed to hold, this corrupts the app and enables the attacker to introduce or run commands DDoS Attack An assault on a service from different sources that floods the target with so many requests that it becomes unavailable to anyone MitM Attack The attacker intercepts the communication stream between 2 parts, the attacker can sniff or replace the traffic Social Engineering Any attempt to exploit social vulnerabilities to gain access to information/systems
• 15.
  15 IBM Security EssentialTerminology (Contd) Phishing The attacker attempts by email to convince a user that the originator is genuine, but with malicious intentions to obtaining information Exploit A breach of IT system security through vulnerabilities Payload Is the part of an exploit code that performs the intended malicious action, such as destroying, creating backdoors, and hijacking computer SQL Injection SQL syntax is used without proper validation as part of SQL queries, this could harm the DB or even the OS Bot A "bot" is a software application that can be controlled remotely to execute or automata predefined tasks Zero-Day Attack An attack that exploits computer application vulnerabilities before the software developer releases a patch for the vulnerability XSS Cross-site scripting, malicious scripts are injected into benign and trusted websites <script>alert("PWND")</script> APT Advanced Persistent Threats are complex and coordinated attacks directed at a specific target, they require enormous research and time Spoofing Faking the sending address to gain illegal entry into a system
• 16.
  16 IBM Security ThreatAgents
• 17.
  ibm.com/security securityintelligence.com xforce.ibmcloud.com @ibmsecurity youtube/user/ibmsecuritysolutions © Copyright IBMCorporation 2016. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. Any statement of direction represents IBM's current intent, is subject to change or withdrawal, and represent only goals and objectives. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM does not warrant that any systems, products or services are immune from, or will make your enterprise immune from, the malicious or illegal conduct of any party. FOLLOW US ON: THANK YOU