Security Foundations and Principles

In order to achieve security we need to combine 3 key elements (CYS pillars):

• People
• Policies
• Technologies
• People - Users must understand and comply with basic data security principles like choosing strong passwords, being wary of attachments in email, and backing up data.
• Policies - Organizations must have a framework for how they deal with both attempted and successful cyber attacks.
• Technology - Technology is essential to giving organizations and individuals the computer security tools needed to protect themselves from cyber attacks.

THREE MAIN ENTITIES MUST BE PROTECTED:

• endpoint devices like: computers, smart devices, and routers;
• networks; and
• the cloud and data centers

COMMON TECHNOLOGY USED TO PROTECT THESE

ENTITIES

• next-generation firewalls,
• DNS filtering,
• malware protection,
• antivirus software, and
• email security solutions.

• Vulnerability is a weakness in the security system
  • (i.e., in procedures, design, or implementation), that might be exploited to cause loss or harm.
• Threat - is a set of circumstances that has the potential to cause loss or harm.
  • a potential violation of security
• Exploit?
• A human (criminal) who exploits a vulnerability commits an attack on the system.
• How do we address these problems?
  • We use a control as a protective measure.
  • That is, a control is an action, device, procedure, or technique that removes or reduces a vulnerability.

https://www.getcybersafe.gc.ca/cnt/rsks/cmmn-thrts-en.aspx

• Supply Chain & Third-Party Threats
  • Compromised vendors, Insecure SaaS providers, or Malicious updates
  • Supply chain threats are external human threats with indirect access.
• AI-Enabled Threats
  • AI-generated phishing emails, Deepfake voice/video fraud
  • AI increases scale, speed, and realism of attacks
• Cloud & API Attacks
  • Cloud misconfiguration, Insecure APIs, or Token theft
• Insider Threat (Intentional vs Unintentional)
  • Malicious Insider or Negligent Insider
• Hybrid Threats
  • Cyber + Physical
  • Cyber + Psychological
  • Ex: Cyber attacks + fake social media campaigns

• Malware: Malicious Software
• Ransomware: Malware that encrypts files and demands ransom
• Social Engineering: Tricks users into revealing sensitive information
• Supply Chain Attacks: Target trusted vendors, software, or hardware to compromise multiple organizations.
• Advanced Persistent Threats (APTs): Long-term, targeted attacks (often state-sponsored) for espionage or data theft.
• Zero-Day Exploits: Exploit unknown or unpatched vulnerabilities in software or hardware.
• AI-Powered Attacks: Use of AI to automate attacks, bypass defenses, or create phishing/deepfake campaigns.
• IoT & OT Attacks: Target connected devices (IoT) or industrial/operational technology systems.
• Cloud & API Attacks: Exploit cloud misconfigurations, insecure APIs, or cloud service vulnerabilities.

• Increased CPU usage
• Slow computer or web browser speeds
• Problems connecting to networks
• Freezing or crashing
• Modified or deleted files
• Appearance of strange files, programs, or desktop icons
• Programs running, turning off, or reconfiguring themselves
• Strange computer behavior
• Emails/messages being sent automatically and without user’s knowledge

• Install quality anti-virus software
• Make sure virus definitions of the scanner are regularly updated
• Never open an attachment from an untrusted source
• Taking caution when surfing the internet and downloading files
• Backup data

• S OCIAL ENGINEERING is an attack that relies on human interaction to trick users into breaking security procedures in order to gain sensitive information that is typically protected.
  • P HISHING is a form of fraud where fraudulent emails are sent that resemble emails from reputable sources; however, the intention of these emails is to steal sensitive data, such as credit card or login information.
    • Spear phishing/ Whaling: targets a specific individual, group or organization.
    • Angler phishing (latest): targets people on social media sites by taking advantage of the trust that customers have in companies. Attackers trick users into giving up private information by pretending to be customer service
    • Vishing/Smishing: voice phishing & SMS Phishing
  • P HARMING: is a cyberattack that redirects users from a legitimate website to a fraudulent one, even when the correct web address (URL) is entered. Unlike phishing, which lures victims into clicking malicious links, pharming is more technical it poisons DNS or compromises the local — system so the victim lands on a fake site without realizing it.
    • P RETEXTING: Pretexting is use of a fabricated story, or pretext, to gain a victim's trust and trick or manipulate them into sharing sensitive information, downloading malware, sending money to criminals, or otherwise harming themselves or the organization they work for. B AITING: erpetrator lures the victim with attractive offers or rewards.
    • P T AILGATING: An unauthorized person wearing a fake ID, follow an authorized person and

• Effective Training program consisting of all security policies and methods to increase awareness on social engineering
• Operational Guidelines to ensure security of the sensitive information and authorized use of resources
• Classification of Information as top secret, proprietary, for internal use only, for public use
• Access Privileges - administrator, user and guest accounts with proper authorization
• Two factor Authentication

• Eavesdropping: Eavesdropping is as an electronic attack where digital communications are intercepted by an individual whom they are not intended (Man in the middle)
  • Sniffing: interception of data by capturing the network traffic using a sniffer (an application aimed at capturing network packets).
• Privileges escalation: is a type of network intrusion that takes advantage of programming errors or design flaws to grant the attacker elevated access to the network and its associated data and applications.
• Human Errors/mistakes ( unintentional)
• Intentional damage/harm
  • .

Integrity is the assurance that the information is reliable and accurate. Attacks focus on the violation of integrity: viruses, logic bombs, unauthorized access, errors in coding, system back doors METHODS USED TO ENSURE INTEGRITY OF DATA

• File permissions and user access controls.
• Version control maybe used to prevent erroneous changes or accidental deletion by authorized users becoming a problem.
• Checksums/ Hashing

METHODS USED TO ENSURE INTEGRITY OF

DATA

• cryptographic checksums - A cryptographic checksum is a

mathematical value (called a checksum) that is assigned to a file and used to "test" the file at a later date to verify that the data contained in the file has not been maliciously changed. Hash value = checksum

HOW TO RESTORE THE AFFECTED DATA?

• Backups or redundancies must be available to restore the affected data to its correct state.

Ensure all information is readily accessible to all authorized users at all times.

Threats to availability includes device failure, software error and environmental issues (heat, flooding, power loss), denial-of-service (DoS) attacks and network intrusions.

T O PREVENT DATA LOSS

• A backup copy may be stored in a geographically-isolated location, perhaps even in a fireproof, waterproof safe.
• Extra security equipment or software such as firewalls and proxy servers can guard against downtime and unreachable data.
• Web application firewall (CLOUDFLARE)

• Identification: Claiming to be an identity when attempting to access a secured area or system
• Authentication: Proving that you are that identity
• Authorization: Defining the permissions (i.e., allow/grant and/or deny) of a resource and object access for a specific identity
• Auditing: Recording a log of the events and activities related to the system and subjects
• Accounting (accountability ): Reviewing log files to check for compliance and violations in order to hold subjects accountable for their actions

• Data Hiding: Data hiding is the act of intentionally positioning data so that it is not viewable or accessible to an unauthorized subject
• Encryption Encryption is the art and science of hiding the meaning or intent of a communication from unintended recipients.