Principles of Cybersecurity
There
are three key concepts or principles in cybersecurity often referred to as the
CIA triad:
- C
= Confidentiality: Ensuring
data can only be seen by authorised viewers.
- I
= Integrity: Ensuring
data accuracy and completeness; this involves stopping unauthorised users
from altering or manipulating it.
- A
= Availability: Ensuring
data and services are readily accessible when needed by authorised users.
Understanding
cybersecurity fundamentals is the first step toward protecting yourself or your
business against potential cyber threats. Cybersecurity is ever-evolving as new
threats appear and innovative methods of defence become available.
Cybersecurity is more than simply stopping attacks; it is about creating an
environment in which any attacks that do happen have minimal effects and swift
recovery is achieved. Let us continue this fascinating exploration of this
field!
Cybersecurity
in the Digital Age
The
Digital Age: A New Frontier
Why
is Cybersecurity Important?
The
digital or information age is an era in human history defined by an economic
shift away from traditional manufacturing towards an economy reliant on
information technology. Today we live more connected than ever before as
data is produced, stored, shared, and accessed across computers, mobile phones
and cloud platforms worldwide.
While our connected and data-driven world provides many conveniences and
advancements, it also presents numerous risks and vulnerabilities which
necessitate the implementation of cybersecurity practices to safeguard us all.
Therefore, its significance cannot be underrated.
More
Relevant Than Ever
Cybersecurity
in today's digital environment continues to rise for multiple reasons:
- Increased
Cybercrime: As
we become increasingly dependent upon technology, so does cybercrime.
Cybercriminals have become more sophisticated as has their reward for
conducting crime online.
- Growth
of Internet of Things (IoT): With
more devices connecting to the internet--from smartphones and smart home
appliances to other connected gadgets like drones--coming online, more
vulnerabilities and entry points for hackers increase exponentially.
- COVID-19
and Remote Work: COVID-19
has led to an acceleration in remote work practices by businesses,
expanding digital footprint and raising demands for secure remote access
to resources.
- Emergence
of AI/ML: These
cutting-edge technologies may bring many advantages, yet also pose new
cybersecurity threats. Attackers could exploit them to automate cyber
attacks or enhance phishing attempts - and more!
5. As we progress into a
digital society, cybersecurity will remain at the centre of discussions. Each
person plays their part by protecting personal data or company assets while
keeping themselves updated about regulations to keep themselves protected against
threats.
6. Keep this in mind as we
journey toward creating a safe digital world - every step towards understanding
and adopting better cybersecurity practices will bring us closer to that goal.
7.
Overview of Cyber Threats and Attack Vectors
8. What are Cyber Threats?
9. Cyber threats can be
defined as attempts by criminals or hackers to damage or disrupt computer
networks or systems for illicit gain, typically to steal, alter, or destroy
targets by hacking into vulnerable systems and then using that access point as
their weapon of attack.
10. Types of Cyber Threats
11. 1. Malware
12. Malware can be defined
as malicious software installed without consent on an end user device with the
intention of harming them and/or their data, including viruses such as worms
and trojans as well as ransomware and spyware. All such examples constitute
examples of Malware.
13. 2. Phishing
14. The Phishing technique
is a devious method of cybercrime where scammers design falsely
realistic-looking websites or emails in order to entice unaware victims into
providing confidential information such as passwords as well as credit card
numbers and social security numbers.
15. 3. Man-in-the-Middle
Attacks
16. Man-in-the-Middle
attacks are cybersecurity attacks wherein an attacker secretly intervenes
between two parties' communication to eavesdrop, alter data or pose as trusted
entities, jeopardising both confidentiality and integrity of communications
between them.
17.
4. Distributed Denial of Service Attacks
18. When engaged in, DDoS
attacks use brute-force traffic attacks against networks or websites in an
effort to render it unavailable for user use.
19. 5. SQL Injection
20. In an SQL Injection
attack, attackers take advantage of vulnerabilities in web application's
database query software in order to gain unauthorised access to information.
21. 6. Zero-Day Exploits
22. Zero-day exploits are
cyber attacks which strike upon discovering any weakness in software, often on
its very first day of discovery. Because most affected parties remain unaware
of it until much later, exploits may remain for days, weeks, or even months
until being patched by those with the best protection plans in place.
An
attack vector is any route through which an attacker gains unauthorised entry
to a computer or network with malicious intentions and delivers their payload
or payoff. Attack vectors allow hackers to exploit system vulnerabilities -
including human ones - by exploiting human vulnerabilities as part of an
offensive strategy.
Common Attack Vectors
1. Email and Phishing
Email has emerged as a primary
attack vector, with phishing being one of the more popular attack techniques
used against users. Attackers typically pose as trusted organisations to lure
recipients into clicking malicious links or downloading infected attachments
from an email sent from them.
2. Web
Attackers may exploit
vulnerabilities in web applications to gain unauthorised access or spread
malware, either via SQL injection, cross-site scripting (XSS), or simply
uploading files with malware onto them.
3. Social Engineering
Social engineering involves
deceiving or coercing individuals into divulging confidential information
through various techniques like phishing, pretexting, baiting and tailgating.
4. Physical Media
Attackers often employ physical
devices such as USB flash drives to gain entry to systems and compromise them.
Leaving such seemingly innocent items lying about makes for easier compromise
by attackers who will soon discover it and exploit its vulnerabilities.
5. Unpatched Software
Software with known vulnerabilities
that has yet to be patched can provide attackers with easy entry points into
networks containing zero-day attacks, making exploitation an attractive
prospect.
Understanding cyber threats and
attack vectors used by cybercriminals is essential for cybersecurity. When
exploring this subject further, remember: awareness is power! By becoming
better acquainted with potential dangers we will have better chances at protecting
ourselves against future attacks.
Legal and Ethical Considerations in
Cybersecurity
So far we've discussed the
essentials of cybersecurity - its purpose, importance and the various threats
and attack vectors it is vulnerable to - but now let's turn our focus onto
legal and ethical considerations surrounding this area of research.
Understanding Cybersecurity Laws
Cybersecurity laws refer to
legislation and statutes related to internet usage by individuals, businesses
and governments alike.
Their aim is to safeguard users against online crime while outlining legal
processes that should be undertaken following any potential cyber breaches or
incidents.
Ethical Considerations in
Cybersecurity
Legal requirements aside, ethical
considerations also play a pivotal role in cybersecurity. Ethical
considerations often revolve around what actions would constitute the
"right" or "good" course of action in any particular
circumstance.
Here are some of the major ethical concerns for cybersecurity:
- Privacy: When protecting systems
and data, cybersecurity professionals often gain access to sensitive
personal or organisational data which should remain private and
undisclosed. Maintaining its protection as part of ethical practice is
therefore of utmost importance.
- Disclosure: When security
researchers or cybersecurity professionals find vulnerabilities within a
system, an ethical question arises of when, how and to whom this
information should be disclosed.
- Proportionality: When responding to cyber
threats, defence measures should be proportionate with their intensity and
should aim at minimising further disruption or injury.