Definition:
Cybersecurity is the process of safeguarding your devices, data, and online presence against unauthorized access, use, disclosure, disruption, alteration, or destruction. It’s like installing a security system in your digital life to protect your data.
Requirements:
Generally, you need some knowledge in some areas to understand cybersecurity as it encompasses several types of skills and basics . These may include:
Basic Computer Skills
Networking Knowledge
Programming Knowledge
Understanding of Security Principles
Information Security
System Security
Network Security
Table of Content:
CIA Triad
The Importance of Cybersecurity
Limitation of Cybersecurity
Common Threats
Common Types of Attacks
Vulnerabilities
Conclusion
Useful Resources
CIA Triad:
The security of any organization starts with three principles: Confidentiality, Integrity and Availability. Next in this cyber security for beginners tutorial we will learn about the CIA Triad, which has served as the industry standard for computer security since the time of first mainframes.
Confidentiality: The principle of confidentiality asserts that only authorized parties can access sensitive information and functions. Example: military secrets.
Integrity: The principle of integrity asserts that only authorized people and means can alter, add, or remove sensitive information and functions. Example: a user entering incorrect data into a database.
Availability: The principle of availability asserts that systems, functions, and data must be available on-demand according to agreed-upon parameters based on levels of service.
Importance of Cybersecurity
Safeguards Personal Information: Prevents theft and illegal access to sensitive data, including financial, health, and personal information
Maintains Reputation: Prevents security mishaps or data exposures that could erode trust among stakeholders, clients, and customers.
Boosts Output: Prevents downtime brought on by cyber incidents that could impair production by guaranteeing the uninterrupted operation of networks and systems.
Supports Remote Work: Enables flexible work schedules without sacrificing security by providing remote workers with secure access to company networks and data.
Regulation Adherence: Assists companies in meeting legal and regulatory obligations around cybersecurity and data protection.
Strengthens Cyber Stance: Strengthens an organization’s defenses against cyber threats and assaults by enhancing its overall cybersecurity posture.
Better Data Handling: Guarantees integrity, confidentiality, and availability through secure storage, transmission, and processing.
Advantages of Cybersecurity
Cost Savings: Prevents financial losses associated with data breaches, regulatory fines, and operational disruptions.
Competitive Advantage: Demonstrates commitment to security, enhancing trust with customers and partners, and potentially attracting new business opportunities.
Innovation Support: Provides a secure environment for innovation and digital transformation efforts without compromising security.
Customer Confidence: Builds trust and confidence among customers, leading to increased satisfaction and loyalty.
Risk Management: Helps mitigate risks associated with cyber threats, reducing the likelihood and impact of security incidents.
Business Continuity: Ensures business operations can continue uninterrupted even in the face of cyberattacks or other security challenges.
Disadvantages of cybersecurity:
Despite cybersecurity having a great positive impact in the computing world it still have some limitations on the same.Some of the challenges include:
Needs continuous learning
The learning process is ongoing because threats are new and never-ending
Complex to setup
Setting up protection architectures and tools requires specialized employees, as it is a complex and time-consuming process.
Slow systems
Systems tend to become sluggish, as these protection programs consume a lot of resources.
Constant tracking
Real-time monitoring of systems and networks is needed to detect threats early, allowing the security team to assess risk levels and develop a cybersecurity strategy to counter them.
Talent shortage
The number of qualified specialists is few compared to the requirements in the field of cybersecurity.
High cost
Cybersecurity can be very expensive, requiring constant learning and spending, which can be a challenge for many small businesses.
Common Threats:
Phishing scams
These are deceptive emails or messages that attempt to fool one into providing personal information or clicking on dangerous links.
Example: You receive an email that appears to be from your bank, warning about suspicious activity on your account. The email prompts you to click a link and log in to verify your identity. However, the link leads to a fake website designed to steal your login credentials.
Malware
This is a malicious software (viruses, worms, etc.) that can infect your devices, steal data, or disrupt operations(Stytz & Banks, 2006).
Example: You download a seemingly harmless free software program from an untrusted source. Once installed, the program secretly installs malware on your computer that encrypts your files, demanding a ransom payment to decrypt them. This is a common example of ransomware, a specific type of malware.
Computer hacking
It alludes to attempts made without authorization to enter networks or computer systems.
Example: Hackers exploit a security vulnerability in a company’s database, gaining access to customer information such as credit card details and personal data. This information can be sold on the black market or used for further fraudulent activities.
Social Engineering-Deception, Not Force.
This is a method used by hackers to trick people into disclosing sensitive information or performing activities that jeopardize their security. Unlike hacking, which exploits technological flaws in systems, social engineering preys on human trust and vulnerability.
Example: You receive a phone call from someone claiming to be from your internet service provider (ISP). They inform you of a problem with your account and request remote access to your computer to fix it. In reality, the caller is a social engineer trying to gain control of your device and potentially steal sensitive information.
Vishing
This is a short for “voice phishing”. A type of social engineering attack where cyber criminals use phone calls to trick individuals into providing sensitive information or performing actions that compromise their security. The attackers typically pretend to be representatives from legitimate organizations such as banks, government agencies, or tech support services to gain the victim’s trust.
Example: You receive a voicemail from someone claiming to be from the government, stating that there’s an issue with your tax return and urging you to call a specific number to resolve it. The number connects you to a scammer who attempts to pressure you into revealing your social security number or making a fraudulent payment.
Smishing
Like phishing emails, smishing employs SMS text messages to deceive victims. You may receive a notice about a bogus parcel delivery issue or a tempting offer that demands you to click on a malicious website or supply sensitive information.
Example: You receive a text message claiming you won a prize in a contest you never entered. The message includes a link to a website where you need to provide your personal details to claim the prize. Clicking the link takes you to a fake website designed to steal your information.
Pretexting
In this case, the attacker fabricates a story to earn your trust and access to sensitive data. For example, they could act as a tech support agent calling to “fix” an issue with your computer, eventually luring you into giving them remote access or divulging passwords.
Example: You receive a call from someone claiming to be from a charity organization. They provide a sob story and pressure you into donating money over the phone. However, the caller is a fraudster who will pocket the donation instead of directing it to a legitimate cause.
Common Types of Attacks
There are mainly five types of attacks:
Distributed denial of service(DDoS) – Through flooding the traffic used to access resources, it is an attack designed to prevent a user from using those resources. Every bot under the control of a botnet is managed by a botnet controller. The attacker instructs the botnet controller to launch a bot attack on a server, flooding it with bot traffic. The website’s traffic will be so heavy that a person attempting to visit it will be unable to do so.
Email attacks – there are three types of Email attacks
Phishing- Usually through email, the attackers sends bait, it motivates people to divulge personal information
Spoofing- The assailant posses as a different individual or entity and sending you an email purporting to be authentic.
Email Attachment- Emails can be used to send files. These files could be documents, files, audio or pictures. You receive an email from attackers urging you to open the attached files.
Password attacks – Five different kinds of password assaults exist:
Dictionary attack: With this technique, we use the dictionary to handle all potential passwords.
Brute force: This technique uses trial and error to figure out how to decode the data or password. It takes the longest to execute this attack.
Keylogger: A keylogger does exactly what its name implies—it logs every keystroke made on a keyboard. Keyloggers are used by most hackers to obtain passwords and account information.
Shoulder surfing: By peering over the user’s shoulder, the attackers can see what’s on their keyboard.
Rainbow table: Precomputed hash values can be found in rainbow tables. Attackers utilize this table to determine the user’s password.
Malware Attack
This is a malicious program or software that disrupts or damages the computer.
There are various types of malware.
Virus: A computer virus is a malicious code that replicates by copying itself to another program or document and changes how a computer works. The virus requires someone to knowingly or unknowingly spread the infection without the knowledge or permission of a user or system administrator. An example of a virus is the Melissa virus.
Worms: These are standalone programs that run independently and infect systems. For example, W32.Alcra.F is a worm that propagates through network share devices.
Essential Practices
1. Use of Strong Passwords
Create unique and complex passwords for each online account(CISA, 2023). Consider using a password manager to help you keep track.
Regularly update your operating systems, browsers, and software applications to patch security vulnerabilities.
c. Beware of Suspicious Links
Don’t click on links or attachments in emails or messages from unknown senders.
d. Secure Wi-Fi
Avoid using public Wi-Fi for sensitive activities like online banking. If you must use it, consider a VPN (Virtual Private Network) for added security.
e. Antivirus Software
Install and maintain reputable antivirus software on your devices to help detect and prevent malware infections.
Internal threats consists of:
– Employee Negligence: Unintentional actions or mistakes made by employees, such as clicking on malicious links or failing to follow security protocols, which can lead to security breaches.
– Insider Threats: Malicious actions taken by individuals within an organization, such as disgruntled employees or contractors, to steal data, sabotage systems, or cause harm.
Vulnerabilities
Explaining common vulnerabilities in systems and networks helps users understand the potential weak points that cyber attackers exploit, enabling them to develop effective strategies to safeguard against such threats and enhance overall cybersecurity.
Conclusion
By implementing these foundational cybersecurity practices, you can significantly reduce your risk of falling victim to cyber threats. Remember, cybersecurity is an ongoing process, so stay informed and adapt to new challenges as they arise.
Useful Resources:
CISA. (2023). Cybersecurity Best Practices | Cybersecurity and Infrastructure Security Agency CISA. Www.cisa.gov. https://www.cisa.gov/topics/cybersecurity-best-practices
Stytz, M. R., & Banks, S. B. (2006). Personal privacy, information assurance, and the threat posed by malware techology. Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE. https://doi.org/10.1117/12.665344
Top 8 Cyber Security Vulnerabilities. (n.d.). Check Point Software. Retrieved May 23, 2024, from https://www.checkpoint.com/cyber-hub/cyber-security/top-8-cyber-security-vulnerabilities
