Please enable JavaScript.

Coggle requires JavaScript to display documents.

Becoming a Cybersecurity Specialist - Coggle Diagram

- - - - Users are often the weakest link in the info-sec systems and are significant threat to the CIA Triad of the org's data.
      - common user threats found in many orgs
        
        No awareness of security -- users should be aware of sensitive data, sec policies and procedures, tech and countermeasures provided to protect info and info sys
        
        Unauthorized media -- the use of unautho. media like CDs, USBs, and network storage devices can result in malware infections and atks
        
        Data theft -- theft by users can cost Orgs financially resulting in damage to an org's reputation or posing a legal liability associated w/ disclosure of sensitive info
        
        Unauthorized VPNs -- VPNs can hide the theft of unautho. info, the encryption normally used to protect confidentiality blinds the IT sec staff to data transit w/o proper autho.
        
        Poorly enforced security policies -- all users must be aware of sec policies and consequences of not complying with the org's rules
        
        Unauthorized websites -- accessing unautho. websites can pose a risk to the user's data, devices and the Org.
        Many sites prompt the visitors to download scripts or plugins that contain malic-code or adware
        Some of these sites can take over devices like camera and applications
        
        Unauthorized downloads -- many network and wrkst infections and atks trace back to user downloads of unauthor. emails, photos, music, games, apps, programs, and vids to wrkst, net/storage devices
        
        Destruction of systems, applications, or data -- Accidental or deliberate destruction or sabotage of systems, application, and data pose a great risk to all orgs.
        Activists, disgruntled employees and industry competitors can delete data, destroy devices or misconfig devices to make data and indo sys unavailable
      - No tech solution, controls or countermeasures make info systems any more secure than the behaviors and processes of the people who use these systems.
    - - Org can implement various measures to manage user threats by:
        
        Disable internal CD drives and USB ports
        
        Enable automatic antivirus scans for inserted media drives, files, and email attachments
        
        Use content filtering to accept or reject specific domain names in accordance with Acceptable Use Policies (AUP)
        
        Restrict access for users to only those systems, applications, and data needed to performance, and use of IT infrastructure during off-hours
        
        Enable content filtering and antivirus scanning for email attachments
        
        Minimize write/delete perms to the data owner only
        
        Tying security awareness to performance review objectives
        
        Track and monitor abnormal employee behavior, erratic job performance, and use of IT infrastructure during off-hours
        
        Educating users annually on policies, staff manuals, and handbook updates
        
        Implement access control lockout procedures based on AUP monitoring and compliance
        
        Sec awareness training by putting up awareness posters, inserting reminders in banner greetings, and sending email reminders to employees
        
        Enable IDS/IPS monitoring for sensitive employee positions and access.
  - - - Unpatched software -- software sec vulnerabilities provide weaknesses that cyber criminals can exploit
        
        Update and apply security patches according to defined policies, standards, procedures, and guidelines
      - Malware -- new viruses, worms and other malic code come to light on a daily basis
        
        Enable automated antivirus solution to scan systems and update antivirus software
      - User downloads -- downloaded files, photos, music, or videos can be a vehicle for malic-code
        
        Establish Access control policies, standards, procedures and guidelines
      - Unauthorized Media -- Users that insert USB drives, Cd's, or DVD's can either introduce malware or run the risk of compromising data stored on the wrkst
        
        Disable Internal CD drives and USB ports
      - Unattended Workstations -- wrkst left powered on and unattended pose a risk of untheorized access to network resources
        
        Establish user account policies for passwords and threshold lockouts
      - Acceptable Use Policy Violation -- Policies are in place to protect the Org's IT infrastructure
        
        Use content filtering
        
        Disbale Internal CD drives and USB ports
        
        Use antivirus scanning for downloaded files
    - - Update and patch all operating systems and software applications.
      - Implement automated antivirus solutions that scan the system and update the antivirus software to provide proper protection.
      - Define access control policies, standards, procedures, and guidelines.
      - Deactivate all CD, DVD, and USB ports.
      - Disable administrative rights for users.
      - Enable automatic antivirus scans for any CD’s, DVD’s, or USB drives inserted.
      - Enable screen lockout during times of inactivity.
      - Use content filtering.
      - Establish password protections and lockout policies on all devices
      - Mandate annual security awareness training or implement security awareness campaigns and programs that run throughout the year.
  - - - Unauthorized access by rogue users on wireless networks
      - Exploits of data in-transit
      - Network OS updates
      - LAN servers with different hardware or OSs – managing and troubleshooting servers becomes more difficult with varied configs
      - Network OS software vulnerabilities
      - Unauthorized network probing and port scanning
      - Unauthorized access to systems, applications, and data
      - Misconfiged firewall
      - Unauthorized LAN access – wiring closets, data centers, and computer room must remain protected
    - - Require passphrases or authentication for wireless networks.
      - Implement encryption between devices and wireless networks to maintain confidentiality.
      - Restrict access privileges for specific folders and files based on need.
      - Implement LAN server configuration standards.
      - Define strict access control policies, standards, procedures, and guidelines.
      - Conduct post-configuration penetration tests.
      - Secure wiring closets, data centers, and computer rooms. Deny access to anyone without the proper creds.
      - Disable ping and port scanning.
  - - - Unauthorized access to resources
      - Router, firewall, or network device operating system software vulnerability
      - Router, firewall, or network device configuration error
      - Remote users accessing the organization’s infrastructure and downloading sensitive data
      - Unauthorized network probing and port scanning
    - - Update devices with security fixes and patches.
      - Conduct penetration tests post configuration.
      - Monitor inbound IP traffic anomalies.
      - Test inbound and outbound traffic.
      - Implement intrusion detection and prevention systems.
      - Implement a data classification standard.
      - Disable ping, probing, and port scanning.
      - Implement file transfer monitoring and scanning for unknown file type.
- - - - ways computers are involved in cybercrime
        
        Computer-incidental crime
        
        ex. CP on computer, the pc was not used to commit a crime, but used to store criminal photos
        
        Computer-targeted crime
        
        Computer-assisted crime
      - Organizations Created to Fight Cybercrime
        
        SIIA
        
        National White Collar Crime Center (NW3C)
        
        InfraGard
        
        Bureau of Justice Assistance U.S. Department of Justice (BJA)
        
        FBI Internet Crime Complaint Center (IC3)
    - - three primary sources of laws and regulations
        
        administrative law
        
        common law
        
        statutory law
      - Criminal laws enforce a commonly accepted moral code backed by the authority of the government.
      - The Federal Information Security Management Act (FISMA)
        
        applies to federal agencies’ IT systems and stipulates that agencies create an information security program that includes the following
        
        Security awareness training
        
        Testing and evaluation of all IT system controls
        
        Policies and procedures to reduce risk
        
        Incident response procedure
        
        Annual inventory of IT systems
        
        Continuity of operations plan
        
        Risk assessments
    - - translating legal requirements in security policies and procedures
        
        Gramm-Leach-Bliley Act (GLBA)
        
        provides for opt-out methods so that individuals can control the use of info provided in a business transaction
        
        a potion includes privacy provisions for individuals
        
        restricts information sharing with third-party firms
        
        mainly affects the financial industry
        
        Sarbanes-Oxley Act (SOX)
        
        Passed after several high-profile corporate accounting scandals
        
        overhauls financial / corporate accounting standards and specifically targeted the standards of publicly traded firms in the U.S.
        
        Payment Card Industry Data Security Standard (PCI DSS)
        
        a set of contractual rules governing how to protect credit card data
        
        a voluntary standard (in theory)
        
        vendor noncompliance may result in significantly higher transaction fees, fines up to $500,000, and possibly even the loss of the ability to process credit cards
        
        Import/Export Encryption Restrictions
        
        Countries may decide to restrict the import of cryptography technologies for the following reasons
        
        Citizens can anonymously communicate and avoid any monitoring
        
        Cryptography may increase levels of privacy above an acceptable level
        
        The tech may contain a backdoor or security vulnerability.
    - - Big Data can get hacked and leak a bunch of personal data, and here are laws
        
        Electronic Communications Privacy Act (ECPA)
        
        addresses legal privacy issues including email, cellular comms, workplace privacy, and a host of other issues related to communicating electronically
        
        Computer Fraud and Abuse Act (1986)
        
        provides the foundation for U.S. laws criminalizing unauthorized access to computer systems
        
        makes it illegal to knowingly access a computer considered either a government computer or a computer used in interstate commerce, without permission.
        
        criminalizes the use of a computer in a crime that is interstate in nature.
        
        Act criminalizes trafficking in passwords or similar access information
    - - Privacy Act of 1974
        
        establishes a Code of Fair Information Practice that governs the collection, maintenance, use, and dissemination of personally identifiable information
        
        maintained in systems of records by federal agencies.
      - Freedom of Information ACT (FOIA)
        
        enables public access to U.S. government records
        
        There are nine disclosure exemptions pertaining to FOIA
        
        Confidential business information
        
        Inter- or intra-agency communication subject to deliberative process, litigation, and other privileges
        
        Information specifically exempted by statute
        
        Information that, if disclosed, would constitute a clearly unwarranted invasion of personal privacy
        
        Internal personnel rules and practices of an agency
        
        Law enforcement records that implicate one of a set of enumerated concerns
        
        National security and foreign policy information
        
        Agency information from financial institutions
        
        Geological and geophysical information concerning wells
      - Family Education Records and Privacy Act (FERPA)
        
        gave students access to their education records
        
        operates on an opt-in basis, as the student must approve the disclosure of information prior to the actual disclosure
      - U.S. Computer Fraud and Abuse Act (CFAA)
        
        amendment to the Comprehensive Crime Control Act of 1984
        
        CFAA increased the scope of the previous Act to cases of great federal interest
        
        prohibits the unauthorized access of a computer
      - U.S. Children’s Online Privacy Protection Act (COPPA)
        
        applies to the online collection of personal information by persons or entities under U.S. jurisdiction from children under 13 years of age
        
        Before information can be collected and used from children, parental permission needs to be obtained.
      - U.S. Children’s Internet Protection Act (CIPA)
        
        The U.S. Congress passed CIPA in 2000 to protect children under the age of 17 from exposure to offensive Internet content and obscene material.
      - Video Privacy Protection Act (VPPA)
        
        protects an individual from having the video tapes, DVD’s and games rented disclosed to another party.
        
        provides the protections by default, thus requiring a video rental company to obtain the renter’s consent to opt out of the protections
      - Health Insurance Portability & Accountability Act (HIPAA)
        
        mandate safeguards for physical storage, maintenance, transmission, and access to individuals’ health information
        
        mandates that orgs that use electronic signatures have to meet standards ensuring information integrity, signer authentication, and nonrepudiation.
      - California Senate Bill 1386 (SB 1386)
        
        California was the first state to pass a law regarding the notification of the unauthorized disclosure of personally identifiable information
        
        Each disclosure notice laws is different, making the case for a unifying federal statute compelling
        
        requires agencies provide consumers notice of their rights and responsibilities
        
        mandates that the state notify citizens whenever PII is lost or disclosed.
      - Privacy Policies
        
        the best way to ensure compliance across an organization
      - Privacy Impact Assessment (PIA)
        
        A privacy impact assessment ensures that personally identifiable information (PII) is properly handled throughout an org
        
        Identify key stakeholders.
        
        Document all contact with PII.
        
        Establish PIA scope.
        
        Review legal and regulatory requirements.
        
        Document potential issues found when comparing requirements and practices.
        
        Review findings with key stakeholders.
    - - Convention on Cybercrime
        
        the first international treaty on Internet crimes (EU, U.S., Canada, Japan, and others).
        
        handles cybercrime and address the following: copyright infringement, computer-related fraud, child pornography, and violations of network security.
      - Electronic Privacy Information Center (EPIC)
        
        promotes privacy and open government laws and policies globally
        
        focuses on EU-US relations
  - - - a U.S. government repository of standards-based vulnerability management data
      - uses the Security Content Automation Protocol (SCAP)
        
        SCAP is a method for using specific standards to automate vulnerability management, measurement, and policy compliance evaluation
        
        uses open standards to enumerate security software flaws and configuration issues
        
        community is a partnership between the private and public sector to advance the standardization
      - uses the Common Vulnerability Scoring System to assess the impact of vulnerabilities
      - also contains a number of checklists that provide guidance on configuring operating systems and applications to provide a hardened environment.
    - - the Software Engineering Institute (SEI) helps government and industry organizations to develop, operate, and maintain software systems that are innovative, affordable, and trustworthy
      - Federally Funded R&D Center sponsored by the U.S. Department of Defense.
      - CERT Division of SEI studies and solves problems in the cybersecurity arena including security vulnerabilities in software products, changes in networked systems, and training to help improve cybersecurity.
        
        Develops tools, products, and methods to analyze vulnerabilities
        
        Develops tools, products, and methods to monitor large networks
        
        Develops tools, products, and methods to conduct forensic examinations
        
        Helps organizations determine how effective their security-related practices are
        
        Helps to resolve software vulnerabilities
    - - non-profit organization that brings together industry, academia, and government to address advanced cyber threats.
      - shares information on cyber threats, engages in cybersecurity research and development, and creates education programs to promote the cybersecurity profession.
      - four challenges to shape priorities defined by ACSC
        
        Enhance mobile security.
        
        Develop real-time threat sharing.
        
        Build resilient systems to recover from attacks and failures.
        
        Integrate cyber risks with enterprise risk frameworks.
    - - identifies sites used for attacks and provides data on the types of attacks launched
      - gathers millions of log entries from intrusion detection systems every day using sensors covering 500,000 IP addresses in over 50 countries.
      - provides a free analysis and warning service to Internet users and organizations.
      - also works with Internet Service Providers to combat malicious cyber criminals
      - resources offered
        
        An InfoSec Diary Blog Archive
        
        Podcasts which include the Daily Stormcasts, daily 5-10 minute information security threat updates
        
        InfoSec Job Postings
        
        Information Security News
        
        InfoSec Tools
        
        InfoSec Reports
        
        SANS ISC InfoSec Forums
  - - - Utilitarian Ethics
        
        created by Jeremy Benthan and John Stuart Mill in the 19th century
        
        Any action that provides the greatest amount of good over bad/evil are ethical choices
      - The Rights Approach
        
        individuals have the right to make their own choices
        
        judged upon how the action affects the rights of others
        
        rights include Truth, Privacy, Safety.
        Ideally society applies its laws fairly
      - The Common Good
        
        the common good is whatever benefits the community
        
        cybersecurity specialist looks at how an action affects the common good of society or the community
    - - a resource for identifying, assessing, and responding to ethical issues throughout the information technology industry.
      - Ten Commandments of Computer Ethics
        
        Thou Shalt Not Use A Computer To Steal
        
        Thou Shalt Not Use A Computer To Bear Falso Witness
        
        Thou Shalt Not Copy or Use Proprietary Software For Which You Have Not Paid
        
        Thou Shalt Not Snoop Around In Other People's Computer Files
        
        Thou Shalt Not Use Other People's Computer Resources Without Authorization or Proper Compensation
        
        Thou Shalt Not Interfere With Other People's Computer Work
        
        Thou Shalt Not Appropriate Other People's Intellectual Output
        
        Thou Shalt Not Use A Computer To Harm Other People
        
        Thou Shalt Think About The Social Consequences of The Program You Are Writing or The System You Are Designing
        
        Thou Shalt Always Use A Computer In Ways The Ensure Consideration And Respect For You Fellow Humans
  - - - a method of testing the areas of weaknesses in systems by using various malicious techniques
      - involves a cybersecurity specialist that hacks a website, network, or server with the organization’s permission
      - differentiation between cyber criminals and cybersecurity specialists is cybersecurity specialists have the permission of the org
      - also known as ethical hacking
    - - intercept and log network traffic
      - captures wired or wireless traffic
      - performs these functions
        
        Networks and problems analysis
        
        Detection of networks intrusion attempts
        
        Isolation of exploited systems
        
        Traffic logging
        
        Detection of network misuse
    - - assesses computers, computer systems, networks, or applications for weaknesses
      - help to automate security auditing producing a prioritized list to address weaknesses
      - looks for the following types of vulnerabilities
        
        Open ports
        
        Misconfiguration of operating systems and software
        
        Missing patches
        
        Active IP addresses
        
        Use of default passwords or common passwords
        
        When evaluating a vulnerability scanner look for
        
        reliability
        
        scalability
        
        accuracy
        
        reporting
        
        two types of vulnerability scanners
        
        software-based
        
        cloud-based
      - Vulnerability scanning is critical for large organizations
    - - Kali
        
        an open-source Linux security distribution
        
        used to test the security of their networks
        
        incorporates more than 300 penetration testing and security auditing programs
      - Network Situational Awareness
        
        org needs the ability to monitor networks, analyze the resulting data, and detect malicious activity
- - - - Site/physical security manager and facilities contacts
      - HR contact for HR matters such as disciplinary action and training
      - Security administrators
      - Systems and network managers, security architects and other IT professionals
      - Information security professionals
      - A senior manager responsible for IT and ISM (often the audit sponsor)
    - - Builders are the real techies who create and install security solutions
      - Monitors administer the security tools, perform the security monitoring function, and improve the processes
      - Definers provide policies, guidelines, and standards and include consultants who do risk assessment and develop the product and technical architectures