Please enable JavaScript.

Coggle requires JavaScript to display documents.

Block 1 Part 1 A cyber security vocabulary - Coggle Diagram

- - - - A transcript of an email apparently sent by Google to John Podesta chair of Hillary Clinton’s Presidential Campaign team.Subject: Sоmeоne has your passwоrd Hi John. Someone, just used your password to try to sign in to your Google Account john.podesta@gmail.com.
        Details:
        Saturday, 19 March, 8:34:30 UTC.IP Address: 134.249.139.239. Location: Ukraine. Google stopped this sign-in attempt. You should change your password immediately.
        CHANGE PASSWORD
        Best, The Gmail Team.
        
        John Podesta was the chair of Senator Hillary Clinton’s 2016 presidential campaign at the Democratic National Committee (DNC). Podesta received an email, apparently from Google, telling him to change his Gmail password. This message was spotted by his chief-of-staff, Sara Latham, who was somewhat suspicious of the message, thinking it might be an attempt to break into Podesta’s Google account.
        
        Fig 1.2
        
        Figure 1.2 Email from Charles Delavan, Clinton’s campaign help desk manager to Sara Latham, chief of staff
        
        Latham forwarded the message to a Clinton campaign IT worker, Charles Delavan, who recognised it as an attempt to steal Podesta’s personal information. Delavan’s reply (Oremus, 2016) was meant to be a warning giving guidance how to secure Podesta’s account, but he made a simple mistake of writing ‘legitimate’ rather than ‘not a legitimate’. Not spotting his error, Delavan sent the reply to Podesta’s team who followed the CHANGE PASSWORD link in the original email.
        
        The original email was fake.It had not come from Google.It had been sent with the purpose of breaking into the DNC.It succeeded.
        
        1 more item...
- - - - KU2 Demonstrate techniques and processes involved in assessment of security infrastructure and related hardware and software controls.
      - KU1 Be aware of the principles, methods and tools relevant to the technical and human factors of cyber security.
      - KU3 Demonstrate an understanding of the theory and practice of systems security that includes identifying associated threats, controls and policies.
    - - CS1 Recognise threats, vulnerabilities and attack methods, and propose appropriate mitigation and security controls towards the design and implementation of secure systems and infrastructure.
    - - KS1 Communicate and analyse problems effectively within a computing environment using appropriate personal and technical skills.
        
        KS2 Formulate arguments and make informed decisions in choosing appropriate techniques in solving a range of technological problems.
    - - PS1 Demonstrate the ability to undertake ongoing learning to keep up to date with cyber security developments within digital systems.
- - - - During the next four weeks you will build a vocabulary of cyber security language that will allow you to understand and describe this rapidly developing field. By the end of this block, you should be able to understand and use all the terms in the following paragraph:
        
        The DNC attack represents a major breach of confidentiality with massive political and reputational consequences. The attackers initially exploited a vulnerability in the DNC’s poor understanding of the human factors of security; but the hacking group remained within the DNC computers for many months, compromising individual machines and exfiltrating confidential information as a textbook example of an advanced persistent threat.
        
        Some of those terms may be familiar; many will be new – but by the end of this block you will be able to use terms such as ‘breach’, ‘confidentiality’ and ‘vulnerability’ with assurance. So, let’s get started with two words that are going to be used on a frequent basis and that can be found in almost all media stories about cyber security: incident and breach. The two terms are often used on an interchangeable basis; however, to cyber security professionals they have specific and different meanings:
        
        An incident is a security event that potentially compromises an individual or organisation. For example, ‘incident’ should be used where there is a possibility that data has been stolen, altered or deleted – but this cannot be confirmed; or where data has been left exposed to such risks.
        
        Incident A security event resulting in the potential disclosure of an asset.
        
        A breach is a type of incident resulting in the confirmed compromise of an individual or organisation.
        
        Breach A security event resulting in the confirmed compromise of an asset.
        
        In the context of the attack on the DNC – while this could be described as an incident, events should be described as a breach since confidential emails were stolen from the organisation causing serious damage.
        
        Activity 1.1 Introducing the learning journal
        
        Part 1. We strongly recommend that you take the time to make notes as you study the module materials. You should use notes to summarise in your own words what you have just learned; to make observations and record ideas that occur to you while reading or completing activities; and to put down questions that need answering at a later date.
        
        2 more items...
  - - - The Cyber Security Body Of Knowledge (CyBOK) is an attempt to address the problem of conflicting information. CyBOK is a free resource hosted by the University of Bristol, developed in cooperation with universities, technology companies and UK Government agencies, that aims to become the definitive UK reference library for cyber security knowledge. CyBOK is built around 19 top-level knowledge areas (KAs), many of which will appear in TM256 and later modules. Each KA is built around a downloadable document authored by recognised international experts.
        
        All CyBOK resources can be downloaded for free. You may find it useful to download individual KAs when working on module activities, especially if you are regularly studying while on the move.
        
        Activity 1.2 A first look at CyBOK
        
        This activity has two parts.
        
        This activity will give you an opportunity to explore the CyBOK website and see some of the material it contains. Make sure you bookmark this website (add it to your browser’s list of favourite sites) as you will be coming back to it on a regular basis!
        
        Part 1 – The Knowledgebase
        Timing:Allow approximately 5 minutes to complete this part of the activity
        
        1 more item...
        
        Part 2 – The Introduction to CyBOK knowledge area
        Timing:Allow approximately 15 minutes to complete this part of the activity
        
        Locate the document Introduction to CyBOK (Martin et al., 2019) in the Knowledgebase. Click the download icon to open the document in your web browser. Alternatively, if you right-click the download icon you can choose to copy the document to your device; it can then be opened in any application capable of reading PDF documents.
        
        Read the introductory text up to Section 1 ‘Cyber Security Definition’. This should only take a few minutes but will give you a good overview of the purpose and scope of the CyBOK project.
        
        1 more item...
  - - - Confidentiality: The property that information is only made available or disclosed to authorised individuals, entities or processes
      - Integrity: The property of safeguarding the accuracy and completeness of assets against unauthorised access or modification
      - Availability: The property of being accessible and usable on demand by an authorised entity.
- - - - Identity A unique characteristic of an entity that distinguishes it to a system.
        
        Authentication links an identity to an entity. Everyday life might give the impression that an identity is synonymous with a name; after all, we talk about identity documents such as ID cards, passports and driving licences. However, there are many everyday examples of identity that do not use names – for example, banks use unique account numbers as a form of identity to distinguish individual customers rather than names or addresses, which may not be unique. Therefore, we can say that anything can act as an identifier so long as it is unique to that entity. Crucially, an identity need not be directly associated with a person; instead, identities can be assigned to any entity including applications or even individual transactions within a system.
      - Email addresses are perhaps the most commonly used form of computer identity; they are familiar, they are relatively simple to remember and you can reuse them on many different systems (just think how many online services use your email address for authentication).
      - Some downsides of using an email address as an identity include:
        
        a user losing access to that identity if they lose access to that email address (such as by changing job or their email provider closing down) reusing an identity across several systems potentially makes that identity vulnerable in multiple systems losing control of the identity if an attacker compromises the email account email addresses are effectively public, making that identity public also.
        
        Other types of identity include your passport or identity card number, your OU student ID and the name you use to log on to your computer. A comprehensive set of identity types has been published by the US Government’s National Institute of Standards and Technology (NIST) (NIST, 2017).
        
        Who or what is NIST?
        
        The NIST is responsible for standardising weights and measures in the US and approving quality standards for manufactured goods. Directly relevant to this module, NIST publishes cyber security standards and guidelines in topics such as authentication and encryption. Such is the high regard in which NIST is held and the central role of the US in technology developments, that many NIST guidelines are implemented outside of the US.You will encounter several NIST publications in this module – although you won’t be expected to read them all – they are VERY long!
      - 4.1.1 The three – or is it five? – factors of authentication
        
        Whenever you use a computer system, it is not enough for you to claim an identity, you must prove that identity using a further piece of information called a factor. When you log on to your computer you claim an identity with a user ID; you prove it using a factor such as a password or fingerprint.
        
        Cyber security specialists agree on three distinct factors of authentication:
        
        The knowledge factor (sometimes described as ‘something you know’).
        
        This is something that can be recalled from your memory – the PIN associated with a bank card is an example, as are computer passwords.‘Something you know’ is limited by the fallibility of human memory. While security increases with the length of the factor, humans struggle to precisely recall long sequences of letters and numbers. The result is a situation where people choose to:use easily guessed ‘meaningful’ passwords – such as pet names or birthdays.use short passwords that can be easily cracked. write down passwords, making them vulnerable to theft.
        
        These issues can be partially resolved using a password manager (see study note below).
        
        1 more item...
        
        2.The possession factor (sometimes described as ‘something you have’).
        These factors consist of physical objects including physical keys, smart cards and plug-in USB security keys holding digital certificates, and token devices capable of generating time-based PINs. The obvious weakness of this factor is ensuring the physical safety of the factor against loss, theft or duplication.
        
        3.The biometric factor (sometimes described as ‘something you are’).
        
        1 more item...
        
        4.1.2 Single-Factor Authentication versus Multi-Factor Authentication
        
        Authentication performed using only one factor is described as Single-Factor Authentication (SFA). Almost all personal computers use SFA for day-to-day login: either a password or a biometric factor.
        
        By contrast, Multi-Factor Authentication (MFA) requires more than one form of authentication. MFA is considered more secure simply because it is generally less easy for an attacker to obtain two authentication factors than just one. Most systems implementing MFA choose different types of factor – many online services use a password (‘something you know’) and a PIN delivered by SMS to a mobile phone (‘something you own’).
        
        Although there is no limit on the number of factors that can be used, it is rare for MFA to use more than two. Systems using two authentication factors can either be described as MFA or as using Two-Factor Authentication (2FA).
        
        Study note – Two-form authentication
        Some online services require users to enter their password and answer a challenge question (e.g., ‘What is your mother’s maiden name?’). While this appears superficially similar to 2FA, Two-form authentication only requires you to authenticate using ‘something you know’ – albeit twice.
        
        Multi-step authentication
        
        The designers of MFA systems have a choice on how factors are evaluated. They can either:
        
        request all of the factors at once, then evaluate them together, or
        
        request one factor, perform an evaluation and then, if it is successful, request any remaining factors, evaluating each in turn.
        
        This second approach is known as multi-step authentication. While it has the same objective as the first approach, it has a significant weakness.
        
        Example – Why multi-step authentication is a bad idea
        
        1 more item...
        
        4.1.3 Out-Of-Band Authentication.
        
        Any authentication process requires the exchange of a supposedly confidential factor. Obviously, the factor is valuable and must be protected from attack using encryption technologies. Security can be improved even further by using two communication ‘channels’. These are:
        
        a secondary channel used to pass an authentication factor.
        
        the original primary channel used to establish identity
        
        The process is known as Out-Of-Band Authentication (OOBA). OOBA improves security by requiring an attacker to compromise both channels before they can obtain the identity and authentication factors.
        
        Examples of OOBA include:
        
        2 more items...
  - - - While authorisation is most commonly discussed in regard to human users, any form of entity should be authorised before accessing a system. It is quite possible for applications and computer processes to perform unauthorised actions through programming errors or misconfiguration; therefore, any authorisation process must guard against accidental as well as deliberate access.
        
        SAQ 1.3 What about accidental authorisations?
        
        What if a programming error accidentally grants a user permission to see data that they should not be able to view? An example might be an online banking site disclosing account details for the wrong customer – it has happened (Read, 2018). Has the user been authorised to see the other account because the computer has shown them the information?
        
        Authorisation is a security control
        
        Authorising permitted identities and rejecting those who should not have access is an example of a security control. For now, you can treat security controls as the protections used to secure a computer system. Security controls will be explored in greater detail in Block 1 Part 4.
        Some differing app
        
        Security controlAny safeguard or countermeasure used to protect the confidentiality, integrity or availability of data or infrastructure against risk.
        
        1 more item...
  - - - A well-designed system using rigorous authentication and authorisation should ensure computer resources and data are only ever accessed by entities for appropriate purposes. However, access may be inadvertently granted through configuration mistakes or software errors, a system may be attacked by hackers, or employees may abuse their privileges to access information without reasonable cause – as illustrated in this quote by King (2008):
        
        Bourke and Wessley’s article on confidentiality was comprehensive in many respects but omitted a serious point, namely that medical staff only have the right to access medical records when they are directly involved in the patient’s case.
        
        ‘This was dramatically illustrated in the trust where I work when Richard Hammond, a well-known television personality, was admitted to Leeds General Infirmary after suffering a serious head injury during filming for his television show. It was estimated that around 300 medical staff accessed his medical records via the internal computer system in the 24 hours following his crash rather than the 20 or so, which would be expected for a patient in intensive care. Disciplinary action ensued for a minority and employees of the trust are now routinely reminded that they must only access medical records when this is strictly necessary.’
        (King, 2008)
        
        Patient records are among the most sensitive of all types of data, but some 280 people, who had no reason to do so, accessed Hammond’s records: a gross invasion of his privacy even if the information had not then been passed to the media without his permission. In this case, it is clear that access had been granted to people who were not involved in Hammond’s care. It is of little comfort that these improper accesses were recorded and noticed by the hospital’s accounting system.
        
        Accounting aims to record every authentication (whether successful or not) and authorisation (or rejection) by identifying which system resources were accessed, at what time, by what entity and for what purpose. Accounting is highly automated, either using tools built into a computer’s operating system or specialised Security Information and Event Managing (SIEM) software. Accounting data is stored in dedicated log files.
        
        LOG A record (such as a file or database) of events within a system (e.g. log-in attempts, network connections, reboots and crashes).
        
        Study note – Other uses for accounting
        
        1 more item...
  - - - There is another ‘A’ that you may encounter when discussing cyber security, namely auditing (also known as ‘security auditing’ or ‘IT auditing’). You may be familiar with the financial auditing of individuals or businesses where their finances are scrutinised to ensure that assets, profits, losses and taxes are correctly reported to shareholders and authorities. In the context of cyber security, an audit is a systematic evaluation of an organisation’s security systems.
        
        The key purposes of an audit are as follows:
        
        Identify vulnerabilities, threats and risks to an organisation: These topics will be introduced during the remainder of Block 1.
        
        Verify that an existing security strategy meets the organisation’s requirements: These requirements may be self-imposed, or they may be stipulated in contracts, industry-specific guidelines and frameworks, and national and international standards, or laid down by law.
        
        Ensure employee compliance with security policies: Employees may be deliberately or inadvertently breaching policies and threatening the organisation’s security. These breaches must be identified and ended. The issue of threats coming from within an organisation will be discussed in Block 1 Part 4.
        
        Identify unnecessary software and hardware: Removing unnecessary hardware and software reduces security risks associated with unmaintained or inadequately monitored equipment. A side benefit is that it reduces costs.
        
        1 more item...