Cybersecurity To Everyone
What is cyber and security means?
⭐Cyber: Technology( hardware/softeware), Human (Technologise, executives, Public Officials and Hackers) and Organisation (Private/ Public)
Cybernetic: communication and control, in machine or animal
Security: freedom from dangerous
⭐How to achieve security?
Individual (Technology Antivirus/ Architecture Network Design)
Corporation (Technology IDS, SIEM, Architecture, Risk Management and Insurance)
Nation (Technology, Risk Management, Intelligence Asset, Hard Power Weapon)
⭐**Cybersecurity = organasation and collection of resources, processes and structures used to protect cyberspace and cyber-enabled system
Evaluation and development of Internet
Global Telecommunication environment
How Internet governed?
Who are hacker and what motivation
what is hacking (It is a process which involve effort)
effects they can achieve
Key concepts
Evolutionery (beginning)
Multiplayer and skateholder
Government support (EVOLUTION)
private sectors (INVENT OTHER NEW TECHNOLOGY)
Academic inspiration
Vision in the future: large volume of data can transmitted by computer; breaking data called packets and move around; prototype network connect to telephone line; create model; need capital (no money)?; place to create model
A group of researcher (academic aspiration), fundamental required, how to create model?, where to get resources?--Lawrance move to DARPA(government)-->DARPA funds ARPANET with UCLA, Standford..-->Project prove that packet can move from different area
Internetwork: computer can communicate through the independent network; ARPANET starts packet switching (proven), Protocol invented: Network Protocol & Transmission Control Protocol to send packets
Rules of Internetwork: Network independent, Packets transmitted allow communication, if not accept then retransmit; black boxes allow network connection, no global control (not own by government and private)
Origin: only handful network exist, only a few networks can connect, only create 256 networks
Surprise :D a few devices can connect to network, File transfer Protocol invented, invent Telnet (LOGIN PURPOSE), mail invented (send msg)
Challenge will be faced: how internetwork can evolve and apply with other new technoligy? (Government fund and develop bench scale prototype)
Ethernet invented (wired computer networking allow to combine using other tech. ta the same time.
Network technology (standardtised) developed; move to business en; DNS and routers created; can translate computer language to human readable language (8.8.8.8 --Google)
Community ownership: Public availability documents of specifying protocol (public use)-->more growth and adoption of new tech.-->growth in quantity-->move out from lab (will accelerate adoption) *Internet is not owned by anyone
Further action
By Government
by private sector
ARPANET is the heart of internetworking (central connective tissue), means not independent network. IP and TCP created before, now Internet generated (to achieve independent network connection).
Scale the internet: Privatise to private sector-->build high speed for research , use and seek for customers devices-->large Investment and lead to Internet Boom
National Centre of Supercomputing Application invent Mosaic web browser
Government continue support: Super Computer Study Act 1986--$600 million for privatising
world wide web invented in 1980,90s, one of the ways to access to the internet-->first browser: Mosaic by CERN --> 1990 competitive relationship between Nestscape and Microsoft
2000s: web 2.0 (blogs, wiki can edit or create content through the Internet) 1990: www(static pages, coundn't edit any things)
Trend 1: Cloud Computing
Trend 2: Mobile Computing
Trend 3: The 2010s Network Society --Growing connectivity (wifi, router); Social Connection (Facebook/blog..); Supporting utilities and sensor (Cloud computing and IOT)
The 2020s Internet and Society AI machine learning, smart infra. etc.
Encapsulation data packaged, routed and transmitted
Data encapsulated through 7 layers--OSI MODEL (stacks) physical (bits)-->data link (frame)--> Network (packats)-->Transport (TCP/UDP)--> session-->presentation-->application (DATA) (unpacked, when people receive it)
Different layer with weakness, threat actors might attack through the layers and steal the information..
how do we know the final destination to send/search?
Application Layer: PC will connect to DNS to find out the routes (IP address) [PC--> Local DNS (domain)--> root DNS (find .com/.edu)-->Local DNS to confirm-->Top-level DNS (google.com)-->local DNS-->Autoratative DNS (IP address)-->Local DNS --> PC
Challenge: if software developer/ administrator didnt design and leave weakness, attacker can attack./ vulnerabilities could exist in these protocol/attacker use the vulnerrabilities to attack
How do we know which routes to reach to IP address?
Autonomous System will be applied--apply peering relationships, broadcast list of independent network ( to communicate and see which routes is suitable) , forward packets to the network and send and reach to the IP address
NetWork layer : IP assemble data from layer above (transport layer/session..) into a packet with adress header and act , link to envelope to send to destination
how do data move?
Electronmagnetic spectrum applied, data encoded can move from different points
Fibro Optic, data move for long distance; Microwave, data can move from point-to-point (near distance); Satallite, data move from radio wave
IXP (Internet Exchange Point) allows 3 mediums connect together with logical peering relationship (network connect)
Governance: process of managing the complicated techonological, informational and organisational problem that arise , invlove multiple skateholders
Autonomous system: Collection of IP under control of network
Reconnaissance planning phase (find vulnerability)
organised by individual. organisations, being trained or execute based on motivation effort to gain reputation
reasons: Curiousity, Reputation, Financial, Political Activitism, national security, terrorism
Resources to attack: skill level, tools used, processes and techniques and financial resources
Target group: Bank, retail, transportation, government, energy,
The example of attackers:
Hobbyist
low skills, light resourced, use off the shelf現成 tools, engage activities that can increase their reputation
motives: curiousity (where the vulnerability lie), easily cross the line and violate integrity of data拉響警報器，might impact access to device
tools: kali linux (reconnaissance, delivery and exploitation)
ways to attack: defacement(destroy) website, guessing password, SQL injection, denail (deny) of service, google hacking
Criminal organisation
low to high skills, high resourced, use off the shelf tool/ capable create own tools, join event that earns return, might connect to government or security organisation
motives: financial gain, use of various tool to involve online fraud, extortion勒索，theft, espionage (spy) purpose
tools: kali linux (custom reconnaissance, tactic and delivery and exploitation)
ways to attack: ransomware (encrypt data and demand money), denail service (not allow to use for some application unless pay), SQL injection (control web to display data from data store), guessing password, access Point of Sales (POS) to steal credit card number
examples of organisations: wolf spider, skeleton spider, FIN7,GozNym,
Technical: find public IP, enter domain; non tech.: social (who targetted? possition? hobby? email?); organisation: what unit do? The leader?
find out and target: Location, services, vulnerability; people: employee, email, social media
Weaponisation
Threat actors write exploit , take advantage of vulnerability; Exploit paired to target machine or person
Delivering
focus on the exploit to the target and execute the exploit
methods: Spear phishing (attachment and link), Supply chain (partner company link on business), removable media (USB, Pendrive), website
Exploitation
Direct interact: open link/docs to execute the code-- back to threat actors' infrastructure
system (web browser): open succuessfully, connect to threat actors infra.-->threat actor can directly interact with user system.
Installation
install malware (help to facillate additional moves)
ensure maintain gaining access: hooking挂鈎 into existing process; create admin account to access; modify DLL file so that malware can load in system
Command and Control
protect communication between malware with encryption, . off-shelf tool
Hide/blend in to environment with port (looks normal) and by web service to relay接 command
disguise original communication (redirect to proxy, establish proxy (routers, etc. ) and custom configuration結構（compromised program))
Attribution can be difficult for victims of cyber attack primarily due to The interplay between proxies, encryption, and threat actors hiding in plain network traffic