Who manages information security?

Threats to information security come in many forms including natural disasters,

Lesson Proper for Week 1 server malfunction, physical theft and unpatched endpoints.

What is Information Security? While paper-based businesses still exist, the ever-increasing reliance on
information systems has cause information security to become a key
Information security or infosec is concerned with protecting information from consideration in cybersecurity risk management and raise a need for dedicated
unauthorized access. It's part of information risk management and involves IT security specialists.
preventing or reducing the probability of unauthorized access, use, disclosure,
disruption, deletion, corruption, modification, inspect, or recording. These information technology security professionals are concerned with data
security, application security, network security, computer security, physical
If a security incident does occur, information security professionals are involved security and data loss prevention.
with reducing the negative impact of the incident. Note information can be
electronic or physical, tangible or intangible. Understand that data, applications, and computers are spreading far beyond
what is traditionally thought of as a computer. Smartphones, tablets and other
While the primary focus of any information security program is protecting the mobile devices are as much of a computer as a server or mainframe and are
confidentiality, integrity and availability (the CIA triad) of information, maintaining susceptible to malicious cyber attacks that can facilitate access to sensitive
organizational productivity is often an important consideration information, critical information, or information assets.

This has led the information security industry to specific best-practice standards This, paired with the increasing amount of data breaches, has led for increased
in the following areas: demand for sophisticated data protection planning and growing demand
for cybersecurity professionals (especially in healthcare) to understand
 Information security policies, information security.
 Password strength A growing number of information security certifications are available and
 Access controls employers often prefer employees with certification that validates knowledge of
 Multi-factor authentication best practices.

 Antivirus software, firewalls There are broad certifications like the Certified Information Systems Security
 Cryptography Professional (CISSP), and specific ones that cover information assurance,
 Legal liability
network security, security testing, business auditing, business continuity
planning, security testing, incident response planning, identity theft, risk
 Security awareness assessments, intrusion detection systems, security breaches, and all other
Information security is achieved through a structured risk management security measures.
process that:
Common roles that required expertise in information management include IT
 Identifies information, related assets and the threats, vulnerability and chief security officer (CSO), chief information security officer (CISO), security
impact of unauthorized access engineer, information security analyst, security systems administrator and IT
 Evaluates risks security consultant.

 Makes decisions about how to address or treat risks i.e. avoid, What are information security threats?
mitigate, share or accept
 When mitigated, selects, designs and implements security controls Threats can come in many forms including software attacks, identity theft,
 Monitors activities and makes adjustments to address any new
sabotage, physical theft and information extortion:
issues, changes, or improvements
Types of InfoSec  Software attacks on information security include viruses, malware,
worms, ransomware like WannaCry, trojan horses or any malicious
Application security codes that impact the availability of information.

Application security is a broad topic that covers software vulnerabilities in web

 Phishing emails or websites are often aimed at stealing intellectual
property or log-in credentials to gain unauthorized access. Social
and mobile applications and application programming interfaces (APIs). These
engineering is one of the largest cyber threats and is hard to protect
vulnerabilities may be found in authentication or authorization of users, integrity
against with traditional security measures
of code and configurations, and mature policies and procedures. Application
vulnerabilities can create entry points for significant InfoSec breaches.  Sabotage like denial of service attacks often aim to reduce the
Application security is an important part of perimeter defense for InfoSec. availability of key information assets, reducing confidence or
organizational productivity until payment is received in exchange for
returning service to the organization
Cloud security  Theft of information and equipment is becoming increasingly common
as most devices are now mobile in nature like smartphones or
Cloud security focuses on building and hosting secure applications in cloud
laptops. This is placing more dependance on cloud security than ever
environments and securely consuming third-party cloud applications. “Cloud”
before in history.
simply means that the application is running in a shared environment.
Businesses must make sure that there is adequate isolation between different  Information extortion involves gaining access to confidential
processes in shared environments. information and then holding it at ransom until payment is made

There are many ways to protect against cyber attacks but the number one threat
Cryptography to any organization are its users or internal employees who are susceptible to
social engineering or phishing. This is why cybersecurity awareness training
Encrypting data in transit and data at rest helps ensure data confidentiality and should be integrated into information security management programs.
integrity. Digital signatures are commonly used in cryptography to validate the
authenticity of data. Cryptography and encryption has become increasingly The following free resources can be used for cyber threat awareness training in
important. A good example of cryptography use is the Advanced Encryption the workplace:
Standard (AES). The AES is a symmetric key algorithm used to protect classified
government information.  What is a cyber threat?
 What is a data breach?
Infrastructure security  What is social engineering?

Infrastructure security deals with the protection of internal and extranet networks,  What are phishing attacks?
labs, data centers, servers, desktops, and mobile devices.  What is clickjacking?
 What is typosquatting?
Incident response  What is a DDoS attack?
 What is Ransomware-as-a-Service (RaaS)?
Incident response is the function that monitors for and investigates potentially How do you respond to information security threats?
malicious behavior.
When a threat has been identified you have a choice:
In preparation for breaches, IT staff should have an incident response plan for
containing the threat and restoring the network. In addition, the plan should  Reduce or mitigate the risk by implementing safeguards or
create a system to preserve evidence for forensic analysis and potential countermeasures to eliminate or reduce threats and vulnerabilities
prosecution. This data can help prevent further breaches and help staff discover  Assign or transfer the risk to another entity or organization by
the attacker. purchasing insurance or outsourcing
 Accept the risk when the cost of the countermeasure is more than the
Vulnerability management possible cost of loss due to a vulnerability or cyber attack

Vulnerability management is the process of scanning an environment for weak With the introduction of the General Data Protection Regulation (GDPR) by
points (such as unpatched software) and prioritizing remediation based on risk. the European Parliament and Council in 2016, the need to respond to information
security breaches has become a regulatory requirement for any business
In many networks, businesses are constantly adding applications, users, operating within the EU. Companies are now required to:
infrastructure, and so on. For this reason, it is important to constantly scan the
network for potential vulnerabilities. Finding a vulnerability in advance can save  Provide data breach notifications
your businesses the catastrophic costs of a breach.
 Appoint a data-protection officer
 Require user consent for data processing
 Anonymize data for privacy
This makes a comprehensive incident handling plan and comprehensive data What is a risk assessment?
leak detection a requirement for most global businesses.
Cyber risk assessments are defined by NIST as risks assessments are used to
To support efficient remediation efforts a clear incident response plan needs to identify, estimate, and prioritize risk to organizational operations, organizational
be designed and readily accessible by all security staff. assets, individuals, other organizations, and the Nation, resulting from the
operation and use of information systems.
Learn how to create a reliable disaster recovery plan.
At a high level a cyber risk assessment involves a data audit that answers:
How do you define information security?

There are many ways to define information security but both the National Institute
 What data do we collect?
of Standards and Technology (NIST) and the National Information Assurance (IA)  How and where are we storing this data?
Glossary define information security as "the protection of information and  How do we protect and document the data?
information systems from unauthorized access, use, disclosure, disruption,
modification, or destruction in order to provide confidentiality, integrity, and  How long do we keep data?
availability."  Who has access internally and externally to the data?

What are the key principles of information security?

 Is the place we are storing the data properly secured? Many
breaches come from poorly configured S3 buckets, check your S3
Confidentiality, integrity and availability, also known as the CIA triad, are at the permissions or someone else will
heart of information security. That said, there is a debate about whether or not
the CIA triad sufficiently addresses the rapidly changing technology and business And then defines the parameters of the assessment:
requirements, as well as the relationship between security and privacy. Other
principles such as accountability have been proposed and non-repudiation does  What is the purpose of the assessment?
not fit in well with the three core concepts.  What is the scope of the assessment?
What is confidentiality?  Are there any priorities or constraints I should be aware of that could
affect the assessment?
Confidentiality is about not making information available or disclosed to  Who do I need access to in the organization to get all the information
unauthorized individuals, entities or processes. While similar to privacy the words I need?
should not be used interchangeably.
 What risk model does the organization use for risk analysis?
Confidentiality is a component of privacy that implements security measures to
protect against unauthorized viewers. User privacy has become an increasing
part of confidentiality due to GDPR and other regulatory requirements.

Other examples of confidentiality include protection from laptop theft, password

Lesson Proper for Week 2
theft and other security management techniques. What's the difference between security, anonymity, and privacy? And when
should you prioritize one over another?
What is integrity?
Three of the most important concepts to understand online are: privacy,
Integrity or data integrity is concerned with the maintenance, assurance, anonymity, and security. But while most treat them as synonyms for having a
accuracy and completeness of data over its entire lifecycle. This means safe digital presence, they don’t mean the same thing. And depending on your
implementing security controls that ensure data cannot be modified or deleted by online needs, you should prioritize one over the other.
an unauthorized person or in an undetected manner. While the three often overlap, the only way to determine which one you need the
most in a particular scenario is to understand what they actually mean.
What is availability?
Why You Need to Know the Difference
For any information system to be useful, it must be available when needed. This You probably use technology in your day-to-day life substantially more than the
means computer systems that store and process information, the security average person 10 or 15 years ago. With that, comes the need to ensure
controls that protect it, and the communication channels that access it must everything you do online is secure. But what about privacy and anonymity?
function on demand.
Over the last few years, the words privacy, security, and anonymity became
Businesses and their customers increasingly rely on real-time high availability buzzwords that websites, apps, and tech companies in general use in promoting
systems 24/7. This means information security professionals are increasingly their products and services to gain people’s trust.
concerned with ensuring availability by preventing power outages, hardware
failure and denial of service attacks. Availability is often viewed as the most Some of them are honest and transparent in what they offer. Others prey on
important part of a successful information security program as its ultimately the people’s cyber literacy and their inability to differentiate the meanings. That way,
end-users who need to be able to use the information. companies are safe from accusations of false advertisements while still giving
users a false sense of trust.
What is non-repudiation?
You need to understand what it means when software or an app says that they
Non-repudiation is a term borrowed from law that implies one's intention to fulfill secure your data or pride themselves on offering complete privacy or anonymity.
their obligations in a contract and that one party cannot deny having received or This allows you to pick the right option for your needs without falling prey to the
having sent a transaction. halo effect of similar words.

How does information security fit in with information risk management? What Does Privacy Mean?
Privacy is the ability to keep certain data and information about yourself exclusive
Information risk management is the process of identifying vulnerabilities and to you and control who and what has access to it.
threats to information resources used by an organization and what if any Think of privacy as owning a smartphone—unencrypted and without a password.
countermeasures should be taken to reduce risk to an acceptable level based on Everyone around you knows who the phone belongs to, but they don’t know
the value of the information value to the organization. what’s on it. If someone goes through your phone without permission, it’s an
invasion of privacy, even if they don't use it to hurt or blackmail you.
There are two main considerations with any risk management process:
When it comes to online privacy, it’s a matter of how much personal information
you can keep to yourself when browsing the internet or using software on any of
1. The process of risk management is ongoing and iterative in nature, it
your devices.
must be repeated indefinitely as new threats and vulnerabilities
Invasion of privacy, in itself, doesn’t cause direct harm to you as an individual.
emerge
But in 1948, the United Nations declared privacy a human right, making some
types of privacy invasions illegal in some countries.
2. The choice of countermeasures or controls used must strike a
balance between productivity, cost, effectiveness, and the information
When to Prioritize Privacy
value of the asset being protected
Make privacy your priority when using apps or services that have access to your
Risk analysis and evaluation have innate limitations because when security personal information such as full name, email address, phone number, location,
etc.
incidents occur, they emerge in context and can come from unpredictable or
unexpected threats like poorly configured S3 buckets or external attackers. You should optimize your experience for privacy when using social media
platforms and apps, messaging and emailing services, and browsers.
The likelihood that a threat will use a vulnerability to cause harm creates risk. In What Does Anonymity Mean?
the context of information security, the impact is loss of confidentiality, integrity, To be anonymous is to hide or conceal your identity, but not your actions. You
or availability or all other possible losses (e.g reputational and financial can be anonymous in the physical world by covering your face and fingerprints.
damages). Note: It's not possible to identify nor mitigate all risks. This remaining In the digital world, you can be anonymous by preventing online entities from
risk is called residual risk. collecting or storing data that could be used to identify you.
Anonymity is important for freedom of speech and particularly for whistleblowers.
What is a threat? That's especially true in areas of the world where having certain viewpoints and
opinions could endanger your safety or put your career and future at risk.
A threat is anything (incidental or deliberate) that could cause potential harm, Anonymity also often overlaps with privacy, allowing you to browse the internet
loss or exposure to an information asset. without worrying about tracking logs. These record your every move and
use collected information to build a profile about you or include you in studies and
What is a vulnerability? statistics you didn’t consent to.

A vulnerability is a weakness or exploit that could cause harm, loss or exposure When to Prioritize Anonymity
to an information asset. Online anonymity is a case-by-case need. Generally, you’d want to be
anonymous anytime you’re doing something you wouldn't want to be traced back
What is risk? to you or your online personas.
It’s important when discussing sensitive topics; whether it’s asking for advice on
Risk is the likelihood that an event could cause harm, loss or exposure to an online forums, expressing fringe political views, or exposing a public person or
information asset. commercial entity's misconduct.

What Does Security Mean?

Security is a set of precautions and measures for protection against potential
harm to your person and reputation, and files directly or indirectly from malicious
parties. You can practice online and data security by using antivirus these challenges.
software, encrypting important files, and using passwords to secure accounts Due to the immature market, lack of standards, and numerous point solutions,
and devices. training is a problem for security staff. The industry has not had the time to grow
We also advise using Two-Factor Authentication (2FA) on services where the staff necessary for these roles. In addition, the information security
possible. challenges keep growing at a rapid pace, constantly expanding the list of
Security incidents can cause direct harm to their victims. This could be a data technology to be deployed, and the information security staff just can't keep up.
breach that compromises passwords and other critical information, or a virus that This translates into more time and money to get your staff trained on
damages your files and hardware—by turning off your device’s cooling fan, for commercially available products.
example.
It’s natural to view security as the most important of the three. After all, compared Government Legislation and Industry Regulations
to the other two, security is a need rather than a right or a preference. But more Recent information security incidents and increased reliance upon the Internet
often than not, ensuring user security is used as an excuse to undermine rights to have prompted governments around the world to create additional legislation to
privacy and anonymity. regulate the technology ecosystem. This legislation spans broad areas, such as
consumer privacy, to specific regulations for industries, such as health care and
When to Prioritize Security financial services. Because the Internet is easily accessible from many places in
You need security to protect any type of information that others could use against the world, it is important to understand and operate in compliance with these
you, such as private images and financial information. Look for services with the regulations. Companies that adhere to these regulations and thereby offer their
utmost security when dealing with password managers, antivirus, and financial customers a safe and secure method for conducting business can differentiate
services. themselves from their competitors.
Privacy is a major issue in electronic commerce due to the high risk of misuse of
What Separates Security, Anonymity, and Privacy? personal information. Computer systems contain personal information for millions
While privacy, anonymity, and security all mean different things, it’s increasingly of customers, and if companies do not take the necessary precautions to ensure
difficult to separate them online. that this information is safe and secure, their customers can have their
Sometimes, having one could compromise the other, like how antivirus software identities—including data such as name, address, phone number, and credit card
keeps your files secure but doesn’t always keeps them private. Other times, numbers—stolen and sold to the highest bidder on the Internet. Previously, only
they work in tandem. For example, using anonymous social media accounts with a highly skilled hacker could break into these systems and access confidential
fake credentials to protect your privacy. information. This is no longer the case; now a novice can use readily available
While you should prioritize one over the other in certain situations, the trick is tools and gain access into these systems if the company does not use the proper
finding the right balance between the three, where you have a safe and free safeguards.
online experience without sacrificing convenience. This depends on
understanding implications your online actions have on your internet experience Mobile Workforce and Wireless Computing
and real life. The arrival of mobile computing devices has had a significant impact on everyday
life. Wireless communications liberate employees and consumers from relying on
Six Significant Information Security Challenges phone lines to communicate. Looking for a phone booth to make a call or going
Executives need to understand and address six significant challenges, which are to the office to access email is quickly becoming a fading memory. Information
listed here and reviewed in detail in the following sections: availability and communications have greatly increased due to mobile computing
devices. With the convenience of these devices, information security concerns
· E-commerce requirements increase because the confidential information stored on them needs to be
· Information security attacks protected.
· Immature information security market In the past, staff members typically used one computer in the office for business
· Information security staff shortage purposes and a different one at home for personal use. These lines have blurred
· Government legislation and industry regulations considerably over the past few years, with the use of mobile computers now
· Mobile workforce and wireless computing surpassing the number of desktop computers that remain in a home or office.
Laptop computers now enable employees to continue working at any time from
Electronic Commerce any location. Personal computing devices for storing name and address
The Internet has created an important channel for conducting business called information, phone numbers, and so on are no longer restricted to business
electronic commerce (e-commerce). This channel provides many new ways for professionals because teenagers now keep track of this information using mobile
businesses to offer products and services to their customers. In the past, the devices
ability to connect with millions of customers 24 hours a day, 7 days a week was
only possible for the largest corporations. Now even a company with limited Security is becoming a severe issue for individuals, enterprises, and
resources can compete with larger rivals by offering products and services governments alike. In a world where everything is on the internet, from cute
through the Internet with only a modest investment. E-commerce services are kitten videos and our travel diaries to our credit card information, ensuring
quite appealing to consumers who do not want to spend their limited free time in that our data remains safe is one of the biggest challenges of Security.
traditional retail stores constrained by normal business hours of operation,
unfriendly staff, and long checkout lines. Executives must understand how to 1. RANSOMWARE ATTACKS
leverage this new channel of electronic commerce while managing the
associated risks. Ransomware attacks
Ransomware attacks have become popular in the last few years and pose one of
India’s most prominent Cyber Security challenges in 2020. According to the
Constant Growth and Complexity of Information Security Attacks Cyber Security firm Sophos, about 82% of Indian organizations were hit by
Security incidents that are related to malicious code (worms, viruses, and ransomware in the last six months. Ransomware attacks involve hacking into a
user’s data and preventing them from accessing it until a ransom amount is paid.
Trojans) have grown from slightly annoying to significantly damaging to business
Ransomware attacks are critical for individual users but more so for businesses
operations. A computer virus is a piece of malicious code that attaches to or
who can’t access the data for running their daily operations. However, with most
infects executable programs. Unlike worms, viruses rely on users to execute or ransomware attacks, the attackers don’t release the data even after the payment
launch an infected program to replicate or deliver their payloads. A virus' payload is made and instead try to extort more money.
can delete data or damage system files.
A Trojan (named after the Trojan horse in Greek mythology) is a malicious 2. IOT ATTACKS
program disguised as something innocuous, often a utility or screensaver. Like IOT Attacks
viruses, Trojans rely on unsuspecting users to activate them by launching the According to IoT Analytics, there will be about 11.6 billion IoT devices by 2021.
program to which the Trojan is attached. Trojans have many functions; some IoT devices are computing, digital, and mechanical devices that can
delete or steal data, whereas others install backdoors that enable a hacker to autonomously transmit data over a network. Examples of IoT devices include
take control of a system. Unlike viruses, Trojans do not replicate. desktops, laptops, mobile phones, smart security devices, etc. As the adoption of
. IoT devices is increasing at an unprecedented rate, so are the challenges of
Immaturity of the Information Security Market Cyber Security. Attacking IoT devices can result in the compromise of sensitive
The information security market is still in its infancy, with few formal standards user data. Safeguarding IoT devices is one of the biggest challenges in Cyber
established for products or services. The best way to characterize this market Security, as gaining access to these devices can open the doors for other
malicious attacks.
would be to compare it to the enterprise resource planning (ERP) market in the
early 1980s. Companies at that time were purchasing finance, order processing,
3. CLOUD ATTACKS
and manufacturing systems from separate vendors and having their IT staff Cloud attacks
integrate these products. This was a time-consuming and expensive process Most of us today use cloud services for personal and professional needs. Also,
because no standards existed, and interoperability between different vendors hacking cloud-platforms to steal user data is one of the challenges in Cyber
was poor. The market then matured, and a small number of vendors such as Security for businesses. We are all aware of the infamous iCloud hack, which
SAP emerged as industry leaders. These leaders provided a complete solution exposed private photos of celebrities. If such an attack is carried out on
for companies that included all the individual systems as part of their enterprise data, it could pose a massive threat to the organization and maybe
integrated ERP system. They also established the standards for smaller even lead to its collapse.
companies offering complementary functionality. Smaller companies either met
the industry leader standards or were pushed out of the market. 4. PHISHING ATTACKS
The information security industry is at a similar stage today, with several Phishing is a type of social engineering attack often used to steal user data,
companies offering individual solutions such as firewalls that address only a including login credentials and credit card numbers. Unlike ransomware attacks,
portion of a company's security needs. As a result, their customers face the the hacker, upon gaining access to confidential user data, doesn’t block it.
challenge of making all these solutions work together. Only early versions of Instead, they use it for their own advantages, such as online shopping and illegal
money transfer. Phishing attacks are prevalent among hackers as they can
standards exist, forcing companies to complete multiple installations of “point”
exploit the user’s data until the user finds out about it. Phishing attacks remain
solutions that provide individual components of their security systems.
one of the major challenges of Cyber Security in India, as the demographic here
As with the ERP systems, this will change as a small number of vendors emerge isn’t well-versed with handling confidential data.
as leaders and offer complete solutions that can support the majority of a
company's information security needs. Smaller niche players in the market will 5. BLOCKCHAIN AND CRYPTOCURRENCY ATTACKS
integrate their products with these leaders' standards because their customers Block chain and crypto currency attacks
will no longer be willing to have their IT staff perform this role. However, until this While blockchain and cryptocurrency might not mean much to the average
day comes, the IT staff continues to bear the daunting task of cobbling all these internet user, these technologies are a huge deal for businesses. Thus, attacks
solutions together. They must deploy a constantly expanding list of products and on these frameworks pose considerable challenges in Cyber Security for
complete the integration work to ensure that these components are working businesses as it can compromise the customer data and business operations.
together. These technologies have surpassed their infancy stage but have yet not reached
an advanced secure stage. Thus, several attacks have been attacks, such as
Shortage of Information Security Staff DDOS, Sybil, and Eclipse, to name a few. Organizations need to be aware of the
Finding qualified information security staff is a difficult task, which will likely security challenges that accompany these technologies and ensure that no gap is
continue to be the case in the near future. Driving the hiring challenge is the left open for intruders to invade and exploit.
immaturity of the solutions from information security vendors, the limited number
of qualified staff available, and the unique blend of information security skills
required. Business executives will need to invest more in this area to overcome
6. SOFTWARE VULNERABILITIES Bots –: can be seen as advanced form of worms. They are automated processes
Software Vulnerabilities that are designed to interact over the internet without the need of human
Even the most advanced software has some vulnerability that might pose interaction. They can be good or bad. Malicious bot can infect one host and after
significant challenges to Cyber Security in 2020, given that the adoption of digital infecting will create connection to the central server which will provide commands
devices now is more than ever before. Individuals and enterprises don’t usually to all infected hosts attached to that network called Botnet.
update the software on these devices as they find it unnecessary. However,
updating your device’s software with the latest version should be a top priority. Malware on the basis of Actions:
An older software version might contain patches for security vulnerabilities that
are fixed by the developers in the newer version. Attacks on unpatched software Adware – Adware is not exactly malicious but they do breach privacy of the
versions are one of the major challenges of Cyber Security. These attacks are users. They display ads on computer’s desktop or inside individual programs.
usually carried out on a large number of individuals, like the Windows zero-day They come attached with free to use software, thus main source of revenue for
attacks. such developers. They monitor your interests and display relevant ads. An
attacker can embed malicious code inside the software and adware can monitor
7. MACHINE LEARNING AND AI ATTACKS your system activities and can even compromise your machine
Machine learning and AI attacks
While Machine Learning and Artificial Intelligence technologies have proven Spyware – It is a program or we can say a software that monitors your activities
highly beneficial for massive development in various sectors, it has its on computer and reveal collected information to interested party. Spyware are
vulnerabilities as well. These technologies can be exploited by unlawful generally dropped by Trojans, viruses or worms. Once dropped they installs
individuals to carry out cyberattacks and pose threats to businesses. These themselves and sits silently to avoid detection.
technologies can be used to identify high-value targets among a large dataset. One of the most common example of spyware is KEYLOGGER. The basic job of
Machine Learning and AI attacks are another big concern in India. A keylogger is to record user keystrokes with timestamp. Thus capturing interesting
sophisticated attack might prove to be too difficult to handle due to the lack of information like username, passwords, credit card details etc.
Cyber Security expertise in our country.
Ransomware – It is type of malware that will either encrypt your files or will lock
your computer making it inaccessible either partially or wholly. Then a screen will
8. BYOD POLICIES be displayed asking for money i.e. ransom in exchange.
BVOD Policies
Most organizations have a Bring-Your-Own-Device policy for their employees. Scareware – It masquerades as a tool to help fix your system but when the
Having such systems poses multiple challenges in Cyber Security. Firstly, if the software is executed it will infect your system or completely destroy it. The
device is running an outdated or pirated version of the software, it is already an software will display a message to frighten you and force to take some action like
excellent medium for hackers to access. Since the method is being used for pay them to fix your system.
personal and professional reasons, hackers can easily access confidential
business data. Secondly, these devices make it easier to access your private Rootkits – are designed to gain root access or we can say administrative
network if their security is compromised. Thus, organizations should let go of privileges in the user system. Once gained the root access, the exploiter can do
BYOD policies and provide secure devices to the employees, as such systems anything from stealing private files to private data.
possess enormous challenges of Computer Security and network compromise.
Zombies – They work similar to Spyware. Infection mechanism is same but they
9. INSIDER ATTACKS don’t spy and steal information rather they wait for the command from hackers.
Insider attacks · Theft of intellectual property means violation of intellectual property
While most challenges of Cyber Security are external for businesses, there can rights like copyrights, patents etc.
be instances of an inside job. Employees with malicious intent can leak or export · Identity theft means to act someone else to obtain person’s personal
confidential data to competitors or other individuals. This can lead to huge information or to access vital information they have like accessing the computer
financial and reputational losses for the business. These challenges of Computer or social media account of a person by login into the account by using their login
Security can be negated by monitoring the data and the inbound and outbound credentials.
network traffic. Installing firewall devices for routing data through a centralized · Theft of equipment and information is increasing these days due to the
server or limiting access to files based on job roles can help minimize the risk of mobile nature of devices and increasing information capacity.
insider attacks. · Sabotage means destroying company’s website to cause loss of
10. OUTDATED HARDWARE confidence on part of its customer.
· Information extortion means theft of company’s property or information to
Outdated Hardware receive payment in exchange. For example ransomware may lock victims file
Well, don’t be surprised. Not all challenges of Cyber Security come in the form of making them inaccessible thus forcing victim to make payment in exchange. Only
software attacks. With software developers realizing the risk of software after payment victim’s files will be unlocked.
vulnerabilities, they offer a periodic update. However, these new updates might
not be compatible with the hardware of the device. This is what leads to outdated These are the old generation attacks that continue these days also with
advancement every year. Apart from these there are many other threats. Below
hardware, wherein the hardware isn’t advanced enough to run the latest software
is the brief description of these new generation threats.
versions. This leaves such devices on an older version of the software, making
them highly susceptible to cyberattacks. Technology with weak security – With the advancement in technology, with
every passing day a new gadget is being released in the market. But very few are
Lesson Proper for Week 3 fully secured and follows Information Security principles. Since the market is very
competitive Security factor is compromised to make device more up to date. This
Threats to Information Security leads to theft of data/ information from the devices

Information Security threats can be many like Software attacks, theft of Social media attacks – In this cyber criminals identify and infect a cluster of
intellectual property, identity theft, theft of equipment or information, sabotage, websites that persons of a particular organisation visit, to steal information.
and information extortion.
Mobile Malware –There is a saying when there is a connectivity to Internet there
Threat can be anything that can take advantage of a vulnerability to breach will be danger to Security. Same goes to Mobile phones where gaming
security and negatively alter, erase, harm object or objects of interest. applications are designed to lure customer to download the game and
unintentionally they will install malware or virus in the device.
Software attacks means attack by Viruses, Worms, Trojan Horses etc. Many
users believe that malware, virus, worms, bots are all same things. But they are Outdated Security Software – With new threats emerging everyday, updation in
not same, only similarity is that they all are malicious software that behave security software is a pre requisite to have a fully secured environment.
differently.
Corporate data on personal devices – These days every organization follows a
Malware is a combination of 2 terms- Malicious and Software. So Malware rule BYOD. BYOD means Bring your own device like Laptops, Tablets to the
basically means malicious software that can be an intrusive program code or a workplace. Clearly BYOD pose a serious threat to security of data but due to
anything that is designed to perform malicious operations on system. Malware productivity issues organizations are arguing to adopt this.
can be divided in 2 categories:
Social Engineering – is the art of manipulating people so that they give up their
1. Infection Methods confidential information like bank account details, password etc. These criminals
2. Malware Actions can trick you into giving your private and confidential information or they will gain
your trust to get access to your computer to install a malicious software- that will
Malware on the basis of Infection Method are following: give them control of your computer. For example email or message from your
friend, that was probably not sent by your friend. Criminal can access your
Virus – They have the ability to replicate themselves by hooking them to the friends device and then by accessing the contact list he can send infected email
program on the host computer like songs, videos etc and then they travel all over and message to all contacts. Since the message/ email is from a known person
the Internet. The Creeper Virus was first detected on ARPANET. Examples recipient will definitely check the link or attachment in the message, thus
include File Virus, Macro Virus, Boot Sector Virus, Stealth Virus etc. unintentionally infecting the computer.

Worms – Worms are also self replicating in nature but they don’t hook Web threats definition
themselves to the program on host computer. Biggest difference between virus
and worms is that worms are network aware. They can easily travel from one Web-based threats, or online threats, are a category of cybersecurity risks that
computer to another if network is available and on the target machine they will may cause an undesirable event or action via the internet.
not do much harm, they will for example consume hard disk space thus slowing
down the computer. Web threats are made possible by end-user vulnerabilities, web service
developers/operators, or web services themselves. Regardless of intent or
Trojan – The Concept of Trojan is completely different from the viruses and cause, the consequences of a web threat may damage both individuals and
worms. The name Trojan derived from the ‘Trojan Horse’ tale in Greek organizations.
mythology, which explains how the Greeks were able to enter the fortified city of
Troy by hiding their soldiers in a big wooden horse given to the Trojans as a gift. This term typically applies to — but is not limited to — network-based threats in
The Trojans were very fond of horses and trusted the gift blindly. In the night, the the following categories:
soldiers emerged and attacked the city from the inside.
Private network threats - impact sub-networks connected to the wider global
Their purpose is to conceal themselves inside the software that seem legitimate internet. Typical examples can include home Wi-Fi or ethernet networks,
and when that software is executed they will do their task of either stealing corporate intranets, and national intranets.
information or any other purpose for which they are designed. Host threats - impact specific network host devices. The term host often refers to
They often provide backdoor gateway for malicious programs or malevolent corporate endpoints and personal devices, such as mobile phones, tablets, and
users to enter your system and steal your valuable data without your knowledge traditional computers.
and permission. Examples include FTP Trojans, Proxy Trojans, Remote Access Web server threats - impact dedicated hardware and software that serve web
Trojans etc. infrastructure and services.
What are web threats? Users are affected when they engage with malicious URLs, downloads, or
provide sensitive info to websites and message senders. This engagement may
Internet-based threats expose people and computer systems to harm online. A also trigger infection and spread of web threats to other users and networks. It’s
broad scope of dangers fits into this category, including well-known threats like not uncommon for innocent users to unknowingly become threat agents
phishing and computer viruses. However, other threats, like offline data theft, can themselves.
also be considered part of this group.
Web threats are not limited to online activity but ultimately involve the internet at How to spot web threats
some stage for inflicted harm. While not all web threats are created deliberately, Despite the unending scope of web-based dangers, it is possible to spot some
many are intended — or have the potential — to cause: general traits of web threats. However, spotting a web threat requires a vigilant
eye to catch subtle details.
Some web threats are clearly of concern to web infrastructure hardware, such as
Access denial. Prevention of entry to a computer and/or network services. water and heat. While those are easier to spot, others require careful attention.
Access acquisition. Unauthorized or unwanted entry into a private computer Any time you are browsing websites and receiving digital messages are when
and/or network services. you should be most cautious.
Unauthorized or unwanted use of computer and/or network services. Here are some tips to guide you:
Exposing private data without permission, such as photos, account credentials,
and sensitive government information.
Unauthorized or undesired changes to a computer and/or network services. Grammar: Malicious actors may not always carefully craft their messages or web
content when assembling an attack. Look for typos, odd punctuation, and
In recent years, the landscape of web threats has grown significantly. unusual phrasing.
Technologies like smart devices and high-speed mobile networks have allowed URLs: Harmful links can be masked under decoy anchor text — the visible text
for an always-connected vector of malware, fraud, and other complications. Also, that’s displayed. You can hover over a link to inspect its true destination.
web adoption in areas like communications and productivity via the Internet of Poor quality images: The use of low-resolution or unofficial images may indicate
Things (IoT) has outpaced user security awareness. a malicious webpage or message.
As we continue to rely more on the web for daily living, it will keep exponentially
rising as an attractive attack option for malicious parties. Convenience and a lack Types of web security threats
of caution around web use are among the top concerns that continue to pose As mentioned previously, web threats typically include human and technical
new risks to privacy and security. manipulation in order to attack. Be aware there tends to be overlap between web
While targets are typically computer-based, human victims ultimately experience threats, and some may occur simultaneously. Some of the most common web
the lasting effects of a web threat. threats may include the following.

How do web threats work? Social engineering

Social engineering involves deceiving users to act unknowingly against their own
When a web threat arises, certain circumstances align to make it a point-of- best interests. These threats usually involve gaining the trust of users to deceive
concern. them. Manipulating users in this way can include:
Namely, there are a few basic components to any web threat:
Phishing: Posing as legitimate institutions or people to get them to divulge
Threat motives give an intentional threat agent a reason or goal to cause harm. personal details.
Some threat agents don’t act intentionally or act autonomously and may, Watering hole attacks: Exploiting popular websites to fool users into exposing
therefore, be absent of motive. themselves to harm.
Threat agents are anything or anyone that can negatively impact — with the Network spoofing: Fraudulent access points that mimic legitimate ones.
internet either as a threat vector or a target itself.
Vulnerabilities include any human behavior weakness, technology systems, or Malicious code
other resources that can lead to a damaging exploit or incident. Includes malware and harmful scripts (lines of computer programming
Threat outcomes are the negative results of a threat agent acting against one or commands) to create or exploit technical vulnerabilities. Where social
more vulnerabilities. engineering is the human side of web threats, malicious code is the technical
As these components interact, a threat becomes an attack on computer side. These threats can include but are not limited to:
systems. Threat motives can include any of the following: financial, surveillance,
information, retaliation, sabotage, and more. Injection attacks: Insertion of harmful scripts into legitimate applications and
websites. Examples include SQL injection and cross-site scripting (XSS).
Threat agents are typically people with malicious intent. By extension, agents Botnet: Hijacking a user device for remote, automated use in a network of similar
may also be anything that is manipulated into acting in favor of the original threat “zombies.” These are used to accelerate spam campaigns, malware attacks, and
agent. However, some threat agents more.
— such as destructive nature events — act entirely without human intervention. Spyware: Tracking programs that monitor user actions on a computer device.
The types of threat agents include: The most common examples are keyloggers.
Computer worms: Scripts that run, replicate, and spread autonomously without
Non-human agents: Examples include malicious code (viruses, malware, the help of a related program.
worms, scripts), natural disasters (weather, geological), utility failure (electrical,
telecom), technology failure (hardware, software), and physical hazards (heat, Exploits
water, impact). Exploits are intentional abuses of vulnerabilities that may lead to an undesirable
Intentional human agents: Based on malicious intent. Can be internal incident.
(employees, contractors, family, friends, acquaintances) and external
(professional and amateur hackers, nation-state actors and agencies, competitor Brute force attacks: Manual or automated attempts to breach security “gates”
corporations) and vulnerabilities. This may typically involve generating all possible passwords
Accidental human agents: Based on human error. Similar to intentional threats, to a private account.
this type can include internal and external agents. Spoofing: Masking a real identity to manipulate legitimate computer systems.
Negligence-based human agents: Based on careless behaviors or safety Examples include IP spoofing, DNS spoofing, and cache poisoning.
oversights. Again, this category can also include internal and external agents.
Cybercrime
Vulnerabilities may be points of weakness where someone or something can be Cybercrime refers to any unlawful activity conducted via computer systems.
manipulated. Vulnerabilities can be considered a web threat and a concern that These threats often use the web to enact their plans.
enables other threats. This area typically includes some form of human or
technical weakness that can lead to penetration, misuse, or destruction of a Cyberbullying: Mental abuse of victims using threats and harassment.
system. Unauthorized data disclosure involves the release of private information, such
as email leaks, intimate photos, and significant corporate data leaks.
Threat outcomes may lead to disclosed private info, deceived users, disrupted Cyber libel: Also known as online defamation, this can involve attacking
computer system use, or seized access privileges. Web threats often result in, individuals or organizations' reputations. This can be done through disinformation
but are not limited to, causing: (deliberate distribution of inaccurate information) or misinformation (mistaken
distribution of inaccurate information).
Advanced Persistent Threats (APTs): Malicious actors gain access to a private
Reputation damage: Loss of trust from clients and partners, search engine network and establish ongoing access. They combine social engineering,
blacklisting, humiliation, defamation, etc. malicious code, and other threats to exploit vulnerabilities and gain this access.
Operations disruption: Operational downtime, access denial to web-based Typically, web threats refer to malware programs that can target you when you're
services such as blogs or message boards, etc. using the internet. These browser-based threats include a range of malicious
Theft: Financial, identity, sensitive consumer data, etc. software programs that are designed to infect victims’ computers. The main tool
behind such browser-based infections is the exploit pack – which gives
Cybercriminals will use almost any vulnerability within an operating system (OS) cybercriminals a route to infecting computers that either:
or an application to conduct an attack. However, most cybercriminals will develop
web threats that deliberately target some of the most common operating Do not have a security product installed
systems/applications, including: Contain a commonly used operating system or application that is vulnerable –
because the user hasn’t applied the latest updates, or a new patch has yet to be
issued by the software vendor
Java: Because Java is installed on over 3 billion devices (that are running under Kaspersky’s Internet security experts have identified the most active malicious
various operating systems) exploits can be created to target specific Java software programs involved in web threats. The list includes the following types
vulnerabilities on several different platforms/operating systems. of online threats:
Adobe Reader: Although many attacks have targeted Adobe Reader, Adobe has Malicious websites. Kaspersky identifies these websites by using cloud-based
implemented tools to protect the program against exploit activity. However, heuristic detection methods. Most malicious URL detections are for websites that
Adobe Reader is still a common target. contain exploits.
Windows and Internet Explorer: Active exploits still target vulnerabilities that Malicious scripts. Hackers inject malicious scripts into the code of legitimate
were detected as far back as 2010 – including MS10-042 in Windows Help and websites that have had their security compromised. Such scripts are used to
Support Center, and MS04-028, which is associated with incorrect handling of perform drive-by attacks – in which visitors to the website are unknowingly
JPEG files. redirected to malicious online resources.
Android: Cybercriminals use exploits to gain root privileges. Then, they can Scripts and executable PE files Generally, these either:
achieve almost complete control over the targeted device. Download and launch other malicious software programs
Carry a payload that steals data from online banking and social network accounts
How do internet web threats spread? or steals login and user account details for other services
The most concerning internet threats travel the web to attack more systems. Trojan-Downloaders. These Trojan viruses deliver various malicious programs
These threat agents often use a mix of human manipulation and technical to users’ computers.
commands to reach their targets. Exploits and exploit packs. Exploits target vulnerabilities and try to evade the
Web threats of this nature use the internet's many communications channels to attention of Internet security software.
spread. Larger threats use the global internet to respond to threats, while more Adware programs. Often, the adware will simultaneously install when a user
targeted threats may directly infiltrate private networks. starts to download a freeware or shareware program.
Typically, these threats are distributed through web-based services. Malicious
actors prefer to place these threats in locations where users will often engage
with them. Public websites, social media, web forums, and email are often ideal
for spreading a web threat.
Examples of web threats third party. A keylogger is a specific kind of spyware that records all the
keystrokes a user makes—great for stealing passwords.
Among the many examples of web threats, here are some of the more well-
known examples:
 A rootkit is, as described by TechTarget, "a program or, more often, a
collection of software tools that gives a threat actor remote access to and
WannaCry ransomware control over a computer or other system." It gets its name because it's a kit
of tools that (generally illicitly) gain root access (administrator-level control,
In May 2017, the WannaCry ransomware spread to many networks and locked in Unix terms) over the target system, and use that power to hide their
down countless Windows PCs. This threat was particularly dangerous because of presence.
its worm functionality, allowing it to spread completely autonomously. WannaCry  Adware is malware that forces your browser to redirect to web
exploited a native communication language within Windows to spread this advertisements, which often themselves seek to download further, even
malicious code. more malicious software. As The New York Times notes, adware often
piggybacks onto tempting "free" programs like games or browser
Celebrity iCloud phishing extensions.

A spear-phishing attack led to the breach of numerous celebrity iCloud accounts.  Ransomware is a flavor of malware that encrypts your hard drive's files
This breach ultimately resulted in the unauthorized leak of countless private and demands a payment, usually in Bitcoin, in exchange for the decryption
photos from these accounts. key. Several high-profile malware outbreaks of the last few years, such
as Petya, are ransomware. Without the decryption key, it's mathematically
While the attacker was eventually located and prosecuted, the victims are still impossible for victims to regain access to their files. So-called scareware is
suffering from their intimate photos being made public — without their a sort of shadow version of ransomware; it claims to have taken control of
permission. This has become one of the most well-known phishing attacks of the your computer and demands a ransom, but actually is just using tricks like
decade. browser redirect loops to make it seem as if it's done more damage than it
really has, and unlike ransomware can be relatively easily disabled.
How to protect yourself against web threats  Cryptojacking is another way attackers can force you to supply them with
Bitcoin—only it works without you necessarily knowing. The crypto mining
Most threats are successful due to two main weaknesses: malware infects your computer and uses your CPU cycles to mine
Bitcoin for your attacker's profit. The mining software may run in the
Human error background on your operating system or even as JavaScript in a browser
Technical error window.
Full protection from web threats means you will need to find ways to cover these
weak points.  Malvertising is the use of legitimate ads or ad networks to covertly deliver
malware to unsuspecting users’ computers. For example, a cybercriminal
General tips to follow for both end-users and web service providers include: might pay to place an ad on a legitimate website. When a user clicks on the
ad, code in the ad either redirects them to a malicious website or installs
Always create backups: All valuable data should be copied and stored safely to malware on their computer. In some cases, the malware embedded in an
prevent data loss in case of an incident. Websites, device drives, and even web ad might execute automatically without any action from the user, a
servers can be backed up. technique referred to as a “drive-by download.”
Enable multi-factor authentication (MFA): MFA allows for additional layers of
user authentication on top of traditional passwords. Organizations should enable
this protection for users, while end-users should be sure to make use of it. Any specific piece of malware has both a means of infection and a behavioral
Scan for malware: Regular scans for infections will keep your computer devices category. So, for instance, WannaCry is a ransomware worm. And a particular
secured. Personal devices can all be covered through an antivirus piece of malware might have different forms with different attack vectors: for
solution like Kaspersky Total Security. Enterprise endpoint machines and instance, the Emotet banking malware has been spotted in the wild as both
computer networks should use this protection as well. a trojan and a worm.
Keep all tools, software, and OS up to date: Computer systems are more A look at the Center for Internet Security's top 10 malware offenders for June of
vulnerable when they’ve been unpatched against undiscovered holes in their 2018 gives you a good sense of the types of malware out there. By far the most
programming. Software developers regularly probe for weaknesses and issue common infection vector is via spam email, which tricks users into activating the
updates for this purpose. Protect yourself by downloading these updates. malware, Trojan-style. WannaCry and Emotet are the most prevalent malware on
Service providers like website owners and server operators are where true the list, but many others, including NanoCore and Gh0st, are what's
comprehensive security starts. These parties will need to take precautions for called Remote Access Trojans or RATs—essentially, rootkits that propagate like
better protection. They can do this by: Trojans. Cryptocurrency malware like CoinMiner rounds out the list.

Monitoring web traffic to gauge for normal volumes and patterns. How to prevent malware
Implementing firewalls to filter and restrict unpermitted web connections. With spam and phishing email being the primary vector by which malware infects
Network infrastructure distribution to decentralize data and services. This computers, the best way to prevent malware is make sure your email systems
includes aspects like backups for various resources and geo server rotations. are locked down tight—and your users know how to spot danger.
Internal probing to investigate for unpatched vulnerabilities. This might, for We recommend a combination of carefully checking attached documents and
example, involve self-attacking with SQL injection attack tools. restricting potentially dangerous user behavior—as well as just familiarizing your
Proper security configuration for access rights and session management. users with common phishing scams so that their common sense can kick in.
Users should protect themselves by doing the following: When it comes to more technical preventative measures, there are a number of
steps you can take, including keeping all your systems patched and updated,
Scan downloads for malware. keeping an inventory of hardware so you know what you need to protect, and
Vet links before clicking, only clicking links if you are positive the destination is performing continuous vulnerability assessments on your infrastructure. When it
safe and trusted. comes to ransomware attacks in particular, one way to be prepared is to always
Make strong, secure passwords, and avoid duplicates. Use a secure Password make backups of your files, ensuring that you'll never need to pay a ransom to
Manager to help manage all of your accounts and passwords. get them back if your hard drive is encrypted.
Throttle login attempts by triggering account lockdown after a limited number of
tries. Malware protection
Look out for phishing red flags in texts, email, and other communications. Antivirus software is the most widely known product in the category of malware
protection products; despite "virus" being in the name, most offerings take on all
forms of malware. While high-end security pros dismiss it as obsolete, it's still the
Lesson Proper for Week 4 backbone of basic anti-malware defense. Today's best antivirus software is from
vendors Kaspersky Lab, Symantec and Trend Micro, according to recent tests by
Malware definition
AV-TEST.
Malware, short for malicious software, is a blanket term for viruses, worms,
When it comes to more advanced corporate networks, endpoint security offerings
trojans and other harmful computer programs hackers use to wreak destruction
provide defense in depth against malware. They provide not only the signature-
and gain access to sensitive information. As Microsoft puts it, "[malware] is a
based malware detection that you expect from antivirus, but anti-spyware,
catch-all term to refer to any software designed to cause damage to a single
personal firewall, application control and other styles of host intrusion prevention.
computer, server, or computer network." In other words, software is identified as
Gartner offers a list of its top picks in this space, which include products from
malware based on its intended use, rather than a particular technique or
Cylance, CrowdStrike, and Carbon Black.
technology used to build it.
This means that the question of, say, what the difference is between malware
How to detect malware
and a virus misses the point a bit: a virus is a type of malware, so all viruses are
It's fully possible—and perhaps even likely—that your system will be infected by
malware (but not every piece of malware is a virus).
malware at some point despite your best efforts. How can you tell for
sure? CSO columnist Roger Grimes has written a deep dive into how to diagnose
Types of malware
your PC for potential malware that you might find helpful.
There are a number of different ways of categorizing malware; the first is by how
When you get to the level of corporate IT, there are also more advanced visibility
the malicious software spreads. You've probably heard the words virus,
tools you can use to see what's going on in your networks and detect malware
trojan, and worm used interchangeably, but as Symantec explains, they describe
infections. Most forms of malware use the network to either spread or send
three subtly different ways malware can infect target computers:
information back to their controllers, so network traffic contains signals of
malware infection that you might otherwise miss; there are a wide range of
 A worm is a standalone piece of malicious software that reproduces itself
network monitoring tools out there, with prices ranging from a few dollars to a few
thousand. There are also SIEM tools, which evolved from log management
and spreads from computer to computer. programs; these tools analyze logs from various computers and appliances
 A virus is a piece of computer code that inserts itself within the code of across your infrastructure looking for signs of problems, including malware
infection. SIEM vendors range from industry stalwarts like IBM and HP Enterprise
another standalone program, then forces that program to take malicious
to smaller specialists like Splunk and Alien Vault.
action and spread itself.
 A trojan is a program that cannot reproduce itself but masquerades as Malware removal
something the user wants and tricks them into activating it so it can do its How to remove malware once you're infected is in fact the million dollar question.
Malware removal is a tricky business, and the method can vary depending on the
damage and spread.
type you're dealing with. CSO has information on how to remove or otherwise
recover from rootkits, ransomware, and cryptojacking. We also have a guide
Malware can also be installed on a computer "manually" by the attackers to auditing your Windows registry to figure out how to move forward.
themselves, either by gaining physical access to the computer or using privilege If you're looking for tools for cleansing your system, Tech Radar has a
escalation to gain remote administrator access. good roundup of free offerings, which contains some familiar names from the
Another way to categorize malware is by what it does once it has successfully antivirus world along with newcomers like Malwarebytes.
Malware examples
infected its victim's computers. There are a wide range of potential attack
techniques used by malware: We've already discussed some of the current malware threats looming large
today. But there is a long, storied history of malware, dating back to infected
floppy disks swapped by Apple II hobbyists in the 1980s and the Morris
 Spyware is defined by Webroot Cybersecurity as "malware used for the
Worm spreading across Unix machines in 1988. Some of the other high-profile
malware attacks have included:
purpose of secretly gathering data on an unsuspecting user." In essence,
it spies on your behavior as you use your computer, and on the data you
send and receive, usually with the purpose of sending that information to a
 ILOVEYOU, a worm that spread like wildfire in 2000 and did more than $15
2- Physical Security:
This layer of security is always an important for many people, and they regularly
billion in damage provide facilities through which they can establish physical security to protect
 SQL Slammer, which ground internet traffic to a halt within minutes of its information, in the real world, if you have a valuable object, such as money,
first rapid spread in 2003 jewelry, documents, etc., you maintain this layer of security as fully as possible,
for example, if you leave that valuable object in a safe place, or give it to
 Conficker, a worm that exploited unpatched flaws in Windows and someone who you trust, you are not worried about protecting them.
leveraged a variety of attack vectors – from injecting malicious code to The same thing is also true for computers, generally, physical security is defined
phishing emails – to ultimately crack passwords and hijack Windows as the protection of hardware and software components, networks, and data from
devices into a botnet. natural physical conditions and events, which may cause serious damage to an
organization and the information contained in them, in other words, physical
 Zeus, a late '00s keylogger Trojan that targeted banking information security includes all measures to protect all hardware, information and software
 CryptoLocker, the first widespread ransomware attack, whose code keeps
available against theft, natural disasters, etc., in order to achieve this kind of
security, you must pay attention to some tips which help you keep your
getting repurposed in similar malware projects information safe.
 Stuxnet, an extremely sophisticated worm that infected computers
worldwide but only did real damage in one place: the Iranian nuclear facility There may be different tips about the ways of establishing this layer
of security which are different from each other, to establish this layer of security,
at Natanz, where it destroyed uranium-enriching centrifuges, the mission it
you may choose a safe room with CCTV cameras, or restrict the access of
was built for by U.S. and Israeli intelligence agencies different people to this room, which can also help you in protecting important
information and other solutions that exists to ensure you that physical security is
Malware trends set up properly, it should also be noted that different there are different threats for
You can count on cyber criminals to follow the money. They will target victims this section, including, abnormal weather conditions, pouring coffee on the
depending on likelihood of delivering their malware successfully and size of computer, people who target your information, etc., to establish security for each
potential payout. If you look at malware trends over the past few years, you will of these threats, certain principles are required.
see some fluctuation in terms of the popularity of certain types of malware and
who the most common victims are—all driven by what the criminals believe will 3- Secure Networks and Systems:
have the biggest ROI. This layer of security is very widespread, which includes all measures,
Recent research reports indicate some interesting shifts in malware tactics and equipment, etc., which cause the security of the system and the network to be
targets. Cryptominers, which had surpassed ransomware as the most common integrated,m and prevent any threatening factors from entering your system, and
type of malware, are falling out of favor due to the decline in cryptocurrency ultimately provide security for you.
values. Ransomware is becoming more targeted, moving away from a shotgun
approach. Network security has 3 types, which we are going to discuss in the
following.
Malware attacks on businesses spike
Businesses saw a 79 percent increase in the amount of malware they dealt with · Physical Network Security:
in 2018 over 2017, according to the Malwarebytes Labs State of Malware Report This type of network security control is to protect information and prevent illegal
2019. “What we usually see year-end or quarterly end is that there has been access to the system.
some sort of increase or large amounts of detections on the consumer side,”
says Adam Kujawa, director of Malwarebytes Labs. “On the business side it · Technical Network Security:
might slowly grow, but certainly nothing like we’ve seen this last six months.” By This type is so important and protects all the data that is in the computer,
comparison, consumer detections decreased by 3 percent over the same period. including the one that is being transferred from the computer or the data that is
“We’ve observed that there is a significant push by cyber criminals to move away entering the computer, in order to establish the security of this layer, you must
from consumers and put their really heavy stuff against businesses instead,” pay attention to many points.
Kujawa adds.
That “really heavy stuff” comes largely in the form of older consumer-focused · Administrative Network Security:
malware that’s “been weaponized” to become a bigger, more versatile threat for As you know, the behaviors of users who have access to information, cannot be
business. Kujawa cites Emotet as one of the most significant. “It’s a nasty little controlled, and you must provide facilities in advance, so that you can prevent
information stealing Trojan that also installs additional malware, spreads laterally, any event that affects the security structure of the network, one of the things that
and acts as its own spam sender. Once it infects a system, it starts sending email can be done in this section, is restricting people's access to all information, which
and tries to infect other people.” is an effective way to prevent a series of unfortunate events.
Emotet has been around since 2014 and targeted mainly consumers. Originally,
it infected a computer looking for an individual’s financial or credit card In general, in this layer of security , you can do the following:
information to steal. Since then, it’s picked up new capabilities inspired by or · Network Access Control
borrowed from other successful malware like Wannacry or EternalBlue. “Now it’s · Antivirus and Antimalware Software
become much more modular and we see it able to use these exploits to traverse · Firewall Protection
through a corporate network whereas before they were limited to a single · Virtual Private Networks
endpoint,” says Kujawa. “Even if it’s a small network in a small business, it’s
more juicy than infecting Grandma.” 4- Vulnerability Programs:
Lateral movement of malware is increasing, according to the Global Threat Despite the spread of cyber attacks and loss of information which they cause,
Report: The Year of the Next-Gen Cyberattack from Carbon Black. Nearly 60 and the daily progress of hackers, security layers have received more attention
percent of malware attacks on business are now designed to move laterally from users, and they try to study and search in this field to have control over each
across a network. layer and implement all the necessary strategies to protect their information,
One reason for the spike in malware attacks on business might be the hackers are constantly scrutinizing the weaknesses of a system and use these
EU’s General Data Privacy Regulation (GDPR). Kujawa believes it’s possible that weak points to attack the system and its information, so they get their desired
attackers stepped up business attacks thinking that it would be harder to steal results through them.
personal and other data after the regulation went into effect. That combined with In this layer of security, you must pay more attention to the vulnerabilities of a
the decline of cryptocurrency values and stepped up defenses against system, all of these weak points have to be identified through various tools, then
ransomware turned attackers to what worked in the past. “They always [go back you should try to do your best to solve the problem because that weak points
to what works],” he says. “Cyber crime is cyclical. It always comes back around.” must be strengthened in order to increase security in general, so you
can improve your system security by paying attention to all points.
Cryptomining attacks decline
The Malwarebyte Labs report has seen a shift away from cryptomining starting in 5- Strong Access Control Measures:
the second quarter of 2018, due largely to the decline in cryptocurrency values. This layer of security has a great impact on establishing security in general, and
Still, the number of cryptomining detections increased for the year by 7 percent. all the actions that are taken in this layer, ultimately, are aimed at controlling
Instead, cyber criminals are turning to information stealing malware like Emotet to people's access to information, to achieve this goal, various solutions can be
turn a profit. “Overall, it seems as though criminals have reached the consensus taken, including the solution of setting passwords which are hard to be guessed,
that sometimes stealing is better than mining,” the report stated. which should include more than 8 characters, so it is hard for people to guess
this password, as a result they cannot access your information easily.
Ransomware becoming more targeted This layer of security contains the following 3 types:
Kujawa notes that small and medium-sized businesses (SMBs) are becoming · Discretionary Access Control (DAC)
more popular targets. He attributes this to the likelihood of being paid for · Managed Access Control (MAC)
ransomware attacks—SMBs often can’t afford the downtime and see paying · Role-Based Access Control (RBAC)
ransom as the fastest way to recover. They also often softer targets than larger
businesses. 6- Protect and Backup Data:
Ransomware detections actually declined by 26 percent worldwide in 2018, This layer of security helps you to have no worries about the stored information,
according to the Malwarebytes report. However, ransomware detections at and it is constantly recommended in this layer to provide backup information, so
businesses rose by 28 percent. Industries most often targeted were consulting, that in case of unexpected events, your information won’t be damaged and will
education, manufacturing and retail. Kujawa believes criminals focus on these be protected as much as possible, there are a number of ways you can get help
industries because of opportunity and likelihood of ransoms being paid. from them in order to implement this layer properly, including keeping information
in a safe place other than the current information system that helps you maintain
7 LAYERS OF SECURITY your information safe. It should be noted that it is necessary to establish the
Security is an important factor for people all over the world due to the existence security for the information from which you have made a backup.
of important information which may be stored on the computer or any other
system, so you have to provide different facilities to protect this information and 7- Monitor and Test Your Systems:
not allow others to access it, in the world of computers, security has many In this layer, you should review all the actions you have taken and examine all
details, and to understand each of them, at the beginning, you need to be fully the aspects, so that you can identify the possible dangers that threaten your
aware of the computer in general, so that you can maintain the security of your information and system, in general, the system monitoring process helps you
site better, security has 7 layers, which we will discuss in the following. solve these problems and does not allow a problem to occur, which causes
damage to your system or loss of your information.
1- Information Security Policies: To implement this layer, there are various tools which will help you achieve your
One of the main layers of information security is Information Security Policies, goal, some of which we are going to mention in the following section.
which gives users the assurance that you give a value to their information and do · SolarWinds Server and Application Monitor
your best to protect them, the security plans for people who want to protect · NinjaRMM
information must be prearranged and should have a step-by-step process to · PRTG - OpManager by ManageEngine
strengthen the security of your site. · OpenNMS
In general, information security policies reflect the thoughts of the media and · WhatsUp Gold
show all their efforts to protect information, through this layer of security , · OpenNMS
information can be secured against all existing threats.

This layer of security has 3 main types that we will mention in the
following:
- Organizational (or Master) Policy
- System-specific Policy
- Issue-specific Policy
 manage who has access to the information they need in your workspace.
Manage email display
Members can find each others' email addresses in their profiles, but some people
may prefer to keep this info private. Workspace Owners and Admins can choose
if members’ email addresses are displayed in their Slack profiles.

Lesson Proper for Week 5 Workspace permissions

What Does Password Protection Mean?
workspace permissions into five categories
Password protection is a security process that protects information accessible via
computers that needs to be protected from certain users. Password protection · Object security
allows only those with an authorized password to gain access to certain · Tab visibility
information. · Browsers
· Mass operations
Password protect · Admin operations

To password protect is to implement or enable a password on a computer,

network device, online service, file, user account, or data. When password Object security
protection is enabled, users receive a prompt for a username or password before
they're given access. For example, to log in to a Microsoft Windows account, the workspace objects with their related item-level permissions. Item-level rights
user must enter the proper credentials. The same goes for a file that is password include:
protected.
· None - denies users access to the object.
If the incorrect information is entered, users can't access certain computers, · View - view the object. This is the lowest level object permission.
online services, files, or other password-protected areas. If the incorrect · Edit - edit and view the object.
password is entered multiple times, access is usually locked temporarily. Once · Delete - delete, edit, and view the object.
locked, you must wait for a set time before trying the password again or ask for · Add - add new objects. This icon turns blue when the setting is unsaved;
support to unlock the computer, account, or file. once you click Save, the blue icon becomes grey.
· Edit Security - grants users the ability to edit the security of objects.
If you can't remember the password for an online account, most services provide
a forgot password feature to help you reset it. Tab visibility
Tab Visibility lists all parent and child tabs to which you can grant groups access.
Protecting Against Malware Combine object security permissions and tab visibility access to give users the
tools they need to complete their tasks. Select a tab to make it visible for a group.
So now we're at the biggest question of all: "How do I make sure my computer or
network is malware-free?" Mass operations
In the Mass Operations section, you control which types of mass action rights the
The answer has two parts: Personal vigilance, and protective tools. One of the group can access. This section also lists any custom mass operations that you
most popular ways to spread malware is by email, which may be disguised to have added to Relativity or that are available in applications currently installed in
look as if it is from a familiar company such as a bank, or a personal email from a your environment.
friend.
Browsers
Be wary of emails that ask you to provide passwords. Or emails that seem to be In the Browsers section, you control which browsers are visible to a group. Select
from friends, but have only a message such as "check out this cool website!" a browser type to make it visible for the group.
followed by a link.
Admin operations
Personal vigilance is the first layer of protection against malware, but simply You can secure several admin operations separately. To assign permissions to a
being careful is not enough. Because business security is not perfect, even group, select checkboxes for any combination of these operations.
downloads from legitimate sites can sometimes have malware attached. Which
means that even the most prudent user is at risk, unless you take additional Physical Security
measures. Most people think about locks, bars, alarms, and uniformed guards when they
think about security. While these countermeasures are by no means the only
What is Malware Protection? precautions that need to be considered when trying to secure an information
system, they are a perfectly logical place to begin.
Malware security protection provides that second vital layer of protection for your Physical security is a vital part of any security plan and is fundamental to all
computer or network. A robust antivirus software package is the primary security efforts--without it, information security software security, user access
component of technological defenses that every personal and business computer security and network security are considerably more difficult, if not impossible, to
system should have. initiate. Physical security refers to the protection of building sites and equipment
(and all information and software contained therein) from theft, vandalism, natural
Well-designed antivirus protection has several characteristics. It checks any disaster, manmade catastrophes, and accidental damage (e.g., from electrical
newly downloaded program to ensure that it is malware-free. It periodically scans surges, extreme temperatures, and spilled coffee). It requires solid building
the computer to detect and defeat any malware that might have slipped through. construction, suitable emergency preparedness, reliable power supplies,
It is regularly updated to recognize the latest threats. adequate climate control, and appropriate protection from intruders.
Good antivirus protection can also recognize — and warn against — even Create a Secure Environment: Building and Room Construction
previously unknown malware threats, based on technical features (such as
attempting to "hide" on a computer) that are characteristic of malware. In · Don't arouse unnecessary interest in your critical facilities: A secure room
addition, robust antivirus software detects and warns against suspicious should have "low" visibility (e.g., there should not be signs in front of the building
websites, especially those that may be designed for "phishing" (a technique that and scattered throughout the hallways announcing "expensive equipment and
tricks users into entering passwords or account numbers). sensitive information this way").

Finally, malware protection needs to be usable. Effective antivirus software must · Select only those countermeasures that meet percuived needs as
be simple to download and install, so you don't need to be a Ph.D. in computer indentified during risk assessment and support security policy.
science in order to use it. Look for antivirus software solutions that have the
characteristics outlined above — and follow through by installing it. · Maximize structural protection: A secure room should have full height walls
and fireproof ceilings.
Robust malware protection specifically guards your finances. These tools
safeguard your account information, and can also provide password- · Minimize external access (doors): A secure room should only have one or
management tools so that frustration over forgotten passwords does not lead you two doors--they should be solid, fireproof, lockable, and observable by assigned
to skip over this essential component of protection. security staff. Doors to the secure room should never be propped open.

No protection is absolute. But a combination of personal awareness and well- · Minimize external access (windows): A secure room should not have
designed protective tools will make your computer as safe as it can be. excessively large windows. All windows should have locks.

Workspace security · Maintain locking devices responsibly: Locking doors and windows can be
an effective security strategy as long as appropriate authorities maintain the keys
Each group you add to a workspace can have vastly different permissions than and combinations responsibly. If there is a breach, each compromised lock
others. You can also copy an existing group’s permissions to save time on should be changed.
configuring them.
· Investigate options other than traditional keyhole locks for securing areas
Limit access to your workspace as is reasonable: Based on the findings from your risk assessment consider
alternative physical security strategies such as window bars, anti-theft cabling
Slack allows for transparency, and sometimes that means sharing proprietary (i.e., an alarm sounds when any piece of equipment is disconnected from the
information or sensitive details. Here are some tips to ensure only the right system), magnetic key cards, and motion detectors.
people have access to information in your workspace:
Recognize that some countermeasures are ideals and may not be feasible
if, for example, your organization is housed in an old building.
 Only invite people you know
For total control, keep the default setting to only let Workspace Owners and Be prepared for fire emergencies: In an ideal world, a secure room should be
Admins send invitations to new members. If you do allow others to send protected from fire by an automatic fire-fighting system. Note that water can
damage electronic equipment, so carbon dioxide systems or halogen agents are
invites, review pending and accepted invitations periodically.
recommended. If implemented, staff must be trained to use gas masks and other
protective equipment. Manual fire fighting equipment (i.e., fire extinguishers)
Deactivate members’ accounts who no longer need access should also be readily available and staff should be properly trained in their use.
Change is constant, and people come and go. Don’t forget to deactivate a Maintain a reasonable climate within the room: A good rule of thumb is that if
member’s account when they leave. Workspace Owners on the Business+ and people are comfortable, then equipment is usually comfortable--but even if
Enterprise Grid plans can streamline deactivation with an identity provider people have gone home for the night, room temperature and humidity cannot be
using SCIM provisioning. allowed to reach extremes (i.e., it should be kept between 50 and 80 degrees
Add people from other companies to a channel Fahrenheit and 20 and 80 percent humidity). Note that it's not freezing
To work with external partners who don’t need access to all the information in temperatures that damage disks, but the condensation that forms when they
your workspace, you can use Slack Connect to invite them to channels. This lets thaw out.
you collaborate securely and productively in one centralized place, all from your Be particularly careful with non-essential materials in a secure computer
own workspaces. room: Technically, this guideline should read "no eating, drinking, or smoking
Use guest accounts and limit the channels they're invited to near computers," but it is quite probably impossible to convince staff to
Some members of your Slack workspace (like contractors, interns, or clients) implement such a regulation. Other non-essential materials that can cause
may only need access to certain channels. Guest accounts are a great way to problems in a secure environment and, therefore, should be eliminated include
curtains, reams of paper, and other flammables.
Guard Equipment: Protect Output:

Keep critical systems separate from general systems: Prioritize equipment Keep photocopiers, fax machines, and scanners in public view: These types of
based on its criticality and its role in processing sensitive information. Store it in equipment are very powerful tools for disseminating information--so powerful, in
secured areas based on those priorities. fact, that their use must be monitored.
House computer equipment wisely: Equipment should not be able to be seen or
reached from window and door openings, nor should it be housed near radiators, Assign printers to users with similar security clearances: You don't want
heating vents, air conditioners, or other duct work. Workstations that do not employees looking at sensitive financial information (e.g., staff salaries) or
routinely display sensitive information should always be stored in open, visible confidential student information (e.g., individual records) while they are waiting
spaces to prevent covert use. for their documents to print. It is better to dedicate a printer to the Director of
Protect cabling, plugs, and other wires from foot traffic: Tripping over loose wires Finance than to have sensitive data scattered around a general use printer. Don't
is dangerous to both personnel and equipment. hesitate to put printers in locked rooms if that is what the situation demands.
Keep a record of your equipment: Maintain up-to-date logs of equipment
manufacturers, models, and serial numbers in a secure location. Be sure to Label printed information appropriately: Confidential printouts should be clearly
include a list of all attached peripheral equipment. Consider videotaping the identified as such.
equipment (including close-up shots) as well. Such clear evidence of ownership
can be helpful when dealing with insurance companies. Demand suitable security procedures of common carriers when
Maintain and repair equipment: Have plans in place for emergency repair of shipping/receiving confidential information: Mail, delivery, messenger, and courier
critical equipment. Either have a technician who is trained to do repairs on staff or services should be required to meet your organization's security standards when
make arrangements with someone who has ready access to the site when repair handling your confidential information.
work is needed. If funds allow, consider setting up maintenance contracts for
your critical equipment. Local computer suppliers often offer service contracts for Dispose of confidential waste adequately: Print copies of confidential information
equipment they sell, and many workstation and mainframe vendors also provide should not be placed in common dumpsters unless shredded.
such services. Once you've set up the contract, be sure that contact information
is kept readily available. Technical support telephone numbers, maintenance Electronic Mail Policy
contract numbers, customer identification numbers, equipment serial numbers,
User Responsibilities
and mail-in information should be posted or kept in a log book near the system
for easy reference. Remember that computer repair technicians may be in a
These guidelines are intended to help you make the best use of the electronic
position to access your confidential information, so make sure that they know
mail facilities at your disposal. You should understand the following:
and follow your policies regarding outside employees and contractors who
access your system.
The agency provides electronic mail to staff to enable them to communicate
effectively and efficiently with other members of staff, other companies, and
partner organizations.
Rebuff Theft:
When using the agency's electronic mail facilities you should comply with the
Identify your equipment as yours in an overt way: Mark your equipment in an
following guidelines.
obvious, permanent, and easily identifiable way. Use bright (even fluorescent)
paint on keyboards, monitor backs and sides, and computer bodies. It may
If you are in any doubt about an issue affecting the use of electronic mail, you
decrease the resale value of the components, but thieves cannot remove these
should consult the IT Services Manager.
types of identifiers as easily as they can adhesive labels.
Any breach of the agency's Electronic Mail Policy may lead to disciplinary action.
Losing a computer to theft has both financial costs (the replacement value
of the equipment) and information costs (the files contained on the hard DO
drive).
Do check your electronic mail daily to see if you have any messages.
Identify your equipment as yours in a covert way: Label the inside of equipment Do include a meaningful subject line in your message.
with the organization's name and contact information to serve as powerful Do check the address line before sending a message and check you are
evidence of ownership. sending it to the right person.
Do delete electronic mail messages when they are no longer required.
Make unauthorized tampering with equipment difficult: Replace regular body
Do respect the legal protections to data and software provided by copyright
case screws with Allen-type screws or comparable devices that require a special
and licenses.
tool (e.g., an Allen wrench) to open them.
Do take care not to express views that could be regarded as defamatory or
libelous.
Limit and monitor access to equipment areas: Keep an up-to-date list of
Do use an "out of the office assistant" to automatically reply to messages
personnel authorized to access sensitive areas. Never allow equipment to be
when you are not available.
moved or serviced unless the task is pre-authorized and the service personnel
DO NOT
can produce an authentic work order and verify who they are. Require picture or
other forms of identification if necessary. Logs of all such activity should be
Do not print electronic mail messages unless absolutely necessary.
maintained. Staff should be trained to always err on the cautious side (and the
Do not expect an immediate reply; the recipient might not be at their computer
organization must support such caution even when it proves to be inconvenient).
or could be too busy to reply straight away.
Do not forward electronic mail messages sent to you personally to others,
Laptops and other expensive equipment that leave the office often never
particularly newsgroups or mailing lists, without the permission of the
return.
originator.
something you should do (icon) Do not use electronic mail for personal reasons.
Do not send excessively large electronic mail messages or attachments.
Attend to Portable Equipment and Computers: Do not send unnecessary messages such as festive greetings or other
nonwork items by electronic mail, particularly to several people.
· Never leave a laptop computer unattended: Small, expensive things often Do not participate in chain or pyramid messages or similar schemes. Do not
disappear very quickly--even more quickly from public places and vehicles! represent yourself as another person.
Do not use electronic mail to send or forward material that could be construed
Store laptop computers wisely: Secure laptops in a hotel safe rather than a hotel as confidential, political, obscene, threatening, offensive, or libelous.
room, in a hotel room rather than a car, and in a car trunk rather than the back
seat. Network Security
Stow laptop computers appropriately: Just because a car trunk is safer than its
back seat doesn't mean that the laptop won't be damaged by an unsecured tire Network security, especially as it relates to the biggest network of all, the
jack. Even if the machine isn't stolen, it can be ruined all the same. Stow the Internet, has emerged as one of today's highest-profile information security
laptop and its battery safely! issues. Many education organizations have already connected their computing
Don't leave a laptop computer in a car trunk overnight or for long periods of resources into a single network; others are in the process of doing so. The next
time: In cold weather, condensation can form and damage the machine. In warm step for these organizations is to weigh the costs and benefits of opening a
weather, high temperatures (amplified by the confined space) can also connection between their private networks (with their trusted users) and the
damage hard drives. unknown users and networks that compose the Internet.

Policy Issues
Regulate Power Supplies:
Connecting to the Internet doesn't necessarily raise its own security policy issues
· Be prepared for fluctuations in the electrical power supply: as much as it focuses attention on the necessity of implementing security
strategies properly. Internet security goals fall within two major domains. The first
Do so by (1) plugging all electrical equipment into surge suppressors or electrical centers around protecting your networks, information, and other assets from
power filters; outside users who enter your network from the Internet. The second deals with
safeguarding information as it is being transmitted over the Internet.
and (2) using Uninterruptible Power Sources (UPSs) to serve as auxiliary
electrical supplies to critical equipment in the event of power outages Protect Your Network from Outsiders:

Pay attention to the manufacturer's recommendations for storing portable Implement applicable security recommendations as raised in previous
computer batteries--they carry live charges and are capable of igniting fires if not chapters: Solid defense against external Internet threats includes the proper
handled properly. implementation of relatively straightforward security measures
like encryption software, virus scanners , remote access regulations,
· Protect power supplies from environmental threats: Consider having a and passwords.
professional electrician design or redesign your electrical system to better Isolate your network through the use of a firewall: Installing a firewall enables
withstand fires, floods, and other disasters. the organization to decide which types of messages should be allowed into
the system from external sources (e.g., "nothing with identifiable virus coding"
· Select outlet use carefully: Although little thought generally goes into and "nothing with decryptor coding structures"). The actual installation and
plugging equipment into an outlet, machines that draw heavily from a power operation of the complex features requires expert technical assistance, but
source can affect, and be affected by, smaller equipment that draws energy from policy-makers can make informed decisions about product features all the same.
the same outlet. Locate equipment and information that is intended for external users outside of
the firewall: If an organization's Web server is intended to provide information
· Guard against the negative effects of static electricity in the office place: and services to the public, it should not be located on the private side of the
Install anti-static carpeting and anti-static pads, use anti-static sprays, and firewall. Nor should it be able to access confidential information that resides
encourage staff to refrain from touching metal and other static-causing agents inside the firewall. This way, if the public Web server should ever be
before using computer equipment. compromised, confidential information is still protected.
Protect Transmissions Sent over the Internet:

Use Secure Sockets Layer (SSL) Servers to secure financial and information
transactions made with a Web browser: In a secure Web session, your Web
browser generates a random encryption key and sends it to the Web site host to
be matched with its public encryption key. Your browser and the Web site then
encrypt and decrypt all transmissions.
Authenticate messages through the use of digital signatures: A digital
signature amounts to a "fingerprint" of a message. It depicts the message such
that if the message were to be altered in any way, the "fingerprint" would reflect
it--thus making it possible to detect counterfeits. The converse, of course, is that
if the "fingerprint" does not change during transmission, you can be confident that
the message was not altered.
Authenticate messages through the use of time stamps or sequence
numbers: Another way to recognize when messages have been modified is to
challenge the "freshness" of the message. This is done by embedding time
stamps, sequence numbers, or random numbers in the message to indicate
precisely when and in what order the message was sent. If a received message's
time and sequence are not consistent, you will be alerted that someone may
have tampered with the transmission.
Authenticate message "receivers" through the use of digital certificates: By
requiring an authentication agent or digital certificate, you force the person on the
other end of the transmission to prove his or her identity. In the digital world,
trusted third parties can serve as certificate authorities--entities that verify who
a user is for you. In this way, digital certificates are analogous to a state-issued
driver's license. If you trust the party that issues the certificate (e.g., the state or
the certificate authority), then you don't need to try to verify who the user is
yourself.
Encrypt all messages sent over the Internet: As more and more messages are
sent over larger and larger networks, information becomes increasingly
vulnerable to assault. Encryption has become a leading tool to combat
this vulnerability. Like other countermeasures, it can be very effective if used
properly and regularly