Cybersecurity Awareness Basics - Intro to Security Terminology — Transcript

Full transcript

1. 0:01Hello, my name is Paul Rogers, founder
2. 0:03of DPO Solutions, and I'll be your
3. 0:06certified cyber security trainer for
4. 0:08this five-part security awareness
5. 0:10training course. This is the first part
6. 0:12of our course, and it covers basic
7. 0:14security terminology, which will help
8. 0:16beginners better understand the topics
9. 0:18covered in subsequent videos, will also
10. 0:21help them to understand information
11. 0:22security in a short space of time. So
12. 0:25let's move ahead to the next slide where
13. 0:27we'll cover the index and the different
14. 0:29parts of this course.
15. 0:32So here is our index for this video
16. 0:35which shows us the highle topics we'll
17. 0:37be covering over the next few minutes.
18. 0:39So first off we ask the questions what
19. 0:41is cyber crime and what is cyber
20. 0:43security. Then we ask what is a threat?
21. 0:46What's a vulnerability and what do we
22. 0:48mean by a cyber risk? We then ask about
23. 0:51what are some cyber security law
24. 0:52examples. We'll then close off with a
25. 0:55module refresher for all these topics so
26. 0:58you'll be ready for the next training
27. 0:59videos.
28. 1:01So what is a cyber crime? Well, cyber
29. 1:04crime is best defined as a criminal
30. 1:06activity involving computers, network
31. 1:09devices or networks. Cyber crime is
32. 1:12often seen as an umbrella term for
33. 1:13hacking, online fraud and cases where
34. 1:16computers are used to steal money and
35. 1:18information.
36. 1:19How do cyber criminals operate? Cyber
37. 1:22criminals can operate as individuals,
38. 1:24but more commonly as cyber crime gangs
39. 1:26who are often based in other countries.
40. 1:29They often use specialist tools to hack
41. 1:31into networks and hide their online
42. 1:33identity with software programs so that
43. 1:35they can evade detection. It's also
44. 1:38worth noting that in some countries such
45. 1:39as Russia and China, cyber criminals
46. 1:42operate with little fear of arrest as
47. 1:44the authorities overlook their
48. 1:45activities as the states themselves may
49. 1:47be financially benefiting from the cyber
50. 1:50crime proceeds themselves.
51. 1:54So what is cyber security? Well, cyber
52. 1:57security is the practice of protecting
53. 1:59network hardware, software and data from
54. 2:02cyber criminals. It relies on people,
55. 2:04processes and technology to ensure that
56. 2:07it works effectively and its success is
57. 2:09measured on how much risk is reduced.
58. 2:12Why is this important? Well, security is
59. 2:14the most important element needed in
60. 2:16protecting data and systems from harm.
61. 2:18Without it, business and personal data
62. 2:20could be stolen or destroyed. Businesses
63. 2:23have faced large fines for careless loss
64. 2:26of data to hackers and have in some
65. 2:28cases ceased operations because of
66. 2:31business interruption caused by viruses
67. 2:33and ransomware.
68. 2:35Other definitions of security exist such
69. 2:38as CIA which is short for
70. 2:40confidentiality integrity and available
71. 2:42availability of data. This term
72. 2:45underpins all activities related to
73. 2:47security technology, people and
74. 2:49processes and you'll see it mentioned in
75. 2:51most security frameworks and training
76. 2:53courses.
77. 2:56So what is a threat in cyber security? A
78. 3:00threat is a malicious act that can
79. 3:01destroy or damage data and is made
80. 3:04possible by the presence of a
81. 3:05vulnerability. Examples of threats are
82. 3:08shown here in the right hand column.
83. 3:10Number one at top of the list is
84. 3:12ransomware which is a type of attack
85. 3:14where cyber criminals take over control
86. 3:16of your data using malware and demanding
87. 3:19a ransom usually in the form of crypto
88. 3:21to re regain access.
89. 3:24Next, a threat could be like fishing
90. 3:26which is uh usually a deceptive email
91. 3:29which usually encourages the user to
92. 3:31click on a malicious link, a common
93. 3:33method for stealing information or
94. 3:35downloading viruses and ransomware.
95. 3:38and then a virus which is a malicious
96. 3:41software which spreads across networks
97. 3:43and steals and damages data. There are
98. 3:47there are in fact hundreds of threats to
99. 3:48IT systems which are too many to list
100. 3:50here. Ransomware and fishing perhaps get
101. 3:53the most attention today as they are
102. 3:55very common and can do a severe amount
103. 3:57of damage to our data. Did you know that
104. 4:00there are over 600 million recorded
105. 4:02ransomware attacks worldwide last year?
106. 4:08What is a vulnerability? A vulnerability
107. 4:11is a weakness or flaw in an information
108. 4:13system, security procedures, or internal
109. 4:16controls that could be exploited or
110. 4:18triggered by a threat source. Examples
111. 4:21are shown here on the right. One would
112. 4:23be weak passwords. So, login passwords
113. 4:26which are short or easy to guess like
114. 4:28someone's name may allow attackers to
115. 4:30log in more easily to your system or
116. 4:33applications.
117. 4:34outof-date patches. Security updates for
118. 4:37Windows, Office, and other applications
119. 4:39need to be kept up to date. This is
120. 4:41because attackers continually update
121. 4:43their techniques. And then third, lack
122. 4:46of security cameras, which may allow
123. 4:49physical access to sensitive areas like
124. 4:51data centers, payroll systems, etc.
125. 4:53without detection.
126. 4:55Cyber vulnerabilities can range into the
127. 4:57thousands. Hackers often look for the
128. 5:00human weak link when exploiting
129. 5:01vulnerabilities. things like weak
130. 5:03passwords, unpatched systems that we
131. 5:05mentioned here, but also data that might
132. 5:08be found on external storage devices
133. 5:11which will always be a target for cyber
134. 5:12criminals who may be opportunistic.
135. 5:17So what is a cyber risk? A cyber risk
136. 5:20commonly refers to any financial loss,
137. 5:23disruption or damage to the reputation
138. 5:25of an organization resulting from the
139. 5:27failure of its information technology
140. 5:29systems. Examples shown here are weak
141. 5:32password risk. This would be a high risk
142. 5:35to data if passwords were generally weak
143. 5:38throughout the organization. Another
144. 5:40risk would be for patches that are out
145. 5:42of date. This could be a high risk to
146. 5:44data on a customer database server, for
147. 5:46example, if it were far behind on its
148. 5:48patches. And then three would be a lack
149. 5:52of security camera uh coverage. There
150. 5:54could be a medium to high risk that an
151. 5:56intruder could access areas with
152. 5:58sensitive data without the necessary
153. 6:00CCTV coverage.
154. 6:03Risk can often be compared to the
155. 6:04likelihood and impact of a vulnerability
156. 6:07being actually exploited. So if you set
157. 6:10a weak password on your PC, for example,
158. 6:12the risk is higher that an attacker can
159. 6:15log in, steal your data, or launch a
160. 6:17virus on your network, which could have
161. 6:19a severe impact on IT systems.
162. 6:24So in this slide we take a look at some
163. 6:26sample cyber security laws. So most
164. 6:29countries have some form of a law which
165. 6:31covers hacking activity and data
166. 6:33protection which will be covered later
167. 6:35in the US. But a federal law called a
168. 6:38computer fraud and abuse act the CFAA
169. 6:41covers this. While in the UK the
170. 6:43computer misuse of act of 1990 are some
171. 6:46examples.
172. 6:48So the CPPA in the US dates back to 1986
173. 6:52but is used regularly in civil and
174. 6:54criminal cases where US systems have
175. 6:56been compromised. So crimes committed
176. 6:59outside the US are also covered by this
177. 7:01act. While in the UK the CMA act similar
178. 7:05is similar to the US law but the UK
179. 7:08misuse act aims to hold hackers to
180. 7:10account in and outside the UK. Sentences
181. 7:13can range up to 10 years with unlimited
182. 7:16fines. It's worth noting that around 85%
183. 7:19of countries have some form of cyber law
184. 7:22in their statutes. The UN is in the
185. 7:25process of negotiating an international
186. 7:27cyber crime treaty to further enhance
187. 7:29the laws.
188. 7:32So, we've reached the end of our
189. 7:34introduction module. You can pause this
190. 7:36video to take a look at some of the
191. 7:38definitions we covered in the previous
192. 7:39slide. The next training video will
193. 7:42focus on fishing and internet security,
194. 7:44which are perhaps the most important
195. 7:46areas to cover in this course. We'll see
196. 7:48you there.