Introduction To Cybersecurity

Introduction
to Cybersecurity
Security is protection. Protection from

threat actors. Those who will harm,
intentionally or otherwise.
WHAT IS CYBERSECURITY?
Cybersecurity refers to the body of technologies, processes, and practices designed to
protect networks, devices, software, and data. These are protected from attack,
damage, or unauthorized access.
Cybersecurity Models form the basis for each cybersecurity implementation.
• Organizations that use firewalls as the primary means of security are based
on a perimeter security model
• Organizations that implement a variety of security mechanisms are based upon a
layered defense model
Each cybersecurity design makes key assumptions:
1. What is fully trusted, partially trusted, and what is not trusted
2. Who has access to what valued assets
The model enables governance frameworks to serve as more effective and applicable
guidance for protecting the computing environment. These are implemented as
Security Policy → Security Model → People, Process, Technology
2
Why do we need cybersecurity?
Components of information The pillars of information security:

security:
• Confidentiality
• Computer Security
• Integrity
• Data Security
• Availability
• Governance
Known as the C.I.A Triad
• Management Systems
• Network Security
• Policy
3
CYBERSECURITY GOVERNANCE
• The typical driver for cybersecurity governance remains the prevention of fraud and
abuse
• Prevention of abuse and fraud have led to increased regulations, standards, and
guidelines.
• Organizations now pay greater attention to governance, which has changed the
dynamics of information security management.
• Computer crimes & cyber attacks are on the rise, many of which are perpetrated using
social engineering techniques.
• Building security awareness into the governance structure has become essential.
• Information security professionals are faced with ever-evolving technologies. These
include sophisticated and determined cybercriminals and a blended threat landscape.
• Even those security practitioners who work in non-regulated environments are
expected to follow a common set of practices, criteria, and standards.
• An understanding of the laws, regulations, and standards that apply to the field of
information security is essential.
• The most common frameworks are the National Institute of Standards and Technology
(NIST) and International Organization for Standardization (ISO 27001 and ISO 27002).
4
CYBERSECURITY CONTROL FAMILIES
(Based on ISO 27001)
• Access Control • Physical and Environmental
Protection
• Awareness and Training
• Planning
• Audit and Accountability
• Personnel Security
• Security Assessment and
Authorization • Risk Assessment
• Configuration Management • System and Services
Acquisition
• Contingency Planning
• System and Communications
• Identification and Protection
Authentication
• System and Information
• Incident Response Integrity
• Maintenance • Program Management
• Media Protection
5
KEY INFORMATION SECURITY CONCEPTS
• Access – A subject of objects ability to use, manipulate, modify, or affect another subject or object.
• Asset – The resources that are being protected - workstation, servers, and network devices.
• Attack – A intentional or unintentional act that can damage or compromise information systems.
• Control, Safeguard, or Countermeasure – The security mechanisms, policies, or procedures that
counter attacks, reduce risk, and resolve vulnerabilities
• Exploit – A technique used to compromise a system.
• Exposure – A state of being exposed when a vulnerability exist.
• Loss – A instance of an information asset suffering damage.
• Risk – The probability of an unwanted experience such as a loss.
• Subject and Object – These people and assets in the IT infrastructure.
• Threat – The danger to an information asset.
• Vulnerability – A weakness or fault in a system or protection mechanism.
6
THE THREE DIMENTIONS OF THE CYBERSECURITY CUBE
Manage Protection
• Domains
• Internet
• Network
Three foundational principles:
• Information States
• Critical Information Characteristics
• Security Measures.
Information states include Transmission, storage, and processing.
Critical Information Characteristics include confidentiality, integrity,
and availability.
Security Measures include technology, policies and practice, and the
education, training, and awareness of people.
7
BALANCING INFORMATION SECURITY AND ACCESS
Manage Access
• Applications
• Data
• Encryption
• Network
The risk with people and information is balancing between

access to information assets, threats, and vulnerabilities.
8
SECURITY PROFESSIONALS AND THE ORGANIZATION
The Information Security Program

• Professional Training
• System Requirements
• System Design
• Implementation
• Verification
• Release
• Incident Response
Thinking about security helps to cut through the information
overload. Incorporating cybersecurity frameworks, patterns,
and best practices help to create a defense in-breath security
paradigm. A skilled workforce helps to drive cybersecurity
governance in the organization.
9
THE CYBERSECURITY KILL CHAIN
Stop The Threat

A framework that is part of the Intelligence Driven
Defense model for identification and prevention of
cyber intrusions. This model identifies what the threat
actor must complete in order to achieve their
objective.
The seven steps enhance visibility into an attack and
enrich professionals with the understanding of an
actor’s tactics, techniques, and procedures.
10
NIST CYBERSECURITY FRAMEWORK
11
IMPLEMENTING STRATEGIC CYBERSECURITY GOVERNANCE
12
CRITICAL THINKING FOR SITUATIONAL & OPERATIONAL INTELLIGENCE
Identify Protect Detect Respond Recover
Reconnaissance X
Weaponization
Delivery
Exploitation
Installation
Command &
Control
Actions on
Objectives
Deny Degrade Disrupt Deceive Destroy
13
PUTTING IT ALL TOGETHER
Basic intro to what What does the Enterprise Start working in the field
cyber security is need to do to protect itself
today via People, Process, Tech
Hands-on Enterprise: Ready to

Intro Frameworks
Tech P, P, T Start!
Learn the basics of the Learn the basics of the

CLI and how to hack NIST Cyber Security
like malicious players Framework
14
THANK YOU

Introduction To Cybersecurity

Uploaded by

Copyright:

Available Formats

Introduction To Cybersecurity

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Introduction To Cybersecurity

Uploaded by

Copyright:

Available Formats

What are the three dimensions of the cybersecurity cube?

What are the three pillars of information security?

Introduction

Security is protection. Protection from

Components of information The pillars of information security:

The risk with people and information is balancing between

The Information Security Program

Stop The Threat

Hands-on Enterprise: Ready to

Learn the basics of the Learn the basics of the

You might also like