Cyber-security as a field is concerned with protecting digital assets. It may conjure to mind dark rooms and hackers and hoaky 90s CGI imaginations of what the inside of a mainframe looks like ala Tron. In reality Cyber-security has a lot more to do do with the security half of its name rather than the the cyber half. Any digital asset (data bases, web-servers, secret files, etc) still has to exist physically on a computer somewhere and that somewhere has to be physically secure in order for anything on the machine to be secure. The need to be physically secure means that conventional security practices are still relevant when considering digital security, it’s just that when an asset is digital it exists as information that can be transmitted over the internet, so there’s additional aveneues of access we need to control.

some core vocabulary

Let’s now take the time to establish some precise vocabulary used within cybersecurity. This whole time I’ve been using the word “secure” but what exactly does that mean? There a few definitions of differing level of detail, but the most common definition you’ll see makes use of something called the CIA triad, an acronym that covers the three main attributes of security. We consider information secure only when it meets all 3 attributes:

• Confidentiality: Private information is kept private. If we have someone’s credit card number, we want tp ensure that information isn’t learned by the public or a third party. Risk factors include data leaks like heart-bleed, intentional espionage, and accidentally publishing internal documents.
• Integrity: All information we have is correct. Potential risk factors include random data corruption as well as intentional altering of records.
• Accessibility: We can always access our information when we need it. We can stop anyone from extracting the data on a usb stick by destroying the usb stick. But, that doesn’t mean we’ve secured the information, since now we can’t access it either. Risk factors include natural disasters shutting down our server, and ransom-ware encrypting our data.

In providing the examples above, I’ve introduced a new piece of vernacular: a risk factor is any event that could compromise the security of our digital asset, from hackers,to natural disasters, or a trusted member of the organization unintentionally deleting or sharing information.

We create assurance of security by implementing what we call security controls. Controls are any policy or infrastructure we use to mitigate risk factors. Some examples include:

• badging into a building (by preventing 3rd parties from entering a space we enforce confidentiality)
• duplicating data (by creating back-ups we protect accessibility in the case of a server shut-down)
• keeping change logs (we can undo any incorrect changes to re-establish integrity).

(as an aside: notice how we can usually sort controls by how they affect one or more of the items in the CIA triad)

Controls can be divided into preventative and reactive controls. Preventative controls look to prevent a security risk from happening. Reactive controls look to detect, record, and undo a security risk after it’s happened. In general we need a blend of both since prevention is good, but if we cannot detect and recover from a security breach, then we cannot trust our information’s integrity.

Other terms of art include:

adversary

a malicious third party actively trying to breach your security, usually used to refer to an imagined person for the sake of thinking through risk factors than an actual real life individual.

asset

anything we’re trying to protect. In cyber-security, that generally means a digital asset or information asset.

malware

portmanteu of malicious software, this refers to software designed to steal information or compromise the integrity of your system

Encryption

is a way of encoding your data so that only someone who has the key can decode it. Think of it sort of like a more advanced caesar cipher.

Phishing

this is an attack that doesn’t necessarily rely on technology, instead it involves tricking someone into providing confidential information, usually by posing as someone with authority.

an example might be if someone were to send an email pretending to be the ceo saying “Hey, I forgot my password, can you please reset and send me the new one?”

Exploits and vulnerabilities

these are bugs, loopholes, or (un)intended behavior in software that an adversary can use to compromise the security of information.

A famous example is the Heartbleed exploit in OpenSSL which allowed someone to gain access to confidential information by sending a request for data they were allowed to access, but asking for more information than was actually available. For example: a server stores a bunch of user’s email address, password, and username. If I make a request to see my own email but I tell the server that my email is actually 500 characters long, the server starts reading its files at my email but then keeps reading and crosses into another user’s email and password until it gets to 500 characters, then it sends me back my email address and someone else’s email and password too.

risk

understanding what can go wrong, and how likely it is, is the first step of security. Technically we can implement security controls without thinking through what could happen, but that’s a good way to end up spending a lot of effort somewhere it’s not needed. Instead, we can do a risk assessment and build up a risk profile of risk factors relevant to our asset, the probability of those risks and the magnitude of consequences should those risk factors occur. We can then use our risk profile to decide on our risk management strategy and security controls. Thankfully, we don’t need to spend all day catastrophizing and thinking up all the ways thing can go wrfile:///home/aspen/Documents/osf/cybersec mindset/Slides-NTEN_Building Your Security Mindset.pdf file:///home/aspen/Documents/osf/cybersec mindset/NTEN Course Transcript - Build a cybersecurity mindset.pdf ong all on our own. There are wonderful organizations that have put together risk catalogues or risk registers: compendiums of potential risks for us to peruse and think through.

Risk management strategies can be catagorized as follows

• risk modification (reducing probability)
• risk mitigation (reducing the potential damage)
• risk acceptance (the risk will just happen, oh well, it’s not worth fixing)
• risk sharing/distribution (like an insurance plan that pays out, or subcontracting out)
• risk avoidance (simply cut off the risk bearing part and stop doing it), used when the asset is low value but high damage.

note that without proper security practices we’re living with risk acceptance by default.

Example

Imagine we are a small org with lots of field workers, called CommunityCheck. Those workers go out to talk to multiple constituents a day and bring with them a clipboard of information from the org as well as any notes they take in the field. One potential risk factor is that, if they keep all their notes on the clipboard uncovered, they might accidentally show a constituent’s private information to someone else while just walking around.

We could try to avoid the risk completely by either ceasing field work or preventing field workers from bringing any information with them. If field-work isn’t very important to our org that might be worth doing. We could also share risk, ceasing our own field work but contracting it out to another organization. But given we have so many field workers, lets say field-work is essential enough that we have to keep doing it ourselves.

We could modify risk by providing field workers with opaque binders, so that no information is visible until they open the binder while talking to a constituent. We could mitigate the risk by creating policies around what information can be brought into the field and how many constituent’s information a field worker can have on hand at once, so that if an exposure happens the information at risk is less of a privacy violation and less constituents are affected.

People, process, policy, technology

Information security lies at the intersection of the people in your organizations handling the information, the way they carry out their work (process), what the organization’s expectations and policies are, and the technology an organization uses to work with and store its information assets.

People are the bedrock, they are the ones who set up the technology, agree to the policies, and create processes. By making sure the people are aware of cyber-security concepts and risk factors we get improvements everywhere else too. If the people have security on their mind, they’re more like to notice if something is wrong and flag it to an internal expert or relevant external service provider. They are also less likely to fall for phishing attacks or other tricks.

That said, we cannot rely on people alone. People are statistically faulty and we are headed towards a data breach if we hang everything on personal responsibility. Even the most aware, most vigilant person will eventually miss something, be tired, forget a specific policy, take shortcuts, etc, and, when that happens, there must be other safety measures to back them up. That’s why we set policies and design processes to give them the best chance for success and use technology to remove burden from them.

For example: We might design our onboarding process to include relevant security training: use a password manager, keep sensitive information out of eye shot. Then, set policies to guide people when things go wrong: if you receive a suspicious email, forward it to “it@organization.com” with the subject line “PHISHING?” and the date. Cycle passwords every 2 months. And, use technology to take away the executive burden by maybe setting up a tool that automatically asks people to set a new password every 2 months rather than forcing them to remember.

Some common advice

Some common best practices to help keep our assets secure include:

• security controls need to be simple enough that they can be easily audited and verified.
• rely on positively identifying benevolent actors. Adversaries can always pick a new unrecognized strategy, so trying to identify and exclude malicious behavior is a losing game.
• security through obscurity/secrecy is not security at all. (someone will stumble onto your hidden asset eventually)
• principle of least privilege: every individual should only have the bare minimum security clearance in order to do their job.
• usability: if a security control is too much of a hassle, the people who are meant to use it won’t.
• Change any passwords away from the default password immediately, also make sure any password is unique enough that it can’t be guessed. Often times, malicious actors don’t have a specific target they just have automated bots trying common passwords in as many places as possible to see if it works. You lock your door not because you’re a target for robbery but to stop anyone who might come and try the door just to see.
• keep software up to date. When a piece of software has an exploit, the provider will issue a patch to fix it, but anyone watching the fixes now knows about the exploit and will go looking for someone who hasn’t installed the patch yet to use it on.
• Segment your access privileges/network, think of it like a firebreak, design technology so if something fails it cant cascade to the whole system.
• Make sure you’re not providing enough information publically that you’re easy to phish or hack.

fun example

It is a bad idea to go on Linked-in and say

“today my mother, Anne Gableson (born Anne Barclay) told me she’s selling our childhood home at 4175 East drive. I have so many childhood memories there that I’ll miss: playing with my bichon frise, Snowy (adopted 2/12/99, died 8/27/07), and watching my favorite movies, Star Wars: Return of The Jedi, and Tarzan. I even got my first car while living there, a 1985 dodge pontiac, with a custom license plate ‘3XP02D’ My shop teacher Mr.Haggerty even let me use the school shop to work on it! I was so proud of that car I used it in my Neopets handle! I’ll miss the home dearly.”

see if you can spot all the bad ideas in there!