How To Get Cybersecurity Fundamentals Mastered Essentially

Foundational Concepts of Cybersecurity

The CIA Triad represents three interdependent security goals that must be balanced to achieve comprehensive protection. Confidentiality ensures that sensitive information is accessible only to authorized entities, integrity guarantees that data remains unaltered and trustworthy, and availability ensures systems and services are operational when needed. Below, a structured breakdown of each principle includes examples of breaches that violated them, illustrating the tangible impact of security failures.

CIA Triad: Confidentiality, Integrity, and Availability

"Confidentiality ensures that data is accessible only to those authorized to have access. Integrity ensures that data is accurate and consistent over its lifecycle. Availability ensures that authorized users have timely and reliable access to data."

Integrity ensures data remains accurate and unaltered. Attacks targeting integrity include man-in-the-middle (MITM) attacks, where adversaries intercept and modify communications between parties. The 2016 SWIFT hack, where attackers altered transaction records to steal $81 million from the Bangladesh Bank, exemplifies how compromised integrity leads to financial fraud.

Availability guarantees that systems and services operate without interruption. Distributed Denial-of-Service (DDoS) attacks are a common method to disrupt availability, overwhelming systems with traffic to render them inaccessible. The 2016 Mirai botnet attack targeted DNS provider Dyn, causing widespread outages for major websites like Twitter, Netflix, and Reddit, demonstrating the real-world consequences of availability failures.

Comparison of Traditional vs. Modern Cybersecurity Approaches

Cybersecurity Kill Chain: Attacker Methodology and Exploitation Phases

"The kill chain consists of seven phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives."

2. Weaponization
Attackers develop malicious payloads (e.g., malware, phishing emails) tailored to exploit identified weaknesses. In the 2017 NotPetya attack, a weaponized ransomware was disguised as legitimate software to evade detection.

3. Delivery
The payload is delivered to the target via phishing emails, malicious downloads, or compromised websites. The 2013 Target breach involved attackers gaining access through a vendor’s credentials, which were delivered via a phishing email.

4. Exploitation
Attackers exploit vulnerabilities in software or human behavior to gain access. The 2017 WannaCry ransomware exploited the EternalBlue vulnerability in unpatched Windows systems to spread globally.

5. Installation
Malware or backdoors are installed to maintain persistence within the network. In the 2014 Sony Pictures hack, attackers deployed custom malware to exfiltrate data and disrupt operations.

6. Command and Control (C2)
Attackers establish a communication channel to control compromised systems remotely. The 2021 Colonial Pipeline ransomware attack used C2 servers to encrypt systems and demand a ransom.

7. Actions on Objectives
The final phase involves achieving the attacker’s goal, such as data theft, sabotage, or financial gain. The 2016 Yahoo breach resulted in the theft of 3 billion user accounts, one of the largest data breaches in history.

Mitigating the kill chain requires defense-in-depth strategies, including network segmentation, endpoint detection, and employee training to disrupt attacker progress at any stage.

Risk Management in Cybersecurity: Frameworks and Key Components

Risk management begins with risk identification, where potential threats and vulnerabilities are cataloged. This is followed by risk assessment, which evaluates the likelihood and impact of identified risks. The NIST RMF categorizes risks into three levels: low, moderate, and high, based on their potential impact on mission, operations, assets, or individuals.

"Risk management is an iterative process that involves continuous monitoring, analysis, and adaptation to evolving threats."

- Risk Identification
Systematic discovery of threats, vulnerabilities, and potential impacts. Techniques include asset inventory, threat modeling, and vulnerability scanning. For example, identifying unpatched software as a vulnerability during a penetration test.

- Risk Assessment
Quantitative or qualitative evaluation of risk severity. The NIST RMF uses a risk assessment matrix to prioritize risks based on probability and impact. ISO 27005 employs risk analysis techniques such as SWOT (Strengths, Weaknesses, Opportunities, Threats) and risk matrices.

- Risk Mitigation
Implementation of controls to reduce risk to an acceptable level. Mitigation strategies include:

ACCEPTABLE USE POLICY (AUP)

Version: [X.X]

Effective Date: [DD/MM/YYYY]
1. Purpose

   This policy outlines the acceptable use of [Organization Name]’s information technology (IT) resources, including devices, networks, and software, to ensure security, productivity, and compliance with laws.
2. Scope

   Applies to all employees, contractors, and third parties with access to organizational IT systems.
3. Definitions

Authorized User: An individual granted access to IT resources.
Sensitive Data: Information classified as confidential or regulated (e.g., PII, financial records).
4. Policy Statements

   4.1 Prohibited Activities

Unauthorized access, modification, or disclosure of data.
Installation of unauthorized software or hardware.
Use of IT resources for illegal, harmful, or unethical purposes (e.g., piracy, harassment).
4.2 Permitted Use

IT resources must be used for business purposes only.
Personal use is restricted to non-business hours and must not impair system performance.
4.3 Security Requirements

Multi-factor authentication (MFA) is mandatory for all accounts.
Reports of security incidents must be submitted via [Incident Reporting Portal] within 24 hours.
5. Roles and Responsibilities

Employees: Comply with this policy and report violations.
IT Department: Monitor compliance, enforce policies, and provide training.
Executives: Ensure policy alignment with organizational goals and legal requirements.
6. Enforcement and Compliance

Violations may result in disciplinary action, up to and including termination.
Non-compliance with regulatory requirements may lead to legal penalties.
Audits will be conducted annually to verify adherence.
7. Review and Updates

   This policy will be reviewed biennially or as needed to reflect changes in technology and regulations.