Cybersecurity
Download as PPTX, PDF3 likes1,971 views
The document discusses cybersecurity concepts including encryption, authentication, digital signatures, and penetration testing. It defines cybersecurity as protecting computer systems from threats. Encryption converts data into cipher text for protection. Authentication verifies identities through methods like passwords, certificates, and biometrics. Digital signatures mathematically verify the authenticity and integrity of messages. Penetration testing involves simulated cyber attacks to evaluate security. The document outlines security best practices and roles of security operations centers in monitoring for threats.
Cybersecurity
- 2. Speaker: Dr Eng Hasan Shamroukh
- 4. Cybersecurity It is the protection of computer systems and networks from information disclosure, theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide
- 5. Cybersecurity Significance 1- Due to the continuously expanding reliance on computer systems, the Internet and wireless network standards such as Bluetooth and Wi-Fi, and due to the growth of "smart" devices, including smartphones, televisions, and the various devices that constitute the "Internet of things". 2- Cybersecurity is also one of the significant challenges in the contemporary world, due to its complexity, both in terms of political usage and technology.
- 6. Assets It is any resource owned or controlled by a business or an economic entity Assets Types: Data Assets Financial Assets
- 7. Data Types According to data importance From lower security level to higher security level
- 8. Security Triad / Security Elements
- 9. Encryption It is converting the original representation of the information (plaintext), into an alternative form known as (cipher text). Wireless Application EEA: EPS Encryption Algorithm Types Symmetric: one key used in Encryption & Decryption Asymmetric: a key used in Encryption and another in Decryption
- 11. Asymmetric Encryption Example Diffie–Hellman key exchange It is a method of securely exchanging cryptographic keys over a public channel and was one of the first public-key protocols as conceived by Ralph Merkle and named after Whitfield Diffie and Martin Hellman. It establishes a shared secret between two parties that can be used for secret communication for exchanging data over a public network. An analogy illustrates the concept of public key exchange by using colors instead of very large numbers:
- 12. Integrity It is Checking that data is not altered or modified during Tx. MAC = HMAC Authentic MAC = HMAC Not Authentic Wireless Application TKIP (Temporary Key Integrity Protocol) EIA: EPS Integrity Algorithm
- 13. Authentication Username and password Verification Protocols PAP: Password Authentication Protocol CHAP: Challenge Handshaking Authentication Protocol EAP: Extensible Authentication Protocol PEAP: Protected Extensible Authentication Protocol FEAP: Fast Extensible Authentication Protocol LEAP: Lightweight Extensible Authentication Protocol
- 14. Authentication Factor Types 1-Knowledge factors: Something the user knows (e.g., a password, partial password, pass phrase, personal identification number (PIN), challenge response (the user must answer a question or pattern), security question). 2-Ownership factors: Something the user has (e.g., wrist band, ID card, security token, implanted device, cell phone with built-in hardware token, software token, or cell phone holding a software token). 3- Inherence factors: Something the user is or does (e.g., fingerprint, retinal pattern, DNA sequence (there are assorted definitions of what is sufficient), signature, face, voice, unique bio-electric signals, or other biometric identifier).
- 15. Authentication Types According to factors used: 1- Single Factor Authentication 2- Multi Factor Authentication According to use
- 16. DoD (Defense of Depth) Onion Model: The best DoD Representation Data is the center and the most important security level It is a concept used in Information security in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system
- 17. DoD Controls Physical control Anything that physically limits or prevents access to IT systems. Fences, guards, dogs, and CCTV systems and the like. Technical controls hardware or software whose purpose is to protect systems and resources. Examples: disk encryption, File integrity software, and authentication. Hardware technical controls differ from physical controls in that they prevent access to the contents of a system, but not the physical systems themselves. Administrative controls Organization's policies and procedures. Their purpose is to ensure that there is proper guidance available in regard to security and that regulations are met. They include things such as hiring practices, data handling procedures, and security requirements.
- 18. Information security culture 1-Pre-evaluation: To identify the awareness of information security within employees and to analyze the current security policies. 2-Strategic planning: To come up with a better awareness program, clear targets need to be set. Assembling a team of skilled professionals is helpful to achieve it. 3-Operative planning: A good security culture can be established based on internal communication, management-buy-in, security awareness and a training program.
- 19. 4-Implementation: Four stages should be used to implement the information security culture. They are: A-Commitment of the management B-Communication with organizational members C-Courses for all organizational members D-Commitment of the employees 5-Post-evaluation: To assess the success of the planning and implementation, and to identify unresolved areas of concern.
- 20. Incident response planning 1-Preparation: Preparing stakeholders on the procedures for handling computer security incidents or compromises 2-Detection and analysis: Identifying and investigating suspicious activity to confirm a security incident, prioritizing the response based on impact and coordinating notification of the incident 3-Containment, eradication and recovery: Isolating affected systems to prevent escalation and limit impact, pinpointing the genesis of the incident, removing malware, affected systems and bad actors from the environment and restoring systems and data when a threat no longer remains 4-Post incident activity: Post mortem analysis of the incident, its root cause and the organization's response with the intent of improving the incident response plan and future response efforts
- 21. Digital Certificate Called also public key certificate / identity certificate It is an electronic document used to prove the ownership of a public key The certificate includes: 1- Key Information 2- Subject: Information about the identity of its owner 3- Issuer: Digital signature of an entity that has verified the certificate's contents
- 22. Public key infrastructure (PKI) It is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public- key encryption. CA: Certificate Authority RA: Registration Authority VA: Validation Authority
- 23. Digital Signature It is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient very strong reason to believe that the message was created by a known sender (authenticity), and that the message was not altered in transit (integrity) Digital Signature Schemes
- 24. Hackers Persons skilled in information technology who uses their technical knowledge to achieve a goal or overcome an obstacle, within a computerized system by non-standard means.
- 25. Penetration Testing It is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system Tools BackBox Nmap Metasploit Project Nessus
- 26. Penetration Testing Phases 1-Reconnaissance: The act of gathering important information on a target system. This information can be used to better attack the target. For example, open source search engines can be used to find data that can be used in a social engineering attack. 2-Scanning: Uses technical tools to further the attacker's knowledge of the system. For example, Nmap can be used to scan for open ports.
- 27. 3-Gaining access: Using the data gathered in the reconnaissance and scanning phases, the attacker can use a payload to exploit the targeted system. For example, Metasploit can be used to automate attacks on known vulnerabilities. 4-Maintaining access: Maintaining access requires taking the steps involved in being able to be persistently within the target environment in order to gather as much data as possible. 5-Covering tracks: The attacker must clear any trace of compromising the victim system, any type of data gathered, log events, in order to remain anonymous.
- 28. SOC (Security Operation Center) is a facility where enterprise information systems (web sites, applications, databases, data centers and servers, networks, desktops and other endpoints) are monitored, assessed, and defended.
- 29. SOC other names Security Defense Center (SDC) Security Analytics Center (SAC) Network Security Operations Center (NSOC) Security Intelligence Center Cyber Security Center Threat Defense Center, Security Intelligence and Operations Center (SIOC) Infrastructure Protection Center (IPC)
- 30. SOC Types SNOC, Security Network Operations Center ASOC, Advanced Security Operations Center GSOC, Global Security Operations Center vSOC, Virtual Security Operations Center CSOC, Cloud Security Operations Center SSOC, Smart Security Operations Center
- 31. Contact me 00962796061387 call / whatsapp / imo / telegram Email: hasannaim@yahoo.com https://www.facebook.com/DrEngHasanShamroukh https://www.linkedin.com/in/eccie https://www.slideshare.net/enghasanshamroukh https://www.youtube.com/user/enghasanccie