Cyber Threats:

Malware:
1) Virus - computer program that resides inside another program which seems to be
harmless
2) Worms - self sustaining computer program which replicates itself
3) Trojan Horse - computer program resides in any downloadable content
4) Ransomware - malicious code which encrypts the victim's data and threaten to pay
ransom
5) Spyware - software to gather information about a target person / org and send it
back to the attacker

Attacks:
6) Phishing - mail with malicious hyperlinks
7) DDoS - affects the availability of the systems to the legitimate users. achieved
by bombarding the host machine with false request which overload the host machine
resulting in denial of service to genuine users
8) Botnet - automated software which performs repetitive tasks, botnet is a
collection of devices which is controlled by the hacker (zombies)
9) Backdoor - way of accessing a s/w or h/w of the system w/o being detected
10) AO and IOT based attacks - hacking IOT devices ( camera etc)

Security Objectives: CIA Tirad

1) Confidentiality - Ensure that the dats remains Confidential

2) Integrity - Protection against unintended modification
3) Availability - Timely and Reliable Access to Information

Alternate way to refer CIA - Disclosure Alteration Denial (DAD)

What supports security objectives:

1) Authentication - Checking who are you?

2) Authorization - Checking what you are allowed to do
3) Accounting - Denial of action / Destroying Evidence

Asset - thing to be secured

Threat - threat to the asset
Threat Agent - who is causing the threat (attacker)
Control - controlling the threat by security measures
Vulnerability - weakness in security control
Exploit - attacker exploit through the vulnerability
Risk - Probibility of the threat & severity of damage

Layers of security control - Defense in Depth - security design strategy where

multiple levels of security control is implemented to reduce the threat
Attack Surface - refer all the points on the system through which an attacker can
attempt intrusion
Attack Vectors - methods or techniques used by the attacker to intrude in the
system (stealth entry, Bribe Insider)

Layers of Cyber Security

High level attack surface for an enterprise

Human
Application Software
Hosts
Network
Information

Information:
Who/What makes this layer
->Electronic information
-> Information in physical form
-> Data in transit

Risk:
-> Leak
-> Tampering
-> Delete

Security Controls
-> Device Encryption (eg: Bitlocker)
-> Communication Encryption (eg: SSL/TLS)

Network
Who/What makes this layer
Domain Network
Network Devices

Risk
-> Intruison
-> denial of SErvice

Security Controls
-> Firewall
-> IDS/IPS
-> DDos scrubbing service

Hosts
Who/What makes this layer
-> Desktop/Laptops/DEvices
-> OS,VM
-> System software, container

Risk
-> Social Engineering
-> Phishing
-> Unnecessary Access

Security Controls
-> Training Awareness
-> Background verification

Human
Who/What makes this layer
-> Employee
-> Customer
-> Contractors

Risk
-> Social Engineering
-> Phishing
-> Unnecessary access

Security Control
-> Training and Awareness
-> Background Verification