CYBER SECURITY
EVERYTHING IN CYBERSPACE WILL BE
COVERED BY A HIERARCHY OF
COMPUTERS!
Cell
Body
Continent Home
Region Car
Building
Campus
World
Fractal Cyberspace: a network
of … networks of … platforms
Original by Gordon Bell
DATA SCALES IN UNIT
Abbreviation Unit Value Size (in bytes)
B BIT 0 or 1 1/8 of a byte
B BYTES 8 bits 1 byte
KB KILOBYTES 1,000 bytes 1,000 bytes
MB MEGABYTE 1,000² bytes 1,000,000 bytes
GB GIGABYTE 1,000³ bytes 1,000,000,000 bytes
TB TERABYTE 1,000⁴ bytes 1,000,000,000,000 bytes
PB PETABYTE 1,000⁵ bytes 1,000,000,000,000,000 bytes
EB EXABYTE 1,000⁶ bytes 1,000,000,000,000,000,000 bytes
ZB ZETTABYTE 1,000⁷ bytes 1,000,000,000,000,000,000,000 bytes
YB YOTTABYTE 1,000⁸ bytes 1,000,000,000,000,000,000,000,000
bytes
DATA IN A DAY
500 MILLION TWEETS ARE SENT
294 BILLION EMAILS ARE SENT
4 PETABYTES OF DATA CREATED ON FACEBOOK
4 TERABYTES OF DATA CREATED FROM EACH CONNECTED
CAR
65 BILLION MESSAGES SENT ON WHATSAPP/ 5 BILLION
SEARCHES MADE
BY 2025, IT’S ESTIMATED THAT 463 EXABYTES OF DATA WILL
BE CREATED EACH DAY GLOBALLY – THAT’S THE
EQUIVALENT OF 212,765,957 DVDS PER DAY!
SOME BASICS…..
RISK : A POSSIBLE EVENT WHICH COULD CAUSE A LOSS
hacking, legal aspects, financial losses
THREAT : A METHOD OF TRIGGERING A RISK EVENT THAT IS
DANGEROUS
DDoS, DoS, malware, MITM
VULNERABILITY : A WEAKNESS IN A TARGET THAT CAN
POTENTIALLY BE EXPLOITED BY A THREAT
eternal blue
EXPLOIT : A VULNERABILITY THAT HAS BEEN TRIGGERED BY A
THREAT - A RISK OF 1.0 (100%)
wannacry
COUNTER MEASURE : A WAY TO STOP A THREAT FROM
TRIGGERING A RISK EVENT
DEFENSE-IN-DEPTH : NEVER RELY ON ONE SINGLE
SECURITY MEASURE ALONE
ASSURANCE : LEVEL OF GUARANTEE THAT A SECURITY
SYSTEM WILL BEHAVE AS EXPECTED
ASSETS
• DATA/INFORMATION (AT REST, IN TRANSIT, IN USE)
• APPLICATIONS
• SYSTEMS / NETWORK
THE DILEMMA OF SECURITY
THE PROBLEM THAT WE CANNOT GET AWAY FROM IN
COMPUTER SECURITY IS THAT WE CAN ONLY HAVE
GOOD SECURITY IF EVERYONE UNDERSTANDS WHAT
SECURITY MEANS AND AGREES WITH THE NEED FOR
SECURITY.
SECURITY IS A SOCIAL PROBLEM, BECAUSE IT HAS NO
MEANING UNTIL A PERSON DEFINES WHAT IT MEANS
TO THEM.
THE HARSH REALITY IS THE FOLLOWING: IN PRACTICE,
MOST USERS HAVE LITTLE OR NO UNDERSTANDING OF
SECURITY. THIS IS OUR BIGGEST SECURITY HOLE.
SECURITY LIES IN TRUST
EVERY SECURITY PROBLEM HAS THIS QUESTION IT
NEEDS TO ANSWER FIRST: WHOM OR WHAT DO WE
TRUST?
ON OUR DAILY LIVES, WE PLACED SOME SORT OF
TECHNOLOGY BETWEEN US AND THE “THINGS” WE
DON’T TRUST. FOR EXAMPLE LOCK THE CAR, SET THE
HOUSE ALARM, GIVE CREDIT CARD NUMBER ONLY TO
THE CASHIER, ETC.
SO WE DECIDED TO TRUST SOMEBODY/SOMETHING
TO HAVE SOME SORT OF SECURITY (TRUST THE LOCK,
TRUST THE POLICE, TRUST THE CASHIER).
WE HAVE TO HAVE THE SAME SCENARIO FOR
COMPUTER & NETWORK SYSTEMS WE USE TODAY.
ACCESS V/S SECURITY
WHEN CONSIDERING SECURITY IT IS IMPORTANT TO
REALIZE THAT IT IS IMPOSSIBLE TO OBTAIN PERFECT
SECURITY. SECURITY IS NOT AN ABSOLUTE. INSTEAD
SECURITY SHOULD BE CONSIDERED A BALANCE BETWEEN
PROTECTION AND AVAILABILITY.
IT IS POSSIBLE TO HAVE UNRESTRICTED ACCESS TO A
SYSTEM, SO THAT THE SYSTEM IS AVAILABLE TO ANYONE,
ANYWHERE, ANYTIME, THROUGH ANY MEANS. HOWEVER,
THIS KIND OF RANDOM ACCESS POSES A DANGER TO THE
INTEGRITY OF INFORMATION.
ON THE OTHER HAND COMPLETE SECURITY OF AN
INFORMATION SYSTEM WOULD NOT ALLOW ANYONE
ACCESS AT ANY GIVEN TIME.
Figure 7
SECURITY ACCESS
BALANCING SECURITY AND ACCESS- TOO MUCH
SECURITY MIGHT MAKE ACCESS HARD TO GET AND
PEOPLE WILL STOP USING THE SYSTEM. ON THE OTHER
HAND, A TOO EASY ACCESS PROTOCOL, MIGHT BE A
SECURITY HOLE FOR THE NETWORK. A BALANCE MUST BE
ACHIEVED BETWEEN THOSE TWO MAJOR “PLAYERS”
THE NEED FOR SECURITY
TO PROTECT THE ORGANIZATION’S ABILITY TO
FUNCTION.
TO ENABLE THE SAFE OPERATION OF
APPLICATIONS IMPLEMENTED ON THE
ORGANIZATION’S IT SYSTEMS.
TO PROTECT THE DATA THE ORGANIZATION
COLLECTS AND USES.
TO SAFEGUARD THE TECHNOLOGY ASSETS IN USE
AT THE ORGANIZATION.
INFORMATION SECURITY
TOOLS SUCH AS POLICY, AWARENESS, TRAINING,
EDUCATION AND TECHNOLOGY ARE NECESSARY FOR
THE SUCCESSFUL APPLICATION OF INFORMATION
SECURITY.
MODEL OF INFORMATION SECURITY IS KNOWN AS
THE C.I.A. TRIANGLE
Figure 5 Hardware
Software
People
Procedures
Data
COMPONENTS OF AN INFORMATION SYSTEM
C.I.A. TRIAD
PEOPLE ARE THE BIGGEST THREAT TO INFORMATION
SECURITY!!! (WHY? – BECAUSE WE ARE THE WEAKEST
LINK)
SOCIAL ENGINEERING . IT IS A SYSTEM THAT
MANIPULATES THE ACTIONS OF PEOPLE IN ORDER TO
OBTAIN INFORMATION ABOUT A SYSTEM IN ORDER
TO OBTAIN ACCESS.
PROCEDURES ARE WRITTEN BLUEPRINTS FOR
ACCOMPLISHING A SPECIFIC TASK; STEP-BY-STEP
DESCRIPTIONS.
THE OBTAINMENT OF THE PROCEDURES BY AN
UNAUTHORIZED USER WOULD CONSTITUTE A THREAT
TO THE INTEGRITY OF THE INFORMATION.
INTERNET
Figure 6
COMPUTER AS SUBJECT OF CRIME
COMPUTER AS OBJECT OF CRIME
HACKER REMOTE SYSTEM
CYBER SECURITY
BRANCH OF COMPUTER
SECURITY RELATED TO ALL IT
EQUIPMENT'S WORKING IN
STANDALONE AND NETWORK
ENVIRONMENT.
OBJECTIVE IS TO ESTABLISH
RULES AND MEASURE TO USE
AGAINST CYBER ATTACKS.
TYPES OF CYBER SECURITY
• PHYSICAL SECURITY
• SOFTWARE SECURITY
• HARDWARE SECURITY
• NETWORK SECURITY
PHYSICAL SECURITY
ACCESSCONTROL: ONLY AUTHORIZED ACCESS TO
MACHINE/EQPTS
PC NOT TO LEAVE UN-ATTENDED IN ON CONDITION
REPAIRS IN PRESENCE OF TECHNICAL STAFF ONLY AND DO
NOT LET THEM CARRY MULTIMEDIA MOBILES WHILE IN
OFFICE
NOT TO GIVE ANY STORAGE MEDIA TO OUTSIDERS.
BLOCKING/SEALING THE USB PORT PHYSICALLY
NEVER EVER KEEP ANY OFFICIAL MATTER ON
PERSONAL COMPUTER/LAPTOP CONNECTED WITH
INTERNET.
………AND A LOT MORE
SOFTWARE SECURITY
ANTIVIRUS
– USE IT AND KEEP IT UP TO DATE.
– THOUSANDS OF NEW VIRUSES BEING GENERATED
EVERY MONTH
PASSWORD
- USE HARD-TO-GUESS PASSWORDS.
- USE THREE TIER PASSWORD SECURITY( BIOS
P/W, SYSTEM P/W, ADMIN/USER P/W, FILE AND
FOLDER P/W)
- NEVER SHARE PASSWORD EVEN WITH YOUR
COLLEAGUES.
FIREWALLS
A COMBINATION OF HARDWARE AND SOFTWARE
RESOURCES POSITIONED BETWEEN THE LOCAL
(TRUSTED) NETWORK AND AN UNTRUSTED
NETWORK.
TO PROTECT THE COMPUTERS FROM INTERNET
INTRUDERS.
Inside Outside
VPN TECHNOLOGIES
A VIRTUAL PRIVATE NETWORK (VPN)
PRIVATE DATA NETWORK
MAKES USE OF THE PUBLIC TELECOM INFRA
MAINTAINING PRIVACY THROUGH THE USE OF A
TUNNELING PROTOCOL AND SECURITY
PROCEDURES.
OTHER PRECAUTIONS
DON'T OPEN UNKNOWN, UN-SCANNED OR
UNEXPECTED EMAIL ATTACHMENTS.
DISCONNECT FROM THE INTERNET WHEN NOT IN
USE.
BACK UP YOUR COMPUTER DATA PERIODICALLY.
DON'T RESPOND TO HARASSING OR NEGATIVE
MESSAGES
GET OUT OF UNCOMFORTABLE OR HOSTILE
SITUATIONS QUICKLY
REGULARLY DOWNLOAD SECURITY PROTECTION
UPDATE "PATCHES".
CHECK YOUR SECURITY ON A REGULAR BASIS.
UNDERSTAND THE RISKS AND USE MEASURES TO
MINIMIZE YOUR EXPOSURE.
SHARE SECURITY TIPS WITH FAMILY MEMBERS, CO-
WORKERS AND FRIENDS.
NEVER EVER GIVE YOUR PERSONAL DETAILS
WITHOUT KNOWING TO WHOM EXACTLY YOU ARE
SHARING IT.
HARDWARE SECURITY
PHYSICAL ON SITE SECURITY- LOCK AND KEY, GUARDING
THE PLACE
CABINET LOCK AND KEY IN COMPUTERS
SURGE PROTECTORS AGAINST ELECTRICAL SPIKES AND
DROPS AND PROPER EARTHING
PHYSICAL SEALING/LOCKING OF PORTS
BIOMETRIC AUTHENTICATION
NETWORK SECURITY
FIREWALLS
ANTIVIRUS SOFTWARES
ENCRYPTION DEVICES
STATIC IP ADDRESSES
VPN
BENEFITS OF CYBER SECURITY
DEFEND THE USER FROM CRITICAL ATTACKS.
IT HELPS US TO BROWSE SAFELY.
WATCH ON ALL THE INCOMING AND OUTGOING DATA
ON OUR COMPUTER TO SAFE GUARD THE NETWORK.
SECURITY WILL DEFEND FROM HACKS AND VIRUS.
ASSURES THE SAFETY TO THE VITAL/CONFIDENTIAL
INFORMATION AND DATA.
SAFEGUARDS THE INTEREST OF THE ORGANISATION
AND IN TURN OF THE NATION.
LEGAL FRAMEWORK
IT ACT 2000(ELECTRONIC RECORDS/DIGITAL
SIGNATURES/ CYBER CRIMES AND PENALTIES)
IT(AMENDMENT) BILL 2006- DATA PROTECTION
AND COMPUTER CRIMES
IT(AMENDMENT) BILL 2008- PORNOGRAPHY
INDIAN COMPUTER EMERGENCY RESPONSE
TEAM(CERT)- ACTION ON ANY BREACH OF CYBER
SECURITY
7-LAYER SECURITY OPTIONS
1) USE BEST PRACTICES
2) WIRELESS ROUTER W/
HARDWARE FIREWALL
3) ZONE ALARM
SOFTWARE FIREWALL
Data 4) SPYBOT W/ TEA TIMER
5) SUPER ANTI SPYWARE
6) ANTI VIRUS SOFTWARE
7) BACKUP DATA
OPTIONAL: CREATE USER ACCOUNTS
BEST PRACTICES
TREAT YOUR PC/LAPTOP AS THOUGH IT WERE A
WALLET OR PURSE WHEN AWAY FROM HOME
BACKUP REGULARLY
DON’T CONDUCT FINANCIAL TRANSACTIONS ONLINE
ON NON-ENCRYPTED SITES
(LOOK FOR HTTPS:// OR THE PADLOCK ICON)
ENCRYPTED WEBSITES
Look for
BEST PRACTICES
BE PARANOID ABOUT E-MAIL ATTACHMENTS
NO SUCH THING AS A “SAFE” WEBSITE
ANALYSIS OF DOMAINS BY SYMANTEC REVEALED
THAT 90% OF INFECTED WEBSITES ARE
LEGITIMATE SITES THAT HAD BEEN
COMPROMISED WITHOUT THE OWNERS
KNOWLEDGE.
WEB BEST PRACTICES
SEE IF THE SITE IS USING A SECURE CONNECTION
(SSL) - LOOK FOR A LOCK ICON TO THE LEFT OF THE
SITE’S URL IN THE ADDRESS BAR
SSL IS A PROTOCOL THAT PROVIDES AN ENCRYPTED
TUNNEL BETWEEN YOUR COMPUTER AND THE SITE
YOU’RE VIEWING. SITES CAN USE SSL TO PREVENT
THIRD PARTIES FROM INTERFERING WITH THE
INFORMATION TRAVELING THROUGH THE TUNNEL.
AVOID ENTERING SENSITIVE INFORMATION SUCH AS
USERNAMES AND PASSWORDS ON THE SITE WHICH
IS NOT USING SSL.
BEST PRACTICES
DON’T OPEN OBVIOUS SPAM – DELETE IT
NEVER TRUST UNSOLICITED E-MAILS
DON’T CLICK ON LINKS IN E-MAIL – TYPE THEM IN
USE STRONG PASSWORDS
WATCH URLS TO KNOW WHERE YOU ARE
TURN COMPUTER OFF WHEN NOT IN USE
NOTHING IS FOOLPROOF – BE PREPARED
READ THE FINE PRINT
WHEN YOU CLICK ON THE BOX,
YOU ARE SIGNING A LEGAL
CONTRACT.
READ BEFORE AGREEING
KEEP A COPY (PAPER OR
DIGITAL) ESP IF MONEY IS
INVOLVED.
USE GOOD PASSWORDS
GREAT INTERNET
SECURITY MEANS
NOTHING IF THE BAD
GUYS CAN GUESS YOUR
PASSWORDS
USE STRONG PASSWORDS
WHEN DEALING WITH
GOLDEN RULES
• MINIMUM 8 CHARACTERS LONG
• AS MEANINGLESS AS POSSIBLE
• USE UPPERCASE /LOWERCASE LETTERS AND NUMBERS,
E.G., XK28LP97.
• CHANGE PW REGULARLY, AT LEAST ONCE IN A MONTH.
• NEVER GIVE OUT YOUR PASSWORD TO ANYONE!
• SHOULD NOT BE TOO HARD TO REMEMBER
• STORE THE PASSWORD IN A SAFE PLACE
MORE PASSWORDS
henearkrxern
USB MALWARE
FLASH DRIVES BANNED BY US
ARMY IN 2008 DUE TO
MALWARE ISSUES.
BAN LIFTED IN 2010
LOTS OF MALWARE IS
WRITTEN TO MOVE ON A
FLASH DRIVE
USB FLASH DRIVE W/ READ-ONLY
‘READ-ONLY’ OR
‘WRITE-PROTECT’
SWITCH PREVENTS
MALWARE BEING
WRITTEN TO THE
FLASH DRIVE
USEFUL IF USING
MULTIPLE
UNFAMILIAR
COMPUTERS
UPDATE YOUR OPERATING SYSTEM
INSTALL ALL
SECURITY
PATCHES
GO TO
WINDOWS
UPDATE WEBSITE
windowsupdate.microsoft.com/
7-Layer Security Options
1) USE BEST PRACTICES
2) HARDWARE ROUTER
W/ FIREWALL
3) ZONE ALARM
SOFTWARE FIREWALL
Data
4) SPYBOT W/ TEA TIMER
5) SUPER ANTI SPYWARE
6) ANTI VIRUS SOFTWARE
7) BACKUP DATA
OPTIONAL: CREATE USER ACCOUNTS
HARDWARE ROUTER W/FIREWALL
FIRST LAYER OF
DEFENSE
MOST WIRELESS
ROUTERS HAVE A
FIREWALL
PROTECTS AGAINST
INCOMING ATTACKS
7-LAYER SECURITY OPTIONS
1) USE BEST PRACTICES
2) WIRELESS ROUTER W/
HARDWARE FIREWALL
3) ZONE ALARM
SOFTWARE FIREWALL
Data 4) SPYBOT W/ TEA TIMER
5) SUPER ANTI SPYWARE
6) ANTI VIRUS SOFTWARE
7) BACKUP DATA
OPTIONAL: CREATE USER ACCOUNTS
7-LAYER SECURITY OPTIONS
1) USE BEST PRACTICES
2) WIRELESS ROUTER W/
HARDWARE FIREWALL
3) ZONE ALARM
SOFTWARE FIREWALL
Data 4) SPYBOT W/ TEA TIMER
5) SUPER ANTI SPYWARE
6) ANTI VIRUS SOFTWARE
7) BACKUP DATA
OPTIONAL: CREATE USER ACCOUNTS
BACKUP YOUR DATA
WHY BACKUP?
DATA LOSS OR CORRUPTION
HUMAN ERROR, FIRE,
FLOOD, MALWARE
BACKING UP IS CHEAPER,
EASIER THAN RE-CREATING
THE DATA
USER ACCOUNTS
THE WINDOWS DEFAULT IS TO RUN IN
ADMINISTRATOR MODE - ALLOWS EASY
INSTALLATION OF OTHER PROGRAMS – EVEN
MALWARE
A SAFER OPTION IS TO CREATE A USER ACCOUNT
WITHOUT ADMIN PRIVILEGES.
USE ADMIN ACCOUNT ONLY WHEN INSTALLING
SOFTWARE.
CONCLUSION
COMMON SENSE, SOME SIMPLE RULES AND A FEW
PIECES OF TECHNOLOGY CAN HELP PROTECT YOUR
COMPUTER SYSTEMS FROM UNAUTHORIZED USE
IT IS IMPORTANT TO REMEMBER THAT BY
PROTECTING YOUR OWN COMPUTER SYSTEM,
YOU'RE ALSO DOING YOUR PART TO PROTECT
COMPUTERS THROUGHOUT THE ORGANIZATION.
BE SECURITY CONSCIOUS WHILE WORKING IN
DIGITAL SCENARIO.
THANK YOU
Address: Contact Number: Email id:
STS BSF TIGRI Mobile No : 8866585647 naunianil33@gmail.com
Contact Me
