Unit1 Cyber NIET Greater Noida Uttar Pradesh

Cyber Security UNIT-1 NIET

1. Noida Institute of Engineering and Technology, Greater Noida Information System, Information Security Cyber Security Ruchika Sharma Assistant Professor (CSE) NIET, Gr. Noida Unit: 1 Ruchika Sharma ANC0301 Cyber Security Unit 1 Cyber Security ANC0301 B.TECH

2. Done my B.E(honours) in computer science and engineering and M.Tech in computer engineering and has 6 yr 10 months of experience . I have published 2 research papers scopus indexed My area of interest are machine learning , DBMS , deep learning Brief Introduction Ruchika Sharma ANC0301 Cyber Security Unit 1

3. Syllabus Ruchika Sharma ANC0301 Cyber Security Unit 1 Unit Unit Objective Unit 1 Introduction : Introduction to Information Systems: Types of Information Systems, Development of Information Systems, Need for Information Security, Threats to Information Systems, Information Assurance, Guidelines for Secure Password and WI-FI Security and social media and Windows Security, Security Risk Analysis, and Risk Management Unit 2 Application Layer Security : Data Security Considerations-Backups, Archival Storage and Disposal of Data, Security Technology-Firewall, Intrusion Detection, Access Control, Security Threats -Viruses, Worms, Trojan Horse, Bombs, Trapdoors, Spoofs, E-mail Viruses, Macro Viruses, Malicious Software, Network and Denial of Services Attack, Security, Threats to E-Commerce: Electronic Payment System, e- Cash, Issues with Credit/Debit Cards. Unit 3 Secure System Development: Application Development Security, Architecture & Design, Security Issues in Hardware: Data Storage and Downloadable Devices, Mobile Protection, Security Threats involving in social media, Physical Security of IT Assets, Access Control, CCTV and Intrusion Detection Systems, Backup Security Measures.

4. Syllabus Ruchika Sharma ANC0301 Cyber Security Unit 1 Unit Unit Objective Unit4 Cryptography and Network Security : Public key cryptography: RSA Public Key Crypto with implementation in Python, Digital Signature Hash Functions, Public Key Distribution. Symmetric key cryptography: DES (Data Encryption Standard), AES (Advanced Encryption Standard), Secure hash algorithm (SHA-1). Real World Protocols: Basic Terminologies, VPN, Email Security Certificates, Transport Layer Security, TLS, IP security, DNS Security. Unit5 Security Policy: Policy design Task, WWW Policies, Email based Policies, Policy Revaluation Process-Corporate Policies-Sample Security Policies, Publishing and Notification Requirement of the updated and new Policies. Resent trends in security.

5. Business protection against cyberattacks and data breaches. Protection for data and networks. Prevention of unauthorized user access. Improved  recovery time after a breach . Protection for end users and endpoint devices. Regulatory compliance . Business continuity. Improved confidence in the company's reputation and trust for developers, partners, customers, stakeholders and employees. Branch wise application Ruchika Sharma ANC0301 Cyber Security Unit 1

6. After successful completion of this course student will able to Course Outcome COURSE OUTCOME NO COURSE OUTCOMES CO1 Aware with different information systems and tools for securing the information. CO2 Apply different tools and techniques for application security. CO3 Design security issues in hardware & develop secure information system. CO4 Analyze different policies for technological security CO5 Analyze different information security standards & provide corporate security. Ruchika Sharma ANC0301 Cyber Security Unit 1

7. CO-PO and PSO Mapping *3= High *2= Medium *1=Low PO No CO No PO1 PO2 PO3 PO4 PO5 PO6 PO7 PO8 PO9 PO10 PO11 PO12 CO1 2 2 2 2 1 2 1 3 1 2 1 3 CO2 3 3 1 2 2 2 1 3 1 2 2 1 CO3 3 3 2 3 3 2 2 3 2 2 2 3 CO4 3 3 1 2 1 3 3 3 2 2 2 3 CO5 3 2 2 1 3 2 2 3 3 2 3 3 CO-PO Mapping Ruchika Sharma ANC0301 Cyber Security Unit 1

8. CO-PO and PSO Mapping *3= High *2= Medium *1=Low Program Specific Outcomes and Course Outcomes Mapping CO PSO1 PSO2 PSO3 PSO4 CO1 3 3 - 3 CO2 3 3 2 3 CO3 3 3 - 3 CO4 3 3 - 3 CO5 3 3 - 3 Ruchika Sharma ANC0301 Cyber Security Unit 1

9. Introduction to Information Systems Types of Information Systems Development of Information Systems Introduction to Information Security Need for Information Security Threats to Information Systems Information Assurance Cyber Security Security Risk Analysis Content (Unit-1) Ruchika Sharma ANC0301 Cyber Security Unit 1

10. Objective of Topic Ruchika Sharma ANC0301 Cyber Security Unit 1 Topic Objective Information Systems To Understand the information system , its Types and Development of Information Systems and also understanding of various threats to information system Information Security Develop an understanding of information security Information Assurance Develop an understanding of information assurance as practiced in computer operating systems Cyber Security and Security Risk Analysis Develop an understanding of security policies (integrity confidentiality and availability), need of cyber security and security risk associated with it.

11. Topic Mapping with CO Ruchika Sharma ANC0301 Cyber Security Unit 1 Topic CO Introduction to Information Systems CO1 Types of Information Systems CO1 Development of Information Systems CO1 Introduction to Information Security CO1 Need for Information Security CO1 Threats to Information Systems CO1 Information Assurance CO1 Cyber Security CO1 Security Risk Analysis CO1

12. There are no prerequisites for this course, but a fundamental knowledge in computers is desirable. Prerequisite and Recap Ruchika Sharma ANC0301 Cyber Security Unit 1

13. Information System Information System is made up of two terms, namely, Information and System . Information - Well-structured data with a specific meaning System - an arrangement that takes input and provides output after completing the required process. “ An arrangement that processes data and provides meaningful information.” [1] Ruchika Sharma ANC0301 Cyber Security Unit 1 Introduction to Information Systems (CO1)

14. Ruchika Sharma ANC0301 Cyber Security Unit 1 Information Systems Cont… Information Systems People Data Network Hardware Software

15. An Information system contains software, hardware, data, people, and procedures . Ruchika Sharma ANC0301 Cyber Security Unit 1 Information Systems Cont… Processes and essential system elements are also considered as part of an Information System. An information system (IS) is an organized system for collecting, organizing, storing and communicating with the information

16. Ruchika Sharma ANC0301 Cyber Security Unit 1 Information Systems Cont… The main components of an information system include: People : Users, administrators, and other individuals who interact with the system. People are crucial for inputting data, using the system, and making decisions based on the information generated. Processes : The procedures, workflows, and activities that transform input data into useful information. These processes can be manual or automated and are designed to achieve specific goals within the organization. Data : Raw facts and figures that are collected and processed by the system. Data can be structured (organized in a predefined way, like in a database) or unstructured (such as text documents, images, or videos). Hardware : The physical components of the information system, including computers, servers, networking equipment, and storage devices. Hardware provides the infrastructure necessary for processing and storing data.

17. Software : The programs and applications that run on the hardware and enable users to interact with the system. This includes operating systems, databases, and various application software designed for specific tasks. Networks : The communication channels and infrastructure that allow different components of the information system to connect and share data. Networks enable communication between computers, devices, and users within an organization. Procedures : The rules, policies, and guidelines that govern the use and operation of the information system. Procedures ensure consistency, security, and efficiency in the management of data and information. Feedback : The mechanism through which the system receives input about its performance, allowing for adjustments and improvements. Feedback helps to ensure that the information system meets the needs and expectations of its users. Ruchika Sharma ANC0301 Cyber Security Unit 1 Information Systems Cont…

18. Capture both internal data and external data of the organization and its environment Stores the data base items over an extensive period of time The user’s need specifications are deployed The output of the Information systems varies on its type Ruchika Sharma ANC0301 Cyber Security Unit 1 Fundamental concepts in Information Systems

19. Ruchika Sharma ANC0301 Cyber Security Unit 1 Types of Information System (CO1)

20. Support various business operations such as accounting and production. Transaction processing system(TPS): Helps in processing various business transactions and retrieving information from them. Processing a transaction can be done in two ways Batch Processing Online or Real-time processing . Batch Processing - transactions are stored over a period of time and then processed. Real-Time Processing – transactions are processed during their occurrences. For example, at retail stores, the cash receipts or card payments are registered and processed simultaneously. Operations Support Systems (OSS) Ruchika Sharma ANC0301 Cyber Security Unit 1

21. B- Process Control System (PCS) Monitoring and controlling physical processes Example- Making day-to-day decisions Controlling operational processes. This system automates the adjustment of a production process. Operations Support Systems (OSS) Ruchika Sharma ANC0301 Cyber Security Unit 1

22. C- Enterprise collaboration system (ECS) Helps in sharing information among employees. A proper flow of information helps in increasing the productivity of an organization. Example- Mail Video Conferencing Operations Support Systems (OOS) Ruchika Sharma ANC0301 Cyber Security Unit 1

23. Management Support Systems (MSS) MSS provides useful information to managers for decision making and control . Management Information System (MIS) : It generates information for monitoring performance and maintaining coordination. Example- Production manager can check the report of cost and time of production. Ruchika Sharma ANC0301 Cyber Security Unit 1

24. Management Support Systems b) Decision Support System (DSS): It supports managerial decision making. Example -Sales manager can set sales targets for the coming year by considering the existing market conditions. c) Executive Information System (EIS) or Executive Support System(ESS) : Provides critical information to the executive and top-level managers for making strategic decisions. Ruchika Sharma ANC0301 Cyber Security Unit 1

25. Provides information to users in different business areas when required. Expert system: Provides adequate knowledge and expert advice for making various managerial decisions. Expert System = knowledge base + software modules Knowledge Management System (KMS): For sharing knowledge, KMS uses a group of collaboration systems, such as the Intranet. Provides two types of knowledge- Explicit knowledge - Information that is documented, stored, and coded with the help of an IS. Tacit knowledge - Information based on processes and procedures stored in the human mind. Knowledge-Based Systems Ruchika Sharma ANC0301 Cyber Security Unit 1

26. Information System: An arrangement that processes data and provides meaningful information Types of Information System Operations Support System TPS PCS ECS Knowledge Based System Management Support System MIS DSS. Recap Ruchika Sharma ANC0301 Cyber Security Unit 1

27. Development of IS, similar to the application development procedure. The main approaches are listed as follows: Waterfall model Prototyping model Evolutionary model Spiral model Incremental model Ruchika Sharma ANC0301 Cyber Security Unit 1 Development of IS (CO1)

28. This method is also called linear sequential model . Ruchika Sharma ANC0301 Cyber Security Unit 1 Waterfall model Feasibility Check Requirement Enquiry Design Coding Testing Maintenance

29. Feasibility check: Technical and financial feasibility check about system development. Requirement and specifications: Gathering knowledge about the required system and developing the specifications needed. Design: Converting the requirements and specifications into a system model. Coding: Coding is the process of designing a bridge between the understanding of the user and the system. This is also called programming. Testing: Ensuring that the system performance is according to the user requirements. This is done after a system is set for use. Maintenance: Changes in the system after testing or use to correct the shortcomings or further requirements. Ruchika Sharma ANC0301 Cyber Security Unit 1 Stages of Waterfall Model

30. It approaches feasibility analysis before requirement analysis, which is not practical. It tests the system after implementing and designing; therefore, any change required after testing can be hard to be introduced. Any feedback to the previous process has not been approached. Ruchika Sharma ANC0301 Cyber Security Unit 1 Drawbacks of Waterfall Model

31. The prototype may be a usable program but is not suitable as the final software product. The code for the prototype is thrown away. However experience gathered helps in developing the actual system. The development of a prototype might involve extra cost, but overall cost might turnout to be lower than that of an equivalent system developed using the waterfall model. Ruchika Sharma ANC0301 Cyber Security Unit 1 Prototyping Model

32. Ruchika Sharma ANC0301 Cyber Security Unit 1 Prototyping Model Rapid Prototype Analysis Design Implementation Postdelivery maintenance Retirement Changed Requirements Development Maintenance

33. Evolutionary model approaches to improve the classic waterfall model by providing scope of feedback and improvement at every stage of the system development. Therefore, every stage should be taken as a separate evolutionary phase. This model is useful for complex projects where all functionality must be delivered at one time, but the requirements are unstable or not well understood at the beginning. Ruchika Sharma ANC0301 Cyber Security Unit 1 Evolutionary Model

34. Ruchika Sharma ANC0301 Cyber Security Unit 1 Evolutionary Model Source: software engineering k k aggarwal

35. It is a combination of the features of the waterfall and prototype models. This idea was given by Boehm. Ruchika Sharma ANC0301 Cyber Security Unit 1 Spiral Model Source: software engineering k k aggarwal

36. User/client communication: Interaction with the client or users of the system to identify the requirements and specifications in the system System planning: Planning the system to be developed and preparing a rough draft and schedule of the development process Risk analysis: Identifying the problems in the plan and developing solutions to check them Engineering: Involves system hardware and software design, coding and testing the system Construction and finalization: Involves system building and testing to release it for use System evaluation: Evaluation by user or client to use the system. Note- All these phases are repeated in the process of system development until users approve the system. Ruchika Sharma ANC0301 Cyber Security Unit 1 Stages of Spiral Model

37. Incremental model approaches system development through various incremental steps, where every step tries to add more functions in the system development process. Each step of system development is a separate group of activities. This model can also be called Continuous Improvement Model. Ruchika Sharma ANC0301 Cyber Security Unit 1 Incremental Model

38. Ruchika Sharma ANC0301 Cyber Security Unit 1 Incremental Model Source: software engineering k k aggarwal

39. Ruchika Sharma ANC0301 Cyber Security Unit 1 Recap Development of Information System:

40. Information security refers to the protection of information. It is the process of securing, protecting, and safeguarding the information from an unauthorized access, use, and modification. Information is an important part of an organization or a business that requires more attention to preserve its integrity, privacy, and availability. Goals of information security - Confidentiality Integrity Availability Ruchika Sharma ANC0301 Cyber Security Unit 1 Introduction to Information Security (CO1) Source: Swayam

41. Process of securing information from unauthorized access Ruchika Sharma ANC0301 Cyber Security Unit 1 Introduction to Information Security Integrity Confidentiality Integrity Availability Securing the information from unauthorized modification On time Fault tolerance exists in the computer system or network Fair allocation of resources over the network Concurrency control management in database Deadlock management in database

42. Here are key concepts within information security: Authentication : Definition: Verifying the identity of users, systems, or processes. Example: Using passwords, biometrics, or multi-factor authentication. Authorization : Definition: Granting or restricting access rights and permissions to authenticated users. Example: Assigning specific privileges to users based on their roles. Non-Repudiation: Definition: Ensuring that a user cannot deny the authenticity of their actions or transactions. Example: Digital signatures that provide proof of origin and integrity. Risk Management: Definition: Identifying, assessing, and mitigating potential risks and vulnerabilities to information and systems. Example: Conducting risk assessments and implementing controls to address identified risks. Cryptography: Definition: The use of mathematical techniques to secure communication and protect the confidentiality and integrity of data. Example: Encrypting sensitive communications to prevent eavesdropping.

43. Security Policies: Definition: Formalized rules and guidelines that define the security requirements and expectations within an organization. Example: Establishing guidelines for password complexity and data handling. Incident Response: Definition: A structured approach to addressing and managing security incidents. Example: Developing plans and procedures to respond to data breaches or cyberattacks. Security Awareness and Training: Definition: Educating users and stakeholders about security best practices and potential risks. Example: Conducting regular training sessions on phishing awareness and safe online behavior.

44. To maintain proper security of information in an organization, we need to apply certain measures, policies, and procedures so that no harm is caused to the confidentiality, integrity, and availability of organizational information . Data breaches are becom ing common Shrinking time from exposure to attack Epidemic of security vulnerabilities Phishing and spamming Compliance need- PCI, SOX, HIPPA Zero day attack Ruchika Sharma ANC0301 Cyber Security Unit 1 Need for Information Security (CO1) Source: Swayam

45. Protection of Sensitive Data Preservation of Privacy Prevention of Data Breaches Business Continuity Compliance with Regulations Prevention of Cyberattacks Protection of Intellectual Property Maintaining Trust and Reputation Financial Loss Prevention National Security Prevention of Insider Threats Ruchika Sharma ANC0301 Cyber Security Unit 1

46. A threat is an illegal activity that can cause damages such as loss of information and data corruption to the network of an organization. The hardware and software components of a computer system are highly vulnerable to many threats . Ruchika Sharma ANC0301 Cyber Security Unit 1 Threats to Information Systems (CO1)

47. Attacks on the network can breach the security of data and resources over the network. Ruchika Sharma ANC0301 Cyber Security Unit 1 Attacks on the Network

48. The attacker does not intend to cause any harm to the network. The attacker observes the information for which he/she does not have access rights. Only Monitors, analyzes, or observes the information available over the network. These attacks are often more subtle and covert, aiming to gather information without the knowledge of the system owner or user. Passive attacks can pose significant threats to the confidentiality of sensitive data. Ruchika Sharma ANC0301 Cyber Security Unit 1 Passive Attack

49. Release of the message Content Ruchika Sharma ANC0301 Cyber Security Unit 1 Passive Attack Source: cryptography and network security william stallings

50. Traffic Analysis Ruchika Sharma ANC0301 Cyber Security Unit 1 Passive Attack Source: cryptography and network security william stallings

51. Here are some common types of passive attacks: Eavesdropping : Monitoring network communications or data transmission to intercept and gather sensitive information like niffing network traffic to capture unencrypted data. Wiretapping : Physically tapping into a communication line, such as a telephone or network cable, to intercept and eavesdrop on the transmitted data like Illegally tapping into a phone line to listen to conversations. Packet Sniffing : Capturing and analyzing data packets as they travel over a network to extract sensitive information like u sing network monitoring tools to capture and analyze unencrypted data packets. Traffic Analysis : Analyzing patterns and trends in network traffic, even without understanding the actual content, to derive information about communication patterns like Monitoring the frequency and timing of communication between two parties. Ruchika Sharma ANC0301 Cyber Security Unit 1

52. Shoulder Surfing : Observing or watching over someone's shoulder to gain unauthorized access to sensitive information, such as passwords or personal identification numbers (PINs) like Watching someone enter their password at an ATM or while typing on a keyboard. Dumpster Diving : Searching through discarded materials, such as printed documents or storage media, to find sensitive information like Retrieving documents from a company's trash containing confidential information. Social Engineering : Manipulating individuals through psychological tactics to trick them into divulging confidential information or performing actions that compromise security like p retending to be a legitimate entity over the phone to obtain login credentials. Passive DNS Reconnaissance : Collecting information about domain names and their associated IP addresses without actively interacting with the target systems like g athering information about a target's domain registration details without sending any direct requests to the domain. Ruchika Sharma ANC0301 Cyber Security Unit 1

53. Metadata Analysis: Examining metadata associated with files or communication to extract information about the data without accessing the actual content like Analyzing metadata in documents to determine authorship or document creation date. Radio-Frequency Identification (RFID) Skimming: Illegally reading or intercepting data from RFID tags without the knowledge or consent of the tag owner like Using RFID skimming devices to capture information from contactless credit cards. Ruchika Sharma ANC0301 Cyber Security Unit 1

54. Intentions can be wrong. The attacker tries to steal information from the network. Attacker can create, delete, modify, and replace a message. Ruchika Sharma ANC0301 Cyber Security Unit 1 Active Attack

55. Masquerade Ruchika Sharma ANC0301 Cyber Security Unit 1 Active Attack Source: cryptography and network security william stallings

56. Replay Ruchika Sharma ANC0301 Cyber Security Unit 1 Active Attack Source: cryptography and network security william stallings

57. Modification of Message Ruchika Sharma ANC0301 Cyber Security Unit 1 Active Attack Source: cryptography and network security william stallings

58. Denial of Service Ruchika Sharma ANC0301 Cyber Security Unit 1 Active Attack Controller Handlers Attack Bots Target

59. Denial of Service (DoS) Attacks : Description: Overloading or disrupting a system, network, or service to make it unavailable to legitimate users. Example: Flooding a website with excessive traffic to overwhelm its servers and cause a temporary or prolonged outage. Distributed Denial of Service (DDoS) Attacks: Description: Coordinating a DoS attack from multiple sources, often using a botnet, to amplify the impact and make it more challenging to mitigate. Example: Launching a DDoS attack by infecting numerous computers with malware and using them to flood a target with traffic. Man-in-the-Middle (MitM) Attacks: Description: Intercepting and potentially altering communications between two parties without their knowledge. Example: Eavesdropping on unencrypted Wi-Fi communications, intercepting and modifying messages. Ruchika Sharma ANC0301 Cyber Security Unit 1 Here are some common types of active attacks:

60. Session Hijacking (Session Replay) Attacks: Description: Capturing and using a session token or cookie to impersonate a user and gain unauthorized access to their accounts. Example: Intercepting and using a user's session token to log in to a web application as that user. Spoofing Attacks: Description: Faking the identity of a user, device, or system to gain unauthorized access or deceive users. Example: IP spoofing, where an attacker sends network packets with a false source IP address to mask their identity. Replay Attacks: Description: Intercepting and later retransmitting valid communication to gain unauthorized access or replicate actions. Example: Capturing login credentials and replaying them to gain unauthorized access. Ruchika Sharma ANC0301 Cyber Security Unit 1

61. Password Attacks: Description: Attempting to discover or crack passwords to gain unauthorized access to a system or user account. Example: Brute-force attacks, dictionary attacks, or password guessing. Malware Attacks: Description: Distributing and executing malicious software to compromise the security of a system. Example: Viruses, worms, Trojans, ransomware, and other types of malware. SQL Injection Attacks: Description: Exploiting vulnerabilities in a web application's database query to execute unauthorized SQL commands. Example: Injecting malicious SQL code into a web form to access or modify the database. Cross-Site Scripting (XSS) Attacks: Description: Injecting malicious scripts into web pages viewed by other users to execute unauthorized actions. Ruchika Sharma ANC0301 Cyber Security Unit 1

62. Example: Embedding a script in a comment on a web page that steals authentication cookies from other users. Phishing Attacks: Description: Deceptive attempts to trick individuals into divulging sensitive information, such as usernames, passwords, or financial details. Example: Sending fraudulent emails or creating fake websites to trick users into providing confidential information. Eavesdropping Attacks (Active): Description: Actively intercepting and listening to communication between two parties, often using techniques like active wiretapping. Example: Injecting malicious code into a network to capture and modify data in real-time. Ruchika Sharma ANC0301 Cyber Security Unit 1

63. Information Security: Confidentiality Integrity Availability Attacks Passive Release of the message Content Traffic Analysis Active Masquerade Replay Modification of Message Denial of Service Ruchika Sharma ANC0301 Cyber Security Unit 1 Recap

64. IA is defined as the set of measures applied to protect information systems and the information of an organization. It ensures availability, integrity, authentication, confidentiality, and non-repudiation of an organization’s information and IS. Ruchika Sharma ANC0301 Cyber Security Unit 1 Information Assurance (IA) (C01)

65. IA ensures these critical security functions by providing the restoration capability to IS with the measures that include- Protecting the system from potential risks Detecting possible risks Reacting to the vulnerable situations IA is, in fact, the management of risks in relation of processing, transmitting, or storing data or information. Ruchika Sharma ANC0301 Cyber Security Unit 1 Information Assurance (IA)

66. Ruchika Sharma ANC0301 Cyber Security Unit 1 IA vs IS Information Assurance Focuses mainly on strategy Covers information management and protection in a larger domain Keeps focus on the overall risk management for the security of an organization Information Security Focuses primarily on tools and tactics Gives importance and priority to technology. Concentrates on applications and infrastructure developed to provide security and operations.

67. Ruchika Sharma ANC0301 Cyber Security Unit 1 Scope of IA Source: Introduction to Information Security and Cyber Laws, S P Tripathi

68. Ruchika Sharma ANC0301 Cyber Security Unit 1 Three-dimensional IA model Source: Introduction to Information Security and Cyber Laws, S P Tripathi

69. Ruchika Sharma ANC0301 Cyber Security Unit 1 Three-dimensional IA model Information states: Information resides in a system in stored form, processed form, or transmitted form. Security services: Five essential security services are provided in the IA model. The services include availability, integrity, authentication, confidentiality, and non-repudiation. Non-repudiation means to apply measures so that the ownership of a particular action cannot be denied later by the individual who took the action. Security countermeasures: After the risks are assessed and analyzed, it is time to react. These security countermeasures are applied against vulnerabilities through technology, people, and operations.

70. Ruchika Sharma ANC0301 Cyber Security Unit 1 Security services Authentication– verifies the identity of the user Authorization– grants permission to authorized users Auditing– Increases the system competence Non-repudiation– sustains the integrity of the message

71. Ruchika Sharma ANC0301 Cyber Security Unit 1 Security services Source: cyber security, G Padmavathi , swayam

72. Ruchika Sharma ANC0301 Cyber Security Unit 1 Importance of People in IA

73. Ruchika Sharma ANC0301 Cyber Security Unit 1 Cyber Security (CO1) Cyber Security is protection against the criminal or unauthorized use of electronic data Preventative methods used to protect information from being attacked Cyber Security strategies include •Identity management, •Risk management and •Incident management Introduction to Cyber Security Source: Swayam

74. Ruchika Sharma ANC0301 Cyber Security Unit 1 Importance of Cyber Security The security properties are realized and maintained by the Organization Ensures protection of resources from attacks, damage and authorized access on networks, computers and programs Enforces Integrity, Confidentiality and Authenticity Preventative methods used to protect information from being attacked

75. Ruchika Sharma ANC0301 Cyber Security Unit 1 Tools used for Cyber Security Common tools used to prevent Data Leakage Passwords Anti-Virus/ Anti-Malware Software Software Patches Firewalls Authentication Encryption

76. Ruchika Sharma ANC0301 Cyber Security Unit 1 Key elements of Cyber Security End-user Education Application Security Information Security Operational Security Disaster Recovery Network Security Key Elements of Cyber Security

77. Ruchika Sharma ANC0301 Cyber Security Unit 1 Application Security Input parameter validation User/Role Authentication and Authorization Session management, parameter manipulation and exception management Security Auditing and Log Analysis Source: Swayam

78. Ruchika Sharma ANC0301 Cyber Security Unit 1 Information Security It protects information from unauthorized access Helps to avoid identity theft Promotes Information privacy Major techniques used are Identification, Authentication and authorization of users Cryptographic techniques Source: Swayam

79. Ruchika Sharma ANC0301 Cyber Security Unit 1 Network Security It identifies threats and stops them from entering or spreading into the network Network security components include: •Anti-virus and anti-spyware •Firewall •Intrusion prevention systems (IPS) •Virtual Private Networks (VPNs) Source: Swayam

80. Ruchika Sharma ANC0301 Cyber Security Unit 1 Disaster Recovery It is a development process used to assess various types of risks Establishes different priorities thereby evolving disaster recover strategies Every organizations must develop proper disaster recovery strategies to protect themselves from damage

81. Ruchika Sharma ANC0301 Cyber Security Unit 1 Operational Security and End-user Education Operational security is a process that is used to identify critical actions in an organization End-user education is must for an organization to avoid unnecessary incidents against security

82. Ruchika Sharma ANC0301 Cyber Security Unit 1 Contrasting Internet & Cyberspace Cyberspace It is a symbolic and figurative space that exists within Internet It supports multitude of business, government and social interactions through information exchange Internet The design of Internet results in a cyberspace built out of components It provides services designed to form more complex services

83. Ruchika Sharma ANC0301 Cyber Security Unit 1 Security Risk Analysis(CO1) The entire process of maintaining organizational security involves assessment, analysis, and management of risks. Assessment is identification of any potential risks for a system. Analysis means measuring the effects that may be caused to the system and providing details to the management team for taking steps that will counter the most concerning issues.

84. Ruchika Sharma ANC0301 Cyber Security Unit 1 Security Risk Analysis Management of risks is to take appropriate steps for removing system vulnerabilities. Risk analysis is a continuous process that requires you to constantly monitor the measures employed to maintain security of your systems at present. Keep calculating threats evaluating their further effects. It keeps the economy in check, that is, the cost of applied security measures never exceed the possible losses.

85. Ruchika Sharma ANC0301 Cyber Security Unit 1 Risk analysis terminology Assets : Everything that has some value and needs to be safeguarded . Threats: possible danger to assets Vulnerabilities: any weakness in the system Countermeasures: Countermeasures are the devices or actions with an intent and capability to reduce system vulnerabilities. Expected losses: : expected impacts of threats on an organization’s assets Impact: It is usually categorized into four areas, namely, destruction, disclosure, modification, and Denial of Service ( DoS ).

86. Ruchika Sharma ANC0301 Cyber Security Unit 1 Interdependency of vulnerability, threat and risk Vulnerabilities Cyber Threat Actor Motivation Risk Source: Swayam

87. Ruchika Sharma ANC0301 Cyber Security Unit 1 Key Elements of Risk Analysis Impact statement: The impact statement describes the damages that may be caused by threats. Effectiveness measure: The effectiveness measure presents the calculated effectiveness of individual actions taken to counter the impact of threats. Recommended countermeasures: The recommended countermeasures involve possible actions that are cost effective and maintain security of assets in a proper manner.

88. Ruchika Sharma ANC0301 Cyber Security Unit 1 Risk Control Strategies Cyber Services- Cyber security is crucial. RCS methods keep you secure while identifying & eliminating threats from cyber criminals. Investigation - RCS knows how to perform discreet, effective, and fully legal investigations for both individuals and organizations. Security Consulting - RCS identifies and mitigates risks and vulnerabilities. If a problem arises, risk level is determined and action is taken. Business Intelligence - RCS business intelligence capabilities safeguard your assets & intellectual property from internal & external threats.

89. https://youtu.be/BvWvFAS1iP0?list=PLUtfVcb-iqn834VGI9faVXGIGSDXZMGp8 https://youtu.be/ooJSgsB5fIE https://youtu.be/tff_X0BMgfk https://youtu.be/fQ3ESFfvchg?list=PLUtfVcb-iqn834VGI9faVXGIGSDXZMGp8 https://swayam.gov.in/nd2_cec20_cs09/preview https://www.youtube.com/watch?v=sdpxddDzXfE https://www.youtube.com/watch?v=0p3787JiFgQ https://www.youtube.com/watch?v=JdfmV2KW11I Faculty Video Links, Youtube & NPTEL Video Links and Online Courses Details Ruchika Sharma ANC0301 Cyber Security Unit 1

90. What is the weakest link in cyber security ? A . Weak encryption. B . Humans. C . Short passwords . 2. Which one of these things will a comprehensive cyber insurance NOT protect you from? Poor cyber security hygiene and implementation. A ransomware attack on your company’s computer network. C . An employee skimming/stealing customers’ credit cards. Daily Quiz Ruchika Sharma ANC0301 Cyber Security Unit 1

91. 3. What’s the best way to secure a weak password like “monkey123”? Add an uppercase numeral and a special character, such as $. B . Don’t reuse it anywhere else or share it with anyone. C . Enable two-factor authentication 4. When using a VPN, what’s the one thing that you cannot hide from ISPs, hackers, and the government? The fact that you’re using a VPN. B . Your identity. C . Your data. Daily Quiz Ruchika Sharma ANC0301 Cyber Security Unit 1

92. 5. The best way to minimize your digital footprint is to: Take fewer photos with your smartphone. B . Travel less with your smartphone. C . Post less on social media 6 . What is most valuable to companies looking to sell you something? Your phone number. B . Your email address. C . Your physical address Daily Quiz Ruchika Sharma ANC0301 Cyber Security Unit 1

93. 7 . When is it ok to reuse a password? When you are logging into social media accounts. B . When it is too hard to remember a long password. C . Never. 8 . The best defense against ransomware is being proactive when you : A. Purchase comprehensive cybersecurity insurance. B . Back up your data regularly. C . Regularly update all your devices and software with the latest security patches. Daily Quiz Ruchika Sharma ANC0301 Cyber Security Unit 1

94. 9 . What’s the best way to steer clear of IoT device security hacks? A . Only choose name-brand hardware makers. B . Disconnect IoT devices from the internet when you are not using them. C . Do not purchase any IoT devices you do not need . 10. What will freezing your credit not affect? Vulnerability to identity theft. B . Your credit score. C . Need to monitor financial statements for fraud. Daily Quiz Ruchika Sharma ANC0301 Cyber Security Unit 1

95. What is Cyberspace? Difference between Information Security and Information assurance Differentiate Information Security and cyber security. What is the CIA Triad? What are the Tools used for Cyber Security ? Differentiate Cyberspace and Internet. Daily Quiz Ruchika Sharma ANC0301 Cyber Security Unit 1

96. What do you mean by Information System? What is the need of Information System? What are the types of Information System? Explain Confidentiality, Integrity and Availability in terms of cyber security What is the need to secure our Information System? Explain the different Threats to Information System? What do you understand by Information system failure? What is Cyber Security and How it is different from Information Security? What is information assurance and how is it provided? Describe security risk and analysis? Define all possible cyber-attacks and write the difference between active cyber-attack and passive cyber attack . Weekly Assignment Ruchika Sharma ANC0301 Cyber Security Unit 1

97. Cyber security is related to: a. Viruses, phishing, and identity theft b. Protection for applications and individual privacy c. Protection from online predators and cyber bullies d. All of the above Mention the key factor in determining the strategic business advantage. a. Security b. Information system c. Information integrity d. knowledge Which of the following is created by human for virtual interactions and exchanges? a. Computer b. Cyberspace c. Mobile phones d. All the above MCQ s Ruchika Sharma ANC0301 Cyber Security Unit 1

98. Which indicates the basic weakness in a system?  a. Threat b. Attack c. Vulnerability c. Risk Which of the following is not a type of attack on the network ? a. Active attack b. Passive attack c. Neutral attack d. All of the above Security risk includes the following element(s) : a. Impact statement b. Effectiveness measure c. Recommended countermeasures d. All of the above MCQ s Ruchika Sharma ANC0301 Cyber Security Unit 1

99. Which of the following is the primary focus of information assurance is: a. Strategy b. Tools c. Infrastructure security d. None of the above Which of the following is not a type of information system? a. Operations support systems b. Knowledge-based systems c. Employment systems d. Management support systems Operations support system involves: a. Transaction processing system b. Process control system c. Enterprise collaboration system d. All of the above MCQ s Ruchika Sharma ANC0301 Cyber Security Unit 1

100. Sessional Paper Ruchika Sharma ANC0301 Cyber Security Unit 1

101. Sessional Paper Ruchika Sharma ANC0301 Cyber Security Unit 1

102. Sessional Paper Ruchika Sharma ANC0301 Cyber Security Unit 1

103. Old Question Papers Ruchika Sharma ANC0301 Cyber Security Unit 1

104. Old Question Papers Ruchika Sharma ANC0301 Cyber Security Unit 1

105. Old Question Papers Ruchika Sharma ANC0301 Cyber Security Unit 1

106. Old Question Papers Ruchika Sharma ANC0301 Cyber Security Unit 1

107. Attacks ii. Passsive attacks iii. Integrity iv. Non repudiation Answer the questions _ Attack in which no wrong intention is involved In which the user refutes from the claim Message is changed to some other d. Unauthorized person enters the system Ruchika Sharma ANC0301 Cyber Security Unit 1 Glossary

108. Compare cyber security, information security, Information assurance. Differentiate Cyber space and Internet. Explain man-in-the –middle attack. Explain scope of information assurance What is decision support system Explain the term vulnerability and threats. How these are related? Expected Questions for University Exam Ruchika Sharma ANC0301 Cyber Security Unit 1

109. Summary In this digital era when everything is accessed and operated through cyber space, security is the very important feature. To understand the need for cyber security, different incidents and statistical reports are presented. Lack of security may lead to set backs in financial matters, personal and professional operations. Important terms related to Cyber Security are also discussed in this module. Different types of Cyber threats, the methods of Cyber Attacks are also explained. The four important fundamentals of security and the other essentials in securing the computers are also explored to understand the basic operations in cyberspace. Cyber security is a broader term which protects all the hardware (devices, routers, and switches), software, information, and data that are part of the cyber space. Cyber Security cannot be misguided with data security. Ruchika Sharma ANC0301 Cyber Security Unit 1

110. References Charles P. Pfleeger , Shari Lawerance Pfleeger , “ Analysing Computer Security ”, Pearson Education India. V.K. Pachghare , “Cryptography and information Security”, PHI Learning Private Limited, Delhi India. Dr. Surya Prakash Tripathi , Ritendra Goyal , Praveen kumar Shukla ,”Introduction to Information Security and Cyber Law” Willey Dreamtech Press.(prefer) https://www.javatpoint.com/cyber-security-introduction https://www.edureka.co/blog/what-is-cybersecurity/ http://natoassociation.ca/a-short-introduction-to-cyber-security/ Ruchika Sharma ANC0301 Cyber Security Unit 1

111. Thank You Ruchika Sharma ANC0301 Cyber Security Unit 1