Securing Networks

Network security maps directly to business continuity. When it fails the damage reaches well past IT:

• —Disrupted e-commerce and lost business data.
• —Threats to privacy and data integrity.
• —Lost revenue, intellectual property and lawsuits.
• —In the worst case, a threat to public safety.

Two Cisco groups support defenders. Talos supplies security and threat intelligence to defend customers. PSIRT investigates and mitigates vulnerabilities in Cisco products, publishing Security Advisories in real time.

An attack vector is a path by which a threat actor reaches a server, host or network. It originates inside or outside the corporate network.

An internal user is already past the perimeter, so can do real damage in four ways:

• —Steal and copy confidential data to media, email or messaging.
• —Compromise internal servers or infrastructure devices.
• —Disconnect a critical connection, causing an outage.
• —Connect an infected USB drive.

Data loss is data lost, stolen or leaked, intentionally or not. It is also called data exfiltration. The consequences stack up:

• —Brand damage, lost competitive advantage and lost customers.
• —Lost revenue, litigation, fines and civil penalties.
• —The cost of notifying affected parties and recovering.

There are six data loss vectors:

These four words describe one chain of events: a danger, the weakness it can use, the mechanism that uses it, and how likely that is.

Threat

A potential danger to an asset.

Vulnerability

A weakness that could be exploited.

Exploit

The mechanism used to leverage a vulnerability.

Risk

The likelihood that a threat happens, with an undesirable consequence.

Countermeasure

An action that protects assets by mitigating a threat.

Impact

The potential damage caused by the threat.

Attack surface

The total sum of vulnerabilities reachable by an attacker: where they get in and where they get data out. An unpatched OS plus browser together form one.

Exploits are remote or local. A remote exploit works over the network with no prior access. A local exploit needs user or admin access on the end system; it does not require physical access.

There are four ways to manage risk:

The hats map onto five types of threat actor:

Early history gives two terms. In the 1960s, phreaking manipulated phone switches with tones for free long-distance calls. In the 1980s, war dialing dialled every number hunting for computers and fax machines, then ran password crackers on whatever answered.

An IOC (indicator of compromise) is evidence of what happened: file signatures, attacker IPs, filenames, software changes. An IOA (indicator of attack) is the strategy behind it: the motivation and the means.

IOC is reactive; IOA enables a proactive posture. Strategies get reused, so blocking one stops future attacks.

The cybersecurity checklist, in the order the course gives it:

1. 1.Use a trustworthy IT vendor.
2. 2.Keep security software up to date.
3. 3.Run regular penetration tests.
4. 4.Back up to cloud and hard disk.
5. 5.Periodically change the Wi-Fi password.
6. 6.Keep the security policy up to date.
7. 7.Enforce strong passwords.
8. 8.Use two-factor authentication.

CISA

US agency; automates free threat sharing via AIS.

NCSA

US awareness alliance; with CISA runs Cybersecurity Awareness Month each October.

ENISA

The EU's equivalent of CISA.