Cyber Security 2021: Beginners Guide to Cyber Security™

Explore the core cyber security goals of confidentiality, integrity, and availability, and how the CIA trade guides policies to protect data from theft, compromise, and attacks.

Learn how confidentiality and privacy protect data from unauthorized disclosure, ensuring authorized access. Explore encryption, access control, authentication, authorization, and physical security as key safeguards.

Explore integrity as the method to ensure data accuracy and safeguard information from unauthorized modification. Learn how backups, checksums, and data correcting codes support this protection.

Explore availability as a core security principle by examining physical protections and computational redundancies that keep sensitive data accessible to authorized users, even during challenges or failures.

Explore how cyber attacks exploit computer systems and networks with malicious code to alter data and logic, and distinguish web-based from system-based attacks.

Explore web-based attacks on websites and web applications, including injection attacks such as SQL injection, spoofing, session hijacking, brute force, denial of service, and man in the middle attacks.

Discover system-based attacks that aim to compromise computers or networks, including self-replicating viruses, Trojan horses, backdoors, and automated bots that exploit email attachments and idle activity.

Explore four types of attacks and how attackers use tools to destroy, alter, disable, steal, or gain unauthorized access to a system. As internet use grows, these threats increase.

Identify attacker types in cyber security, including cyber criminals, hacktivists, state-sponsored actors, and insider trades, their motives (stealing data, profits, political goals), and methods (viruses, spam, identity theft).

Introduce cyber security principles recognized by governments and ISPs to protect information systems and users, covering economy of mechanism, open design, complete mediation, separation of privilege, and psychological acceptability.

practice economy of mechanism by designing security mechanisms as simple and small as possible, reducing errors and easing testing, while keeping interfaces between modules straightforward to avoid faulty assumptions.

Enforce fail-safe defaults by applying a conservative default configuration and restricting privilege initialization; deny access unless explicitly granted during subject or object creation, avoiding full access to files and services.

Apply the least privilege principle by granting users only the rights needed to complete tasks, and remove elevated rights promptly when no longer required.

Explore the open design principle, showing that security should not rely on secrecy and that complexity does not increase security, with examples from passwords, cryptographic systems, and DVD CSS protection.

Enforce complete mediation by authenticating and checking access rights for every subject and object, ensuring the system mediates all access and adapts to changing permissions.

separation of privilege requires multiple conditions to grant access, limiting system entity access before privilege is granted; for example, knowing the root password and belonging to the right group.

Minimize the least common mechanism that allows multiple users to share resources, reducing the risk of security problems; if shared access is necessary, use separate channels to access files.

Psychological acceptability emphasizes the human element in security, advocating simple, usable mechanisms and clear feedback, such as reporting only that the user ID or password was incorrect, without unnecessary information.

The work factor compares bypass costs to an attacker’s resources to gauge cipher strength; a four-character password may be inadequate against attackers who can try millions of passwords per second.

Explain the principles of compromise recording and when recording intrusion details or monitoring access to files, emails, and browsing sessions can protect a building, with examples like internet-connected surveillance cameras.

Learn how data security protects programs and data from unauthorized access, modification, destruction, disclosure, or transfer through physical and software controls, preserving integrity and privacy.

Master data backups by applying the three-to-one rule, securing on-site and off-site copies, and using encryption and access controls to prevent data loss.

Explore archival storage for long-term data retention, including online, offline, and cloud options, with indexing, media choices, and the contrast with data backups.

Securely dispose of data by destroying or archiving media and using secure deletion tools. Encrypt before deletion and physically destroy devices when required, while maintaining decommissioning records.

Explore how growing internet use drives cybersecurity concerns and how preventive, detect, and corrected controls protect networks. Learn firewall, VPN, intrusion detection, and access control.

Explore how firewalls protect private networks with packet filtering, stateful inspection, application and circuit gateways, and gateway architectures, and learn how vpn enables encrypted remote access to corporate resources.

Network intrusion detection system and host intrusion detection system monitor traffic, analyze for attacks, alert administrators, and complement firewall protection with signature-based and anomaly-based detection.

Access control identifies and enforces restricted system access to prevent unauthorized use, by authenticating and authorizing users with credentials such as passwords, keycards, or biometrics, including two factor authentication.

Discover how e-commerce functions with technologies such as mobile commerce, electronic payment systems, online transaction processing, and EDI, and identify common security threats like data misuse and credit card fraud.

Explore electronic payment systems in e-commerce and how they streamline transactions. Examine risks such as fraud, tax evasion, payment conflicts, and threats like denial of service, eavesdropping, and direct access.

Explore credit and debit card fraud, from ATM skimming to online transactions. Learn about threats like fake calls, fake websites, keystroke capture, and public wifi that steal credentials.

Define security policies as formal, living rules that organizations use to ensure only authorized users access company technology and information while guidelines evolve with technology.

Clarify why cyber security policies matter for consistency and accountability, informing employees about duties and what they can and cannot do, while protecting sensitive data, IP, and customers and clients.

Explore cyber security standards as written norms, guidelines, and frameworks that establish a common language, precise criteria, and interoperability to improve security of IT systems and critical infrastructures.

Explore the ISO/IEC 27000 family, a global framework for information security management that protects data assets and guides 27001, 27002, 27005, and 27032 for risk, controls, and cross-border cybersecurity.

Explore India's information technology act 2000 and amendments, along with copyright and patent laws, to understand cyber crimes and electronic governance, e-commerce, digital signatures, and intellectual property rights.