Defining Security and its Roles

0:00Alright, I thought before we would get started here in the main material for the Cybersecurity Fundamentals exam. First of all, take a look at the umbrella over that exam, and that is a larger organization known as ISACA. And the exam we're looking at really is only part of a larger certification that's called the ITCA. Oh my gosh, too many acronyms going on here, right? Well, if you're anything like me, the first thing I want to know is, what in the world are these acronyms? Where does this all come from?

0:31Well, here is the ISACA website. And one of the things that kind of disturbed me a little bit when I first learned about ISACA is that there is no real definition for ISACA. You can look on their website on this page or any other page you go to. You know, what I would do is I'd go to the About Us, and I'd go to the About Us Home, and that should surely tell me what the acronym means. But no, you'll just see ISACA without any other reference there. Okay, so finally we have, though, Wikipedia to the rescue.

1:02So here it is, folks. ISACA stands for Information Systems, Audit and Control Association. Although, I think it says it in here, too, that ISACA now goes by its acronym only. So I guess that's why they don't define it on the web page, but I just kind of wanted to know what it was. Now, here's the other thing. This organization originated in the United States in 1967. Wow, I was but a wee lad back then. But if you think about it, there were not really that many digital assets back then.

1:35We really didn't have the internet as we know it now. I mean, it did exist, but it was mostly for educational and military purposes, government purposes, and it is nothing like what we use today. As far as digital assets go, we didn't really even have hard drives. Much less solid state drives like we have right now. In fact, my mother, when she was alive, she got started in IT, and my dad also, and they had stacks of cards, punch cards. I can't remember how big they were, but like maybe three or four inches wide by six or eight inches long.

2:10And that was their digital asset. These cards had little punched holes in them that each one of the holes would represent some kind of binary information. And they would run those through a machine. That was their version of digital data back in the day. Much more cumbersome and much harder to store any quantity of information when you're physically limited by how many stacks of cards you can stack up. They used to feed those into these old IBM machines. So anyway, fast forward to today. And here we have a specific certification that we are trying to achieve.

2:44So let's take a look at that. If we go to credentialing, they have a lot of different ones here. Some of them are more advanced than others. But the one we're looking at today in this course is the ITCA, which is information technology certified associate. Oh, so now they're defining acronyms. Anyway, that's what that one is. And this is an entry-level certification. Now it doesn't stand on its own. It really is a larger part of five smaller certifications that are within it. So if you take a look at it, you can get some fundamental deals, information about here.

3:17And you can Google or go to their website, which you can see up here as well. And you see that we have five separate exams that we need to know about in order to achieve the ITCA. That would be computing fundamentals, cyber security fundamentals, which is the course that we're working on here, of course. Data science fundamentals, which is an emerging but huge field. It's probably as big as a big impact on society and culture as the internet itself was a few years ago. Networks and infrastructure fundamentals and software development fundamentals.

3:51So cyber security fundamentals, of course, is where we're headed. So I'm going to click there and get a look here at what we've got going on. So first of all, that gives you a little bit of an idea of what you'll need to know here. There is an exam, of course, so that you have to pass. But what I'm going to point out here is for every other exam that I've taken, and I've been taking them for close to 30 years now, starting with Microsoft exams. I think it was Windows NT 3.51 or 4.0. I can't remember which one. Anyway, I've taken them for a long time.

4:22Every other exam I've taken through my whole career gives you a list of bullet points that you have to study. Usually it's on a web page or you can save it as a PDF. And the last course I did was also on cyber security. There's 23 pages of little bullet points of all the stuff you'd need to know. Here, I sack a gives us this. This is your outline right here. Okay. For that landscape information security fundamentals, security operations and response and securing assets. All of that could mean almost anything.

4:53There are no specific bullet points for what you have to learn. So what you might have to do is to go to view all study materials. Now you don't really have to do that because I'm going to be your source of information here for what you need to do to do well with this particular exam. Before I click on this, I want to point out, I cannot quote to you verbatim of any of their materials. I cannot share with you what's on the exam specifically anything like that. That would be in, you know, run afoul of the non disclosure agreement or the N DA that you have when you become a member.

5:28Now, what's this significance of a membership here? If you go here, you'll notice that. Yeah, there are some materials you could get. There is an online course. You could take it if you want. But honestly, again, I think you'll do better if you just watch this one. That's not out of company pride. I'm just telling you, trust me on this. Anyway, you can see that there's member pricing and $160 for that and $220 for non member pricing. Likewise, there's a pretty big price difference here for their lab package.

5:58Again, $136 or $200 and the study guide, $40 or $44. I haven't added this up, but the non member price would be, see, that's $220 for $64 if you got all of those items. $464 if you become a member of Isaka, which is not hard to do, by the way, but you do have to pay for it. It's $160 plus $136. That's $196 plus $40. That would be $236, right? I'm doing the math right in my head. You're going to find out quickly as you watch me train that I am no math genius , but I think I got that right.

6:32The membership will kind of pay for that difference for you. Remember, this is just one of the exams. If you used only their materials, you'd have to use five other certifications or actually four other certifications worth of materials as well. The membership would really start to save you some money there. If you go to membership here, click right there. I can't remember what I paid for mine, but anyway, we'll click on it here. Oh, and it limited time offer, $123. So that is really a pretty good savings.

7:04I think it renews annually, but that's pretty good savings on materials if you buy their materials. They do have other benefits to membership. I'll leave that up to you to look into on your own. And so that's a little bit about Isaka, the ITCA, the Cybersecurity Fundament als Exam, and some of their materials. I will point out you could get the materials if you want. I'm not offended if you want to get those, okay, which certainly wouldn't hurt. I do think I'm going to be able to provide you with everything you're going to need here, though, for exam success. However, if you buy the book, I'm just going to tell you right now, it's very dry.

7:37Nothing against Isaka. They're just very academic organization, very, I guess, formal, if you want to put it that way. They have some very smart people working there, but you'll find that it kind of reads like a college textbook that you have to memorize and try to fall asleep in. Obviously, their own materials are the best source of truth for a lot of that. Nevertheless, I think you'll do well if you just watch this course in preparation for the exam, which we'll start in the next NUGIT, which is what we call videos around here at CBT NUGIT.

8:08NUGIT is called a video, or videos called a NUGIT. We'll start about defining security, and in particular, things like IT security and cyber security and information security. We'll be looking at all that kind of stuff in the next NUGIT.

0:00All right, so now let's get our discussion started about cybersecurity fundamentals and in particular what security really is now I Saka would have you kind of split hairs upon what all the different types of security are I have no hairs to split And I think it's being a little bit granular in the whole definition But nevertheless, let's go ahead and address it because there are different umb rellas of security in some areas of security are Topics of other areas of security and with that in mind, let's start here with the generic IT security Okay information technology security now this relates to protecting company assets When you think about an asset that could be a lot of things Assets could be data. Yeah, that's one of the first things we look at here That's primarily what we think of when we think of cyber security and we also think of you know the internet and things like this with With data we also look at hardware now you might think how could hardware relate to security?

0:58You know like a video card is that related to security a network card is that related to security? Yes, okay So for example there have been network devices that have actually had Embedded code in the firm in the hardware of those devices that is actually spy ware Yeah, that's happened nation states have done that Okay, and if you're not familiar with spyware, it's a way of collecting information and then forwarding it on to a destination That's of course unauthorized Hacker or another nation state or something like that. There's also software software is big because a lot of security threats that occur are Through weaknesses in software. I'm not I'm gonna go into more details on some of these things as we go But I'm just kind of getting the 30,000 foot view here. There's also the facilities themselves You might have physical security requirements for different organizations again We'll be discussing that but that's all part of the umbrella of IT security now What are we doing with this? Well, what's our objective to protect information from theft? That's a big one. All right, okay It can also be misuse sometimes. It's just an honest mistake One employee is excited to be part of a project and so they forward their best

2:15friend at the company a list of topics They're gonna be working on for this new project. Well, that was forwarded to a department that's not read in on this particular topic And it might be confidential or even classified information that is crossed to boundary now So that's a kind of a misuse although well-intentioned not authorized There's also unauthorized access so could be that something has permissions on let's say file system Where the permissions are too broad and people just out of curiosity can click their way through folders and say oh look at these files And well, they weren't supposed to read those files So they were unauthorized really to be able to access those and that follows a couple of different levels There's the actual access that's been assigned and there's the logical access So the logical access is we know that people those people that were clicking on that file We're not supposed to the actual access is that it was too broad. Okay. Well again talk more about all of this as we go There's also modification. That's a big part of hacking by the way So hackers sometimes don't actually just reach in and steal something a lot of times They'll just modify something kind of slip it under the radar It looks a lot like what was supposed to be there

3:31It's been specifically modified to benefit that hacker, okay, or it could just be vandalizing data Or otherwise subverting some kind of data So maybe company a has a competitor called company B Company B figured out a way to get into the company's Servers and their file servers and modify some of their financial data Which would then of course cause company a to take wrong actions in response So this kind of stuff actually does still happen There's also CIA. This is not the law enforcement organization But this is confidential confidentiality integrity and availability These are just kind of three tenants that you'll see all the time as you move through IT and in particular Cybersecurity and these tenants really apply to most areas of IT so confidentiality You want to make sure that it's confidential, right?

4:25So this could relate to a lot of different kinds of things again company secrets trade secrets or Personally identifiable information like if you're in a medical organization, you want to protect your patients Social security numbers or other government ID depending upon where you are anything else It could be uniquely tied to that individual even just something like their address their phone number Yeah, it's still important to keep that kind of data confidential. There's also integrity This relates to the modification thing I was talking about earlier Where you don't want someone to modify data and manipulate that data well with CIA and integrity There are ways to be able to protect against that again stuff. We talk about later on There's also availability this is really just making sure that something is Available as designed for whoever's supposed to be able to access it. Okay, so a lot of times what hackers do and by the way when I say hackers we kind of tend to think of You know a 13 year old in grandma's basement hacking away from down there a lot of our nation states right now and A lot of them are from very powerful countries where the hackers are actually state employees and Have benefits from the country and so forth. They get it on salary and

5:41everything they take lunch breaks No, whatever, you know, they're just like normal employees. It's just that they 're also hackers for a country Anyway, a lot of these hackers which are also known as bad actors if I can say that as well these bad actors a lot of times will do something called a denial of service attack or a DOS attack against Certain kinds of assets could be a like a web server Maybe they don't like a specific companies web companies Objectives or tenants or they feel like that companies too greedy or whatever and so they will possibly send a denial of service attack Against their website and bring it down kind of in a vandalism kind of a way but to make a point Okay, and sometimes that DOS attack will simply be a distraction because they 're actually doing something else And they just want everyone to look at the DOS attack and all of it to pay attention to that while they're actually Doing something else that they don't want people to notice. Okay, so that's CIA There's also protecting from both inside and outside threats So when it comes to IT security we have a tendency to think of only the evil internet hackers and people out there that are trying to hack in from this Outside world known as the internet and trying to penetrate our interior

6:57networks and to sneak away all of our data And that's all true We do need to be concerned about that But a lot of times the threats are actually internal like I was telling you about earlier where an employee Share something with another employee that they weren't supposed to share they didn't have authorization to do that Okay, that would be an insider threat another insider threat would be a fired employee Now if a company follows good procedure They should disable that employees access to everything before they're even notified that they're fired but or closely thereafter but if that company if that employee has left the company and It's possible that there are still resources that are still open to that employee that we forgot about or it kind of slipped through the cracks Well, they could possibly still gain access to all of our systems all of our data or whatever kind of files that they used to work on For example databases and the like and they could vandalize that or they might even leave on good terms go to a in a lateral move go to a different company and then still have access to our database and Siphon off our database of customers and bring it to their next company So that's kind of a insider threat that you might need to think about there now There's also information security and here's where we're kind of starting to split hairs But information security would relate to the data itself. That's where the big

8:15emphasis is Now this we generally tend to think of as only digital data, but it's also analog when I say analog This would be things like notebooks papers schematics anything that's printed out That sort of thing whereas digital would generally be things like maybe confidential information going across a network cable or Digital data stored on a thumb drive for example that someone's been able to steal out of the organization So but analog again is still a big factor I'll give you another example of that an employee that has got ill intent against our organization They could take digital assets that are maybe a file on a server somewhere Print it out once it's printed out. It's now analog Slipping into their backpack and walk out of the building with it now They have that data that they're not supposed to abscond with also We have things such as verbal and visual communication Remember let's go back to that employee example again where they share something with another employee that they're not supposed to do Well, it doesn't have to be that they emailed them a list of what they're working on or whatever It might just be standing at the water cooler. Maybe they're really close friends and they're sharing a Greek yogurt You know while they're in between bites of this Greek yogurt

9:31There's they're saying what kinds of things are working on which again We'd like to be able to be friendly with everybody But we might have to have authorization to share certain things or we might be in a phone conversation with even a relative or our spouse And we're on our lunch break We're talking to our spouse and say hey you wouldn't believe what the company's gonna do tomorrow They're gonna release this great new product and our stock is gonna go skyrock eting through the roof Well, you should not be doing that because especially with publicly traded companies That anything that could affect the stock price or insider information stuff like that. That is a big big no-no so that stuff still counts folks and visual communication so this is kind of the Stereotypical thing where you might have seen in movies or something where you know a detective says to someone who's a civilian Well, I'm not supposed to show you these records. These are confidential and they're police data But and they have the file on their desk. I'm just gonna go on a coffee break for about Mmm 15 minutes and no more than 15 minutes when I come back Maybe we can discuss it some more of course They leave the room and that someone takes their phone out and they take pictures of all the files That are on that desk. Okay of all the papers So that would still be a visual communication that has to be protected against

10:50and in fact by the way These things here are just deadly to security sometimes a lot of organizations Will not even allow them in the building depending upon the sensitivity of their data

0:00All right, as we move closer to a discussion of cybersecurity in particular, there's still other types of security that we need to know about that are also relevant. And one of those would be information and communications technology or ICT. This is really simple. It's really anything that carries information in the days of telephone lines when we used to use those more frequently. That telephone line that carried an analog phone conversation from you to another person, that would be part of ICT and carried information. It carried voice signals, analog signals to whoever you were speaking with. In modern times, of course, there's lots of other kinds of things that can carry that information, which we'll talk about here. There are three main components here. First of all, there's a transmitter. All right, the simplest way to understand that is now with maybe even a cell phone. So when I speak into my cell phone, and I'm talking to someone, that's this is the transmitter. On their end, they have a similar device. It's a receiver. Okay, so we have a transmitter and a receiver. You can also think of the similar idea there with a walkie talk ie, or with a citizen's band radio, or with a radio station, transmitter from a radio station through an antenna over the

1:15airwaves to a receiver, which would be a radio. Right? Lots of different ways that this could happen. And then whatever is in between the transmitter and the receiver is the medium. Now, that might just be airwaves, right? Radio signals transmit over airwaves. And yes, radio signals can also get hijacked. And radio signals can also get manipulate. So can television signals, for example, if you ever saw the movie, V for Vendetta, it's kind of a lower movie now, but V for Vendetta, they were hijacking television signals and they were inserting their broadcast.

1:49This also happens in at least one movie a year where a hacker or a political activist, somebody will hijack a television signal and they'll interrupt the broadcast and they'll transmit their own message over the medium of those airwaves. So what kind of elements do we have to play a part here? Well, there's the communications technology. Again, we had radio television. There's also microwave, not just for cooking popcorn, by the way, can also be used to send data. Okay, so microwave's also a factor there. We have cellular, we have internet, which really encompasses a lot of these different kinds of things. Okay, so internet could be over Wi-Fi.

2:29It could be over a cabled internet connection. It could be internet that you receive over cellular signals to your cell phone. So lots of different kinds of technologies . We're not going to exhaust all of those right here and now, but that definitely is a factor. In fact, let me point something else out. Let's just use this globe. It's kind of hard to see because of the little mesh that's over it. But here's the United States right here. And then across the ocean, there are actually even underground fiber optic cables that right now are going through kind of a pinch point in the Middle East that we don't know if it's hackers or activists or who's doing it, but in recent news as of this recording, there have been damaged fiber optic cables that threaten a lot of the communications throughout the rest of the world over here because there's a real significant juncture right there of fiber optic cables. Well, that's a medium that's under threat right now. And it's not just for internet. Those cables are used for everything . Okay, lots of different kinds of transmission. And big part of that is because it's internet because internet, you can have voice over the internet. You're listening to me right now, through voice. You can have voice over IP. So phone calls that now take place over the internet instead of old copper wiring like they used to. Anyway, for some reason, all that looks like a

3:45spider, but anyway, lots of different kinds of communications technology that can be at risk when it comes to security, digital transactions, credit card transactions, for example, those can also be hijacked. A big thing that happens now is even at gas station pumps or at convenience store checkout counters, people can put a skimmer on top of the credit card reader right there, you know, where you usually insert your chip or tap to pay or swipe your magnetic stripe. Well, magnetic magnetic stripe is particularly vulnerable to this because there's no security built in. When it comes to a credit card, there's that little chip on there for when you insert the card, there's a little bit of storage behind that chip that has cryptographic information that would generate unique information for specific transactions. So there's built in security to that. The magnetic strip, there's no security built into that really. So if someone puts a fake credit card reader over top of an existing one, when you swipe your credit card in and out of that, they can read that swipe, they can read that magnetic magnetic data. Okay, that 's a digital transaction that is at risk. There's also data that's kind of a generalized term could be anything, but most data is kind of important. So we want to protect that. And then of

5:01course, we talked about the internet as well. And again, the internet really encompasses almost every type of communication in our current world. Even when we were talking about earlier, radio and television, most radio and television signals can actually be broadcast over the internet and streamed that way. We used to watch television, ABC, CBS, NBC in the United States, BBC, overseas in England. I canceled my cable service for television. I don't even use anymore. I watch who the little word Netflix or something like that. Okay. So the internet is significant here.

5:34There's also the cloud, which will talk about more again as we move along. But that is also significant. It's all connected by the internet. So it's dependent upon the internet. There are private clouds, but those are kind of a little bit more of a minority. Most of what goes on in the cloud does use normal internet signals. And the advantage of that is we can have data centers that I could never afford to pay for, but that Microsoft or Amazon pays for, for example, or Google, and I store my data on their servers. They're the ones that spent billions of dollars to build the whole thing.

6:06And I just kind of lease a tiny little bit of it for a few bucks a month. Okay. One of the advantages of the cloud, it's on a consumer level, but it's also in a big way on a corporate level. Many government organizations and large corporations really don't have their own data centers the way they used to. Now they still have some data centers locally, but now a lot of their data has been shifted to the cloud. There's also software. There's an organization called Ver acode. And a few years back, they did a study and they found that 83% of applications that were being written had at least one security flaw on us on an initial scan. They have a way of scanning for weaknesses there.

6:47Well, they were able to detect that 83% of software out of the gate is flawed somehow. So that again is where hackers have a significant foothold in two cybersecurity . And again, there's also the hardware itself, which I talked about again in our last nugget.

0:00Alright, now let's continue our discussion of security. In particular here, we're going to be discussing network security. Now this is where a lot of security happens because probably the biggest threat in security is usually cyber security. So a lot of times that's going to be internet based. And of course, the internet is just a big network and corporate networks are trying to protect themselves from the evil bad internet. But network security is a subset of cybersecurity, which we have yet to discuss fully. But we'll get there.

0:31And then also, it's both physical and logical. Now, what do I mean by that? Well, let's take a look at these two subnets here. These could be called subnets. Okay, I'll just put that on there for clarity subnet. I'm not sure if my handwriting is very good clarity, but anyway. Alright, so two different subnets. What is a subnet? Well, generally speaking, it would be a family of devices that all share the same range of IP addresses. It's a little oversimplified, but for now that will suffice. So for example, maybe all the hosts in this subnet would be on the 10 dot network.

1:04So 10 dot nine dot eight dot something. Okay, let's put a zero for something there. And we'll discuss more about networking in a different course, but that would also assume a 24 bit subnet mask for our purposes. And then over here, we would have a another subnet. This would be a different subnet though. 10 dot nine dot seven dot something over here. Right. Those are two separate subnets and they may be separated physically or logically. Okay. So all of the hosts on this subnet might be connected to a single switch.

1:39This would be called a switch and it just connects. It gets the whites kind of disappearing in there, but it connects all of those computers in there. We also have another switch over here that also connects all the computers that you see on this side. So this is just like an ethernet cable that comes out of the back of the computer, goes into the switch and allows each computer to communicate with the other computers on its same network. And then if I have a message that needs to go from this computer on this network over to this computer on this network, how does that happen?

2:11Well, these two switches are probably connected to a router. I'll put an R for a router here. Okay. So they're both connected. Okay, when a message is destined for this computer, it goes from this computer into the switch, the switch communicates with the router, the router forwards the message onto this switch over here, and then the message gets to its destination. We can also just make this logical. So what if this was just a larger switch? And if I wasn't clear about it before, a switch is what all the devices will connect to and it allows traffic to pass back and forth between one host and another.

2:46Right? There could be computers on this network. There could be printers, servers, all kinds of things. All right. But mostly it's going to be PCs in our particular context. So this switch, it might connect both of these networks. All right. And then maybe they're all on the same physical switch, but the switch can have a logical division in it known as VLANs or virtual local area networks, VLAN, right? And you can program. You don't have to memorize this. I'm just telling you how a logical division might work.

3:18A switch can be programmed to have one subnet on one side like a 10.9.8.0, like I was saying before, and maybe a 10.9.8 or 7.0 on this side, all these hosts can physically connected to the same device. But logically internally, we've programmed it to have two separate VLANs. So that's beyond our scope really quite for right now. But I TSC seems to want us to be able to differentiate between the physical and the logical.

3:52Okay. So I put that out there. All right. Now that could be on premises like the diagram I just showed or remote. Remote's actually a big issue because let's say that you're out here, you're maybe on a business trip. This is your trusty little MacBook Pro or something. And you're trying to communicate with corporate HQ up here where all your resources are. That's where your maybe your mail servers up there. Maybe your intranet is up there. Maybe some web applications. Some other things you need to connect to are in the headquarters office. So how do you make that connection? Because you're in a hotel room over here.

4:24HQ is over here in a well protected corporate network. You have to have a secure way to make this connection. A spoiler alert. Normally that's going to be through something called a virtual private network or VPN which would encrypt this connection. All right. That's all we'll talk about for there for right now. That's another way to provide good security for your connections. And there's also the cloud which again is another whole topic. But a lot of corporations are making big moves to the cloud and we need to secure those networks as well. And beyond network security, there's also application security.

4:56And again, a lot of these things we're talking about here. This is kind of the overview of them. We cover them in more detail at a future point in time. So application security, it's really again a subset of cybersecurity. So that's part of it. And just as NFYI mentioned this a couple of nuggets ago, about 83% of initial scans reveal vulnerabilities. And that's on the first scan. There's software and programming and companies that can do automated scans of code that developers create, that programmers create.

5:28And it can alert to certain weaknesses in the code that could be a security vulnerability. Well, 83% of those initial scans reveal some kind of a vulnerability. So a couple of other areas of security stick around for the next nugget where we'll talk about cybersecurity specifically.

0:00All right, now let's move here into cybersecurity, which is, again, another subset of IT security, but also a big part of what we're going to be discussing throughout the rest of this course. So what we do here is we primarily focus on internet threats. I don't want to say it's only internet, but probably the ITCA would really mostly focus on internet threats. And we all go into a lot of detail in this particular video, only because the rest of the course is mostly cybersecurity. Okay, but what does it involve? Well, it has a lot of different policy that you have to establish. This is kind of done on a more administrative level, a planning level, stuff like that.

0:38It's not the day to day actively resisting cybersecurity, although that's also necessary. But when it comes to making policy, that's something you have to do in advance. You don't do that on the fly when you're under a cyber attack actively. That has to be planned in advance, because if it's not, then you're really running around in a panic and nobody knows what their job is at the time and all this kind of stuff. So that has to be a process for that whole idea. All right. Now part of that policy that you can establish will be risk assessment. So you have to see what your potential points of entry are, and that will also reveal what your potential weaknesses could be. So just as an FYI, most people that are in cybersecurity will tell an organization that it's not a matter of if you get hacked, it's a matter of when. And by the way, you might already be hacked. Okay, very often that's the case, because a lot of organizations or a lot of hackers, excuse me, a lot of hackers will hack into an organization quietly.

1:40They'll slip under the radar. It's not this big splash that's made all the time. And it's not always very obvious. So they might already be in the network, they might be able to create a couple of secret accounts, open up what we call back doors and be able to then do something like elevate their privilege. So they might find just an average account that doesn't really have a lot of privilege, they might be able to find ways to elevate it. So you have to understand what the risks are there across a lot of different vectors. What's your risk assessment from the internet? It's likely that you will get attacked. Okay, everybody gets attacked. The only way to protect 100% from that is to not be connected to the internet. And even then, you still run risks from cybersecurity. Well, how can that be if you're not connected to the internet? Because your users, your users have phones that are connected to the internet. They could snap a screenshot or take a photograph of their screen where they're supposed to be confidential schematics, company secrets, personal information. And they could just send that to somebody over the internet because they're using cellular instead of your corporate network to transmit that data. So even if you're not connected to the internet at all, there is still risk.

2:55Many organizations will prohibit their users from carrying cell phones into the workplace. An acquaintance of mine that works in a nuclear lab, that's the case with him, he doesn't even own a cell phone. He says, I don't have much use for one because I'm at work a lot. And when I go home, I'll just use the landline at home. If I need to call somebody who he's also kind of old fashion. Anyway, that's other stuff to think about there. Also, password management, we'll get into this in much more detail in the future. But I will say this, most people are resistant to good passwords because they're difficult to remember. I have a couple of friends that have photographic or near photographic memories, not that big a deal for them. Okay, most mortal humans have difficulty remembering their passwords or or just entering in and wrong on the keyboard, just getting a fat fingering and I do that all the time. So what do they do then?

3:44They make easier passwords. They'll get it. Most people will get as easy of a password as they can possibly come up with within the bounds of your requirements. Most organizations will require upper lower case, you know, alpha, numeric, special characters, certain length, that sort of thing. Okay, so the password management is a big factor. And it's not always passwords anymore. There are other ways to authenticate besides passwords. So it's really kind of breaks beyond just that barrier of passwords.

4:14Could be other things like biometric authentication, two factor authentication, which by the way, both of those are much, much better ways to either improve passwords, improve using passwords, or not use a password at all. Because there is such a thing called password less authentication. We'll talk about that coming up in a future video. Okay, there's also encryption. This is something that is commonly misunderstood. And it's probably because a lot of people watch too much TV. Okay, it's where in some movie or TV show, there'll be an expert cybersecurity specialist.

4:48Maybe they're with the FBI or something like that. And they'll say, Oh, it's encrypted, but I'll crack that in about 20 minutes. And so or less, you know, before the show is over for sure. So they'll just crack through all of this encryption. They'll smash through a bunch of firewalls, all this kind of stuff. And it makes it look as if cracking encryption is easy. Well, some encryption is easier than others. But if you're using a highly respectable level of encryption, these days, it's very difficult to circumvent that encryption. A lot of times hackers will use other methods to attack you as opposed to directly trying to crack your encryption algorithm.

5:24Nevertheless, you need to know what good encryption is. You need to know how and where to use it, and how it can improve your security posture. And there's also then the data security. This again, also has many other areas that are within it. So where do you store that data? How is that data stored? Is it backed up? That's a big part of data security. A lot of times we think about just protecting it with right permissions so that only authenticated people and authorized people can access that data. What happens if something goes wrong with that data itself?

5:55A drive fails, hard drive fails, or you get hit with ransomware, which is a significant threat in today's landscape, both for individual users as well as corporations. If the data is backed up properly and on a good schedule, you might have some protection against ransomware. Also, where are the actual devices stored that store your security? Are they are the servers that store that data in a secure location who can access those servers where the data is stored ? Is your data stored in the cloud? What are you using to protect that data in the cloud? I'm not providing answers right now because there's a lot to it, but it does bring up questions that have to be answered when you look at data security. All right, so anyway, that's a little bit of an intro into parts of cybersecurity, which we'll cover throughout the rest of our course. And our next nugget, that we're going to be discussing specialized systems.

0:00Now, another potential security threat vector would be specialized systems. It's a little bit of an umbrella term here, but generally it falls in the area of things like factories and automations, things like this, but it could be with industrialized control systems or ICS systems. Okay. And again, you can think of something like the factory where there's an industrialized control system that might mix a specific batch of chemicals into a VAT, for example. It's a pharmaceutical company that has very, very granular and very specific measurements that have to be issued when a specific drug, for example, is me.

0:39Well, there are computers and systems that control that. You wouldn't want someone to get a hold of that or to hack into that and to adjust those potencies and potentially create a problem. There are a lot of checks and balances in the pharmaceutical industry, so there 's regular testing that goes on to make sure that and confirm that the correct dosages and mixture of chemicals is proper. I have a friend of mine that that's his full time job. He works very deeply in that space. Everything from the time that the source materials are delivered to the dock, the time the drugs are made, and then from the time that they leave the dock.

1:14That's all his job is to monitor that whole process. Okay. And it's not of course just for drugs. It could be for anything else that's really made. There's also SCADA or SCADA as some people might call it. This would be supervisory control and data acquisition. We just call it SCADA devices. Anyway, these again will be automations that occur that you use to perform certain tasks, very similar to industrialized control systems. So where would these kinds of things be used? Well, again, a factory floor, for example, could be where automobiles are made.

1:47There was an automobile manufacturer recently. I don't think it was as a matter of hacking, but an automobile manufacturer recently that had a robot that builds cars that bolts on fenders or something like that. I don't know what I can't remember what it was. But an employee was in the vicinity and that robot accidentally attacked that employee. I think that was errors in other areas besides security, but nevertheless, you could see some of the dangers that occur if somebody were to be in the way of some kind of a malfunction or a hack.

2:18Okay. So that's the science industry. Yeah. There's a lot that goes on there. I mean, if a nation state that was an enemy of another country were able to hack into something and adjust how missiles are made or how military equipment is manufactured or at least gum up the works or prevent those devices from being made, you can imagine the impact of that. Okay. Utilities. There have been various utilities that have been hacked. They are actually a pretty big target. So nation states will regularly go after utilities like power plants, water, water treatment plants, all those sorts of things.

2:53Few years ago, there was a water treatment plant that got hacked into and I guess the hacker released a higher level of chemicals into the water system, the water supply, then was supposed to be there. The application, I'm familiar with it. There is chlorine that gets put into your into normal tap water, at least in the United States. There's fluoride. There might be other chemicals. I don't know the others. They were able to adjust the quantity of chemicals that got into the water supply. You can imagine how that could have gone. The United States has also been involved in this, something called Stuxnet.

3:24This is going back years now, but where we created sophisticated malware that deliberately was deliberately used to infect computer systems of another nation and it affected their nuclear centrifuges. It had something to do with affecting the timing that was being used in those. So it caused things to go haywire there. Utilities, infrastructure. You'll see this in a lot of different things. It could be in transportation networks, traffic control systems, railways, shipping ports.

3:58Actually, that reminds me, I have an article. Let me try to bring it over here and find it for you. All right, here it is. I just saw this yesterday. Chinese spy cranes in US ports are caught with covert modems. I'll link this for you down below, but the basic idea here is that there are these cranes that are used quite frequently in shipping docks in ports. And for some inexplicable reason, they have a modem in them. Now, I'm not sure if they're oversimplifying the word "botem" there because a modem really just modulates and demodulates.

4:31It modulates analog data to digital data and digital data to them. Analog data, you can also think of it as an internet modem that you might have in your home. That's what you use to connect your digital computers to an analog network that communicates over the internet. So that's what a modem is. But in this context, where it's in those cranes, those Chinese manufactured cr anes had a modem that was able to transmit data to and from those cranes. And there's not really a reason for it that they could determine.

5:02So what's being done with that? Could those modems be used to shut down those cranes, to deliberately deliver a bad up data that causes some kinds of problems, that puts a snag in those ports and in their ability for people to do their jobs there. That's a big one there in terms of infrastructure. Another reason why this is a big problem is because on a factory floor, for example, a lot of these systems were originally designed before the internet. There's a company called Siemens, which is a good company, and they created a lot of these control devices that were very reliable, very good devices in controlling automation and robots and assembly lines and all different kinds of things.

5:46Well, when they first came out with these devices, people weren't using the internet decades ago the way they are right now. And there wasn't a threat vector from the internet. So they were really built without any security in mind at all. And so you think about it, a lot of the times there were devices like this that might control some kind of machinery on the factory floor. Maybe there was just a green button here and a red button here and an operator would just stay in there and they would push green or they would push red and make the machine go, make the machine stop.

6:18Maybe that's the kind of the only thing that was in mind with this. Well, now that we have internet connections, some of these that were designed in old methods, now if they're connected to the internet so that we can kind of automate things , there's no built-in security there. Is it possible that someone could hit the big red button from another country? Yes. And I'm oversimplifying again a little bit here, but you get the idea. So much of this was created without the internet in mind and without any security in mind because it wasn't needed at the time. And as a result, many systems are extremely vulnerable because in a foundational way they don't have security built in.

6:54And modern devices are better, but nevertheless there's still a lot of these weak systems out

0:00Alright, let's take a look at a summarization of what we've learned in this validation where we have three quiz questions that we'll take a look at to see how well we 've learned our material. Alright, what are specialized, excuse me, why are specialized systems sometimes insecure? Let's start at the bottom. They are always internet connected. Well, no, they're not always internet connected. Some of them are not actually internet connected at all, and so they're not vulnerable in that sense. Many of them were not originally internet connected and then modifications were made to connect them to the internet.

0:32Okay, so that's not particularly an answer right there. Number two right here, they are not insecure. Well, they are insecure in many instances, so you can't just categorically say they're not insecure. How about this one? They have aging electronic systems that can burn out. Well, that is an issue, but it's not a security issue. And more of a maintenance issue. Our correct answer here is they were not originally designed with security as a priority, and they were just designed to operate those machines, and they were usually pretty simple. But now that a lot of them have internet connections and potentially a way to access them potentially from a bad actor or a hacker, they might be able to modify what that machinery is supposed to do, for example, right?

1:16Let's take a look at this. What does CIA stand for in IT security? How about corporate infrastructure assessment, confidential insider access, neither one of those two are correct. How about the central intelligence agency? CIA does stand for that, but not in an IT security context. For that, we have confidentiality, integrity, and availability. What does physical security safeguard? Let's take a look at these. How about sabotage? Yeah, that would be one. Okay.

1:47You might want to sabotage the function of a company, right? And interfere with its operation or government or utility or something like that. How about theft? Certainly, we want to protect against theft. That's why we have security measures that in a lot of places might prevent an employee from walking out of the building with something valuable, for example. Or we didn't really cover this part of the material, but you'll see it later on . Some places, USB flash drives, you know, just like, oh, this kind of little thing here that you plug into a USB port as a little USB connection on there.

2:18A lot of times those are not allowed because you can steal information onto those, slip it into your pocket and walk out with something valuable that you're not supposed to have. How about damage? Yes. There are certain physical protections we can use to protect against damage of equipment. How about espionage? Certainly that as well, because that kind of relates to the theft. We could steal data that they're not supposed to be able to steal or otherwise access our resources.

2:48That's also why we have physical security measures such as, you know, badged access and things like this. So that only the appropriate people are supposed to enter the building or the work site and that it's not a spy, so to speak, or somebody who does not offer authority to access that location. And then internet attacks is not really a part of physical security. Although it's a concern just not for this particular topic.