Category: Cyber Security

You have been asked to be the project manager for an inventory tracking software

You have been asked to be the project manager for an inventory tracking software implementation project that the company will begin using. As the project manager, you want to create a PowerPoint presentation that will present to the project team the importance of effective communication.
Communication occurs not just among the project team, but also with the vendors, stakeholders, and others.
When considering project communication, it is important to identify the 5Ws and 1H of project communication. This includes the Who, What, When, Where, Why, and How.
Creating a communication management plan can help the project manager and the project team to organize and document the different process, types, and expectations of communication for the different people involved in the project.
You decide to use Trello to plan the different elements of your presentation. Trello is a tool for project managers who need a streamlined and visual way to keep projects on track. Trello takes organization to a new level with visual organizations where projects are organized by boards, which have corresponding cards that outline tasks and objectives for each project.
Instructions:
For this assignment, you must review the tutorials on the Trello.com website to create a free Trello account and use a communication tool to create a presentation that addresses the importance of project communication.
Your presentation should include the following:
Create the stakeholder communications requirement.
Determine what information needs to be communicated.
Offer details on how the information will flow among the project team and the stakeholders.
Identify methods of communication by presenting and justifying the different tools that can be used to support communication. Review the communication standards that you created in Week 4.
Include schedules for the various communications.
Identify communication escalation processes.
Identify the 5Ws and 1H (that are not mentioned above).
Identify the major obstacles of communication.
Incorporate appropriate animations, transitions, and graphics as applicable.
Length: 8-10 slides. Take a screenshot of your Trello cards and submit them in a Word document, along with a link to your presentation.
Notes: 100-150 words of speaker notes for each slide
The completed assignment should address all of the assignment requirements, exhibit evidence of concept knowledge, and demonstrate thoughtful consideration of the content presented in the course. The writing should integrate scholarly resources, reflect academic expectations and current APA standards

https://docs.google.com/presentation/d/1h6saeziMvM…
This is a discussion board

https://docs.google.com/presentation/d/1h6saeziMvM…
This is a discussion board limit to your team. Make three separate posts to share with them. In one post, list three keywords you found in the reading. Provide three things: (1) the keyword, (2) your definition of it, and (3) why you believe it is important.
In another post, pose two open-ended questions you have about this topic.
Stretch your own understanding. Ask a question that you can’t answer. Open-ended questions are complex questions that (1) get people talking, (2) cannot be answered with “yes” or “no” or a single word or short phrase, (3) may be provocative or controversial, and (4) cannot be answered with a simple search of the internet.
In another post, complete two sentence stems, making connections to your personal experiences, with enough detail to show that you can apply the current topics to your life experience. Suitable sentence stems are like the following: “This is like when…”, or “This remind me of…”
Return to this discussion board to address the open-ended questions of a colleague or support their selection of important keywords and life experiences. Make sure to engage with this discussion three times.

The Essential Elements of a Comprehensive Cyber security Plan

Cyber Prep & Communication: Swift Defenses

Today you only need to google “Cyberspace security challenges” to learn about the daily threats of hackers. These threats could be identity theft, criminal hackers, cyber espionage, or even the threat of insiders, whether it’s spiteful, mischievous, or unintentional. The bottom line is that everyone is at risk. An organization must be prepared to protect vital information within cyberspace with a Cyber Security Plan. Components of a Cyber security plan have elements to prevent breaches from happening and how to respond to such incidents quickly and mitigate impacts. A cybersecurity plan should have these elements in order to be effective; Basics of Security, Communicate with the organization/stakeholders, Framework, Threat Intelligence, Regulatory Factors and liability, Risk assessment, and Incident response planning.

Part of the planning process is avoiding problems from the start. Achieving this goal, or improving your odds of never having a disastrous breach, is to ensure basic security systems are running, including being current with security policies that are fully enforced. This would be in the form of; firewalls, intrusion detection systems, security incident and event managers, automated security monitoring and alerts systems, spam filters, access controls, strong passwords, encryption of sensitive data, and security software for smart devices, i.e., phones, watches, etc.

Communicating with the organization/stakeholders helps everyone to be ready at a moment’s notice in case of an attack. Predetermined roles should be established, which eliminates the guesswork. This allows the incident to be assessed and addressed. Because when it comes to data loss, minutes count. Employees should have the training to recognize tactics and attempts of an attack when it occurs. Examples of attacks are; social engineering and installing malicious software for data intrusion.

Framework & Intel: Cyber Resilience

Framework is an important element within cybersecurity risk management. It provides direction across the board, including technologies and organizational processes. With Framework, you will have a plan for dealing with a cybersecurity incident and avoid any guesswork about what to do. The Framework SOP (Standard operating procedure) should cover all organizational processes. This includes elements outside of the organization, i.e., vendors and smart devices.

Threat intelligence and being informed can make you more secure and able to respond more efficiently to attacks. Ultimately an organization must be able to identify signs of attack techniques and indicators as reference points. Threat intel uses these indicators and insights into known and emerging threats to an organization. Having this knowledge can help with split-second decisions the moment a cyber incident occurs. Vulnerabilities like sharing passwords, unpatched software and operating systems, infrastructure configurations, and operations provide a context to the threat. Recognizing this will provide the threat intelligence needed to appropriately respond when an attack or incident occurs.

Regulatory factors and liability to a breach need to be addressed as well, depending on your organization. Do you risk fines or other penalties if data is exposed? Having a detailed audit log that shows what happened before, during, and after a breach will be helpful in the case of a data breach. This could help indicate if security negligence was to blame for the breach.

Risk Assessment & Readiness: Proactive Defense

Risk Assessment refers to having a model of threats based on the risk identified, the likelihood of it occurring, and the damage it could do to your organization. Actions taken should involve identified personnel and prioritize threats/attacks, and what steps are taken to remedy them are known by all within the organization. Security managers need to think like a hacker and determine what is of most value and focus resources to protect such valuable data.

Incident response planning includes the latest improvements, training, and preparation. This ensures all know how to act and what to do once a threat is detected. However, sometimes with all prevention efforts, a breach can happen. Cybersecurity threats are constantly evolving. That’s why an organization must be proactive with improvement, training, and preparation. Every process and plan should be tested regularly and kept up to date. Outdated response plans will be ineffective. If your response plan and Framework are in place, all personnel and risk management programs will be able to act when the day comes of a breach/attack.

References:

1. Anderson, R. (2008). Security Engineering: A Guide to Building Dependable Distributed Systems. Wiley.
2. National Institute of Standards and Technology (NIST). (2018). NIST Cybersecurity Framework. Retrieved from https://www.nist.gov/cyberframework
3. Simic, M., & Vasic, N. (2019). Cybersecurity Incident Response: A Comprehensive Guide to Best Practices, Tools, and Techniques. Apress.
4. Rouse, M. (2017). Threat intelligence. TechTarget. Retrieved from https://searchsecurity.techtarget.com/definition/threat-intelligence
5. European Union Agency for Cybersecurity (ENISA). (2019). Guidelines for SMEs on the security of personal data processing. Retrieved from https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-terminology-guidelines/csirt-terminology-guidelines/csirt-terminology-guidelines-2018
6. United States Computer Emergency Readiness Team (US-CERT). (2018). Incident Handling. Retrieved from https://us-cert.cisa.gov/bsi/articles/knowledge/cybersecurity-incident-handling-guide
7. Computer Security Incident Response Team (CSIRT) Services Framework. (2015). FIRST. Retrieved from https://www.first.org/education/csirt_services_framework.pdf
8. Kizza, J. M. (2015). Computer Network Security and Cyber Ethics. McFarland.
9. Blyth, A. (2019). Information Security Incident Management: A Methodology to Manage and Resolve Security Incidents. Apress.
10. Schwartau, W. (1991). Information warfare: Chaos on the electronic superhighway. CyberPress.

Safeguarding the Digital Realm: Exploring the Core Tenets of Cyber Security

Understanding Cyber Security

Cyber security specialists today enlist strategies that exhibit due care toward three major necessities in information assurance: confidentiality, integrity, and availability, also called the CIA triad. That focus doesn’t change; no matter what technology does, it stands as a foundation to protect regardless of all other factors. Physical, operational, and technical security controls can all counter the threats to each division of the CIA triad. All are equally important, and you need an understanding of what confidentiality, integrity, and availability mean in relation to information security.

To realize our goals as security professionals, we should take note of the overarching theme of “risk management” throughout the cybersecurity community and the accurate implication that there will always be a risk. It can never be completely removed; we can only manage it to reduce it to acceptable levels. There are many ways to do so, and each control that we learn about will be an example of a risk strategy, such as risk avoidance, risk deterrence, and risk mitigation.

Importance of Information Assurance

It’s more important than ever that organizations protect the information they hold, whether it be proprietary documents, financial records/accounts, or employee and customer private information. We’ve seen an enormous rise in the number of attacks on company security infrastructures that have successfully exploited poor security practices, and in other cases, the company’s poor practices resulted in a breach with no intervention by an external entity. An ongoing report by the Identity Theft Resource Center reveals a detailed explanation of every known and reported data breach occurring in the calendar year 2018. They described 668 known breaches exposing 22,408,258 records.1. This is an insane count and only a portion of the actual breaches that affect more than personal information across all industries.

Data breaches are one exploit that threat agents use to surpass controls protecting confidentiality. They can be compromised by social engineering in a weak physical security environment or through the use of technology to take advantage of poor network configurations. Confidentiality is what keeps unauthorized individuals from accessing information. Authentication is a vital aspect of maintaining confidentiality by verifying the identity of authorized individuals to then grant access to the information requested.

In A+ Guide to IT Technical Support, the authors explain how Windows computers do this (as well as most other systems you will use). By requiring sign-in with a secure password when first signing on and when the computer goes to sleep, they ensure the authorized user is on the system and given access to the files and information stored on that profile. A good practice is to lock your workstation when leaving it to enable this feature manually and make sure you have a secure password that isn’t easy to guess or be attacked via brute force.2.

Password authentication is one of the most basic forms of access control that provides confidentiality. While other security implementations, such as encryption, may prove more effective in a wider range of environments. New standards for encryption have been developed over the past several years and are currently as secure as it has ever been. Old encryption standards have either been cracked, or their keys are easily accessible to malicious people. The impact on a business and the thousands of customers it serves is potentially severe without proper protection of confidentiality, thus calling for diligent conservation of information assurance in the realm of confidentiality by senior leaders responsible for its protection.

“Integrity first,” the first core value of the United States Air Force, means that, above all, we do the right thing even when no one is looking. But how do we know if what we are seeing is the “right thing” and hasn’t been tampered with? In a cyber world, this is especially valuable, yet there are so many avenues of communication in technology that it can seem daunting to figure out what is accurate and who really said or created it. The implementation of hashing is one way people have used technology to ensure that data has not been changed.

Hashing takes the data and, through the hashing function, returns a fixed-length string of characters that is extremely rare to result in the same string for any other set of data. Encryption does not ensure integrity. People can change data without ever finding out what it is, such as cutting a competitor’s bid request value by half on an online auction without knowing what their bid was.3. What that tells security professionals is that it is important to have multiple layers of security that envelope every aspect. This layered approach is widely accepted in government and industry worldwide.

We need to be sure that the information we are protecting is not changed. It is just as significant as protecting it from unauthorized exposure. Technology has made the world of business, healthcare, and finance fly like the wind in terms of speed. This is great! Experts are contributing to this growth daily, and we are becoming better at everything. The only problem is the “bad guys” are getting better every day, just like the rest of us, sometimes much quicker. It may seem like the integrity of information is the least probable threat vector, but with the amount of malicious intent in the attackers of the 668 public attacks in 2018, including those unknown, or ongoing attacks, it has been determined to be a popular exploit.

After all, consider common email scams, phony IRS claims, and originating authors who could be debunked with proper measures to protect integrity and non-repudiation. Phishing, whaling, and other intra-corporation email ploys are easily recognized as such with proper personnel training in security awareness. However, in more sophisticated attempts, the use of hashing algorithms can alert of changed emails in transmission depending on the type of attack.

I laude today’s innovators and developers who continuously grow the capability of people through the use of technology and other tools. It’s exciting to see the explosive growth of the cyber industry, and in turn, cyber security is growing just as fast in parallel. We know it’s important to protect information. We’ve seen the consequences of poor security practices. However, when we place so many controls on our infrastructure, we can reduce the availability of our resources. Sometimes, it is not our control but everything that is out of our control that degrades availability. Natural disasters, sole dependence on external entities, and certain attacks have all proven their terror throughout history.

One common-sense practice is to routinely back up systems to reliable hardware to mitigate risk and/or cloud-based backups to transfer risk to the cloud provider. This way, information would be recoverable in case of emergency or loss. DoS (Denial of Service) and DDoS (Distributed Denial of Service) attacks both directly target the availability of one’s network or system resources. In one case occurring in 2016, Hollywood Presbyterian Medical Center had its database compromised, and the attackers encrypted the entirety of their information and demanded a ransom in Bitcoin for anonymity (approx. $17,000).

This severely slowed duty performance down. No access to customer records other than paper in unused files. They had to go back to old-school pen-and-paper bookkeeping. Some patients in intensive care situations had to be moved, and others were inconvenienced by the hospital’s inability to verify and supply medications or information over the phone or email. Ultimately, within a couple of weeks, they paid the ransom.4. Imagine the effects this lack of availability had on them to cause them to just pay the price. We should strive to prevent these situations as security professionals by looking at every square inch of our security posture. We must calculate risk and reduce it to an acceptable level.

There are innumerable attacks employed by individuals that threaten these core tenets of security, and a deep understanding of them and how to defend against these attacks will prove valuable in securing the information we use every day. As we can see, it is not only important to keep one aspect of security in mind, but all three work together and cover the empty spaces left by the others. Defense-in-depth is the strategy that holds to this standard by layering security controls and ensuring the inclusion of each of the triad’s members and all other considerations relative to risk management and security awareness. Threats come from inside and out, and we must be prepared and properly trained to handle incidents from any source.

References:

1. Identity Theft Resource Center, and Cyber Scout. “The ITRC Data Breach Report.” Idtheftcenter.org, Identity Theft Resource Center, 30 June 2018, www.idtheftcenter.org/wp-content/uploads/2018/07/DataBreachReport_2018.pdf.
2. Andrews, Jean, et al. CompTIA A+ Guide to IT Technical Support. Cengage Learning, 2017.
3. Jung, E. J. “Hash Functions.” Www.cs.usfca.edu, University of San Francisco, Department of Computer Science, www.cs.usfca.edu/~ejung/courses/686/lectures/05hash.pdf.
4. “Ransomware Case Studies: Hollywood Presbyterian and The Ottawa Hospital.” InfoSec Resources, InfoSec Institute, resources.infosecinstitute.com/category/healthcare-information-security/healthcare-attack-statistics-and-case-studies/ransomware-case-studies-hollywood-presbyterian-and-the-ottawa-hospital/#gref.

Emerging Cyberse curity Challenges in the Age of Connectivity

On my first day on the job in the information security department, one of the first goals was to set the top 5 security threats.

These five threats include:

1. Phishing – 90% of cyberattacks begin with phishing. This includes the form of what seems like real-life legit emails that seduce users to reveal private and personal information. These forms are meant to seem harmless, although they contain links that install malicious software that can really harm your machine.
2. DDoS – Distributed denial-of-service is an attack that occurs when several systems overrun the bandwidth or resources of the servers.
3. Data Breach – A breach or infringement of our private information which is sold to different parties or used in other ways.
4. Ransomware – Malicious software that encrypts our information and then requires the amount of the ramson to be paid for us to gain back our information. If the ransom is not paid up, the threat of the information could be released to the public.
5. IoT Vulnerabilities – With everything connected to the internet, such as security cameras, smartwatches, and other devices owned by students and faculty, presents back doors for hackers. These are back doors because they usually lack security and or are not updated regularly.

Ransomware’s Costly Grip: Pervasive Threats

Out of the threats listed, the most prevalent include ransomware and malware; these are more costly than data breaches. Five months into 2019, around May, ransomware caused 11.5 billion in damages. This means that someone becomes a new victim every 14 seconds. Due to how ransomware works, it can be the most costly and frequent. Also, if the ransom is not paid in the amount of time listed, the amount of data that could be sold to other parties can be severally damaging to any organization. Now today, there is a new type of ransomware which is crypto-jacking. This ransomware encrypts software to attack a victim and unknowingly installs a program that secretly mines for cryptocurrency, which can severely damage and slow down an organization’s network.

These are the most common threats due to the perfection of their techniques. A lot of organizations have also had a tough time addressing these threats. A large amount of the time, it is more costly to have these vulnerabilities fixed by a professional, so administrators and higher-ups in these organizations decide to just keep paying the ransom every time. This is extremely negative since a large amount of information can still be taken even if the ransom is paid.

Emerging Cyber Risks

Malware is also the most common type of cyber-attacks. This includes spyware, ransomware, viruses, and worms. Making sure an organization’s network and infrastructure are safe from malware is a constant battle. Although the more threats that will be more critical in the next 12 months include IOT issues becoming worse due to the new 5G technology. 5G is a new upgrade to cellular network technology that proposes faster speeds and bandwidth. Over 265 million mobile device users are in the United States due to 5G expansion among major cities. The prediction from hill.com states that the expansion of 5G will continue to grow, and the vulnerabilities will also grow; these vulnerabilities will also be unknown to the average person. The new infrastructure will have to support 5G; if this does not happen, more and more devices will be at extreme risk.

Another major risk that could come up in the next year could be ready-to-use hacking toolkits. Toolkits are already available for the average Joe to use, so, therefore, more and more will become which could be easier and easier to use. With these toolkits, an attack could come within the organization, which is internal that could be very good a googling. This could be a threat within the school itself; this internal threat could be a student or someone in the faculty.

Internal problems could not only be intentional by someone within but instead internal by accident. Since 5G is coming in hot and all students have tablets and smartphones that run on IOS and Android, these devices must be updated regularly since they are connected to the campus network. Lastly, I believe all Linux servers should be abandoned and adopted by all Windows servers. Linux is good but does not support a campus; Linux is free and sets for beginners that hold areas for hackers to get in; Windows is much more secure and advanced.

References:

1. https://thehill.com/opinion/cybersecurity/479316-2020-cybersecurity-predictions-evolving-vulnerabilities-on-the-horizon
2. https://www.csoonline.com/article/3505263/malware-the-battle-that-doesn-t-end.html
3. https://www.cisco.com/c/en/us/products/security/common-cyberattacks.html#~types-of-cyber-attacks
4. https://www.bankinfosecurity.com/interviews/interview-raimund-genes-ransomware-virus-total-issue-i-3328
5. https://www.zdnet.com/article/five-emerging-cybersecurity-threats-you-should-take-very-seriously-in-2019/
6. https://www.masergy.com/blog/the-top-five-cybersecurity-threats-to-watch-out-for-now
7. https://www.cosn.org/sites/default/files/Top%205%20Cybersecurity%20Threats.pdf

Cyber security Risk Management: Historical Trends and Mitigation Strategies

Managing the Risk of Cyber-Attacks

Last year, the average cost of cybercrime globally reached $11.7 million per business (“Cyber Crime Costs $11.7 Million Per Business Annually,” 2017). This cost is expected to grow exponentially and reach an average of $150 million by 2020 (Ogborn, 2018). Because the frequency, severity, and number of exposure units have been observed to grow over the past century, this paper will first examine the historical background to see which underlying historical trends have helped to create the current cyber environment (Morgan, 2017; Ogborn, 2018).

Next, the paper will identify the direct and indirect losses and recommend a number of risk management techniques that a business can implement to prevent or reduce the losses. Consequently, it will enumerate a number of steps a company can take to recover from the cyber-attack. Last but not least of all, this paper will examine the attack on Target and the company’s path to recovery.

Historical Background

Although people tend to think of cybercrime as something that originated in the last two or three decades with the discovery of the Internet, cybercrime has been around for over 100 years. The first known occurrence of cybercrime came to be in the 19th century with the invention of the wireless telegram (Fell, 2017; McMullan, 2015). In 1903, during the first public demonstration of the technology, Nevil Maskelyne, an inventor and wireless technology enthusiast, hacked the telegram to send Morse code messages in disapproval of the invention.

The next wave of cybercrime came in the late 1950s with the “phone phreaks,” or phone hackers that would listen to tones emitted by phones to find out how the calls were routed (Fell, 2017). The phone phreaks would then imitate these tones to switch the calls from the phone handset and allow themselves to make free calls around the world.

The major wave of cybercrime came with the growing use of email in the late 1980s (Fell, 2017; “Where Does Cybercrime Come From?” 2017). Since that time, phishing scams and malware have been conveniently delivered to people’s inboxes. The development of web browsers in the 1990s increased people’s exposure to new, more hidden forms of cybercrime, such as viruses (“Where Does Cybercrime Come From?” 2017). The frequency of cybercrime increased dramatically in the early 2000s with the widespread use of social media. The increasing number of people putting their personal information into a profile database created a treasure trove for identity thieves, which then used the information to gain access to bank accounts and open new lines of credit.

Today, nearly everyone has a footprint on the web, including large companies. Because of this, cybercrime has become even more attractive than ever before. Not only have the prospects for hackers increased, but the losses to people and businesses continue to grow on a yearly basis. On average, the cost of a data breach by 2020 will be over $150 million (Ogborn, 2018). The overall global cost of cybercrime today is around $600 billion, or about 0.8 percent of the global GDP.

Companies that fall victim to cybercrime often pay high legal fees and suffer losses in both income and reputation. In 2013, Target lost $890 million in market value the day it announced its cyber breach, which resulted in the loss of nearly 40 million customers’ credit card information and other data (Palmquist, 2018). On a similar note, Yahoo lost a whopping $350 million off its sale price when it announced in 2016 that it had been a victim of a data breach that compromised three billion user accounts (Armerding, 2018).

Loss Exposures Associated with Cybercrime

As more people and businesses become interconnected via the Internet, the number of exposure units continues to grow. Not surprisingly, the frequency of losses is also increasing. Cybersecurity Ventures predicts that by 2019 a business will fall victim to ransomware every 14 seconds as opposed to every 40 seconds in 2017 (Morgan, 2017). According to Ponemon Institute, the severity of losses is also growing at an alarming pace.

In 2017, the average cost of cybercrime globally reached $11.7 million per business, which was a 23 percent increase from $9.5 million in 2016 (“Cyber Crime Costs $11.7 Million Per Business Annually,” 2017). Seeing these statistics, one may not surprisingly wonder where these costs come from. To answer this question, one may have to look at both direct and indirect losses associated with a data breach. Studies show that businesses suffer a variety of losses during and after a data breach. These losses include damage or loss of personal and financial data, stolen money, loss of productivity, theft of intellectual property, legal expenses, damage to reputation, and recovery expenses.

Stolen money. Cybercriminals can impose a direct and immediate financial cost on a business when they gain access to the financial accounts and transfer the funds to the accounts they control. Even banks, which are often thought to have the strongest cyber security protection, are not immune. In the years 2016 and 2017, in a time span of just 18 months, Russian hackers called “Money Takers” stole a total of $10 million from U.S. and Russian banks (Reevell, 2017). Hackers do not have to break into a company’s system to steal money. In 2016, businesses unknowingly wired over $360 million to cyber criminals that posed as corporate executives or suppliers in emails (Reuters, 2017).

Stolen intellectual property. Hackers may also steal intellectual property, such as trade secrets or future company plans, and attempt to sell this information to competitors (Deloitte, 2016). Because intellectual property helps innovation and growth, the loss of this information may not only increase costs but also lead to the failure of small and medium businesses (Deloitte, 2016; Lewis, 2018). According to the Center for Strategic and International Studies, the theft of intellectual property constitutes, at the minimum, a quarter of the cost of cybercrime (Lewis,2018).

Damage to reputation and loss of personal and financial data. In the first half of 2017, nearly 2 million data records were compromised (Graham, 2017). This constituted a 164 percent increase from the year prior. Because a large percentage of the sensitive records stolen are usually filled with confidential customer data, reputational damage and liability risk are very real concerns to a company and its brand (Eubanks, 2017; Puzas, 2017). Data breaches often lead to a loss of trust in the company and a lack of confidence in the company’s ability to keep customer data safe. As a result, customers are less likely to buy from companies that could mismanage their information and put them at risk of identity theft. As one can imagine, losing customers, especially those who were once brand loyal, negatively affects a business’s bottom line.

Legal costs. Following a cyber-attack, a company may be faced with class-action lawsuits from customers who have been affected. Target, Home Depot, and Sprouts are just a few of the many businesses that have had class-action lawsuits filed against them. In May 2017, Target paid a whopping $18.7 million settlement over the 2013 data breach that affected more than 40 million of its customer payment card accounts (Eubanks, 2017). Data breaches can also draw hefty fines from the Federal Communications Commission, Federal Trade Commission, Health and Human Services, the Payment Card Industry, Data Security Standards, and other regulatory agencies (Puzas, 2017).

Decreased profitability. According to Nick Eubanks of the Young Entrepreneur Council, “Market perception is directly linked to how company security is managed (Eubanks, 2017).” The reason for this is that an estimated 85% of business assets are in digital form. Taking this into consideration, it is no surprise that negative press regarding a cyber-attack can provoke the “sell now” groupthink. Investors want to feel that their money is safe with a company; they want to feel like they can make a profit. When the majority of the company’s assets are under attack, they want to be out and out quickly. According to a study by the critical security provider Gemalto, two-thirds of the 65 companies breached had their share price negatively affected (Graham, 2017).

Recovery expenses and lost productivity. Following a cyberattack, opportunities and income are foregone, and business activities are interrupted by the need to spend money and time on recovering hacked data and bolstering cyber security (Lewis, 2018). Profitable projects may have to be postponed or even canceled as money is diverted away to deal with security issues. According to Business Insider, it costs an estimated $1 million on average to resolve a cyber-attack (Puzas, 2017).

Dealing with the Loss Exposures

The most direct loss exposure to a company that uses the net to store its data and communicate with its stakeholders is the loss or theft of data. As mentioned earlier, this loss exposure is growing in frequency and cost every year. To reduce the frequency and severity of losses, a company can use a variety of risk control techniques such as loss prevention, duplication, and separation. Because no business is immune to cyber-attacks, it is also a good idea to use risk financing techniques such as active retention and cyber-insurance to deal with indirect losses such as legal costs and recovery expenses.

Loss prevention. The support and commitment of the Board of Directors and senior management are vital to the successful implementation of a risk management strategy (CPNI, n.d). These two groups should actively communicate the organization’s attitude and approach to risk management throughout the organization to make certain that employees, contractors, and suppliers are aware of the risk level the organization is willing to take on. Training employees in cyber security principles and limiting their access are two ways to reduce the risk of data loss or theft.

Employees should be trained to use two-factor authentication, regularly change passwords, and recognize suspicious emails (Cap Coverage, 2018). They should also only be given access to the data and information they need to do their job. It is also very important to install, use, and regularly update antivirus and antispyware software on all computers used by the company. To make sure that the appropriate security measures are maintained, the company must conduct regular network penetration tests and cyber-attack exercises (CPNI, n.d.). The deficiencies in protection need to be corrected immediately or as soon as possible.

Duplication and separation. In case data is stolen or lost, it is a good idea to keep copies of important business data and information (Cap Coverage, 2018). A company can also limit its losses by dividing the assets exposed to a loss and keeping them separated. To do this, a company would identify, group, and isolate important business data and control for the risk of each group (Cap Coverage, 2018; CPNI, n.d.). This way, if a loss occurs, only one group suffers a loss, and the company can still continue certain business operations.

Cyber-insurance. Because the losses associated with a cyber-attack are very high, cyber insurance can help deal with some of the indirect losses (HUB International Limited, 2018). Cyber insurance coverage varies and usually covers only a part of the loss. Areas more commonly covered by cyber-insurance include privacy attorneys, IT forensic investigation, compliance with state notification laws, credit monitoring for breached individuals, PR firm to manage the crisis, regulatory fines, and class-action lawsuits resulting from the breach. Currently, the top cyber insurers are AIG, Chubb, Hiscox, Liberty Mutual, and HSB (Cyber Policy, 2018).

Handling the Existing Risk and Returning to “Normal”

As mentioned earlier, it is nearly impossible to prevent all cyber-attacks. When a cyber-attack occurs, a business is likely to experience decreases in its operational abilities, downtime, reputation, and revenue (Alvarez Technology Group, 2018). To limit these losses and ensure operational continuity, a business needs to have a response and recovery plan in place in case an attack occurs. The response and recovery plan should serve as a guideline for organizing the incident response team, securing systems and ensuring business continuity, conducting an in-depth investigation, managing public relations, and following legal and regulatory requirements (Rossi, 2015).

Incident response team. To deal with cyber-attacks in a comprehensive and effective manner, a business must establish an incident response team (Rossi, 2015; Walker & Associates Insurance, 2018). The incident response team should consist of relevant internal stakeholder groups. Typically, this team includes HR and employee representatives, a technical team, a legal team, intellectual property experts, data protection experts, and public relations representatives (Rossi, 2015).

Securing systems and ensuring operational continuity. To prevent continued data exposure and loss, a breached business needs to take certain security measures (Rossi, 2015; Walker & Associates Insurance, 2018). Although doing this can be very disruptive and costly, a business may have to quarantine or suspend a compromised portion of the network. Other systems may also have to be monitored to make sure that any other breaches are detected promptly. After detecting the losses, the business should check whether they are covered under the insurance policies (Vitale, 2016). If they are covered, the insurance company needs to be notified in a timely manner.

Conducting an in-depth investigation. An important step to take after a breach has occurred is to carry out an in-depth investigation (Rossi, 2015). This investigation should determine the cause of the breach, the breach’s effects, and the remedial actions that need to be taken. Should an employee be involved in the breach, the investigation also needs to consider all relevant labor laws and involve HR personnel. To be able to demonstrate appropriate handling of the situation and to notify those affected by the breach, the investigation needs to be appropriately documented (Walker & Associates Insurance, 2018). Furthermore, the business should integrate the feedback from the investigation into its current response and recovery plan to prevent similar breaches.

Managing public relations and following legal and regulatory requirements. To avoid detrimental reputational damage and additional legal consequences, the business should follow the security breach notification laws in informing those affected by the breach (National Conference of State Legislatures, 2018). The accuracy and timing of notifications are especially important. Helpful complimentary services such as credit screening can also be offered to help save the customer relationship (Rossi, 2015).

Closing the Loop With a Real-Life Case

Not many cyberattack stories have happy endings. Costs associated with diminished consumer trust, damaged reputation, class action lawsuits, and stolen intellectual property can be detrimental and even deadly to a business. Target, one of the largest retailers in the U.S., goes to prove that recovery and even growth after an attack are possible if the appropriate measures are taken. The following three sections explain the cyber-attack, the measures taken, and the result.

Cyber-Attack on Target

In November 2013, hackers stole forty million credit and debit card records using stolen third-party vendor credentials (Hong, 2017). This hack was largely the result of negligence. Target delayed the investigation of suspicious activity and failed to implement even the most basic security measures, such as the separation of cardholder data from the rest of its computer network (Finkle, 2014; Hong, 2017). The theft negatively affected the retailer’s reputation with customers, decreased sales, and resulted in $202 million in legal fees and other post-breach costs (Hong, 2017).

How have things changed? Five years and a CEO later, Target has made large strides towards regaining consumer trust and recovering financially. To prevent future attacks, the company has limited vendor access and separated its cardholder data from the rest of its computer network (Target, 2018). It has also installed whitelisting applications on its point-of-sale systems to allow only known web traffic to access its systems (Target, 2018). To ensure the security of accounts, the company implemented password rotation policies and two-factor authentication (Target, 2018).

Not to mention, Target became the first major issuer to use chip and PIN credit cards in the United States (Harris, 2017). Unlike credit cards with magnetic stripes, credit cards with EMV chips are more difficult and expensive to duplicate, which makes them more secure. That is to say, Target’s credit cards became some of the safest in the nation. To better detect suspicious activity, the company also improved its auditing and logging of security-related events with supplementary rules, alerts, and a centralized log feed (Target, 2018). As a result, the company can now better monitor user activity, document regulatory compliance, and perform forensic analysis.

Did these changes help? Target’s sales have more than recovered. In fact, the company just reported its best quarterly sales in over a decade (Bhattarai, 2018; Safdar, 2018). Total revenue grew 6.9% to $17.78 billion, increasing the company’s annual earnings prospects. According to Target Chief Executive Brian Cornell, this growth is not only attributable to the booming economy but also to the increase in market share Target has gained in various categories ranging from electronics and homewares to toys and apparel (Safdar, 2018).

References:

1. Cyber Crime Costs $11.7 Million Per Business Annually. (2017). Retrieved from https://www.securitymagazine.com/articles/88134-cyber-crime-costs-117-million-per-business-annually
2. Ogborn, J. (2018). Cyber Attack Trends: 2018 Mid-Year Report. Retrieved from https://www.varonis.com/blog/cyber-attack-trends-2018-mid-year-report/
3. Morgan, S. (2017). Cybersecurity Ventures. Retrieved from https://cybersecurityventures.com/
4. Fell, J. (2017). A Brief History of Cyber Crime. Retrieved from https://www.safetydetectives.com/blog/history-of-cyber-crime/
5. McMullan, T. (2015). Cybercrime: A Short History. Retrieved from https://www.itgovernance.co.uk/blog/cyber-crime-a-short-history
6. “Where Does Cybercrime Come From?” (2017). Retrieved from https://www.kaspersky.com/resource-center/threats/where-does-cybercrime-come-from
7. Palmquist, R. (2018). Target Corporation Data Breach: A Case Study of What Not to Do. Retrieved from https://dmi.com/target-corporation-data-breach/
8. Armerding, T. (2018). The 17 biggest data breaches of the 21st century. Retrieved from https://www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html
9. Deloitte. (2016). Intellectual property theft: A growing threat. Retrieved from https://www2.deloitte.com/global/en/pages/risk/articles/intellectual-property-theft.html
10. Lewis, J. (2018). The true cost of cybercrime. Retrieved from https://www.csis.org/programs/technology-policy-program/significant-studies-cybercrime

Leveraging Data Science and Machine Learning for Enhanced Cyber security

Rising Threats and Evolving Tactics

Today, the world we live in is advancing in each field, especially in terms of technological development. Any work can be done through smart devices. The biggest boon for our century is the internet. With that, we can know what is happening around us and in every part of the world. With the increase in the technological aspects and flexibility of doing things online, the risk of cyber-attacks is also growing exponentially.

Data science is one of the top emerging technologies that has proven to aid many organizations, and cyber security is not an exception for that. Data science includes many machine learning algorithms that are used for predicting cyber-attacks in advance. Existing Cyber security techniques could be helpful in preventing the attacks or threats as they occur, but with data science, these attacks could be predicted in advance and take necessary steps to avert them completely. This paper gives a general introduction to what Data science is and how that can be used in Cyber security, along with some basic machine learning algorithms.

Machine learning is one of the topmost emerging technologies that is currently booming the business of any type of organization. Generally, data science is the field of extracting and analyzing the data. This process involves extracting useful information from either structured or unstructured data that has been collected from various sources. As the data is collected from multiple sources, it would be generally unformatted data. For the analysis process, data should be in an organized manner. Then by using machine learning algorithms and tools, the information can be analyzed to make predictions about unexpected events.

Data Science helps in predicting the actions that might occur by analyzing past data. Most organizations are implementing data science in their business activities in order to predict possible activities. The task of data analysis is performed by the data scientists. They establish a working relationship with the stakeholders in order to know which information is to be analyzed so that they can find the algorithms that need to be used to run the data models that might help in business growth.

On the other hand, Cybersecurity is another big thing happening in the world. Security is needed everywhere and for everyone, especially when we are dealing with devices online. Cyber security deals with threat management issues related to any type of organization. It provides the procedures and methods that can be used to prevent cyber attackers. Also, they aid in recovering from the attacks. Generally, hackers and attackers with malicious intentions try to steal confidential data from devices through various attacks.

A cyber-attack involves stealing, modifying, or deleting sensitive data from a system or accessing another’s system without their knowledge. There are innumerable cases where many industries have lost millions of dollars because of cyber threats. Hackers can target either an individual or a group of people in order to gain access to the systems. These attacks come in different forms. Some of the attacks that are frequently used by the attackers are phishing, a man-in-the-middle attack, denial-of-service attacks, viruses, malware, etc., and Social engineering attacks, which are the most commonly used attacks on individuals and on employees of any company. In this method, the hacktivist’s main goal is to make the target believe that they are legitimate and trust them.

Relationship between Machine learning and Cyber Security:

Data analysts use machine learning tools in order to conduct a thorough analysis of the collected data to reveal trends and patterns. For example, based on the analysis, future occurring attacks can be predicted so that necessary preventive measures can be taken by the organization. Cyber security uses a wide range of tools and intrusion styles in order to monitor the activities on the devices and to stop dangerous activities. They come into action only when any unusual things happen. But data science can be used for both enhancing and simplifying cyber security tools. By using past and present data as input to machine learning algorithms in data science, the possibility of the occurrence of future attacks can be estimated.

Another biggest concern about a cyber-attack is losing valuable information. Cyber security uses encryption algorithms in order to prevent the loss of data from an organization’s database. But, by using data science, inaccessible protocols can be developed. For instance, by analyzing past data, spending a huge amount on the detection and response phases. But no organization is sure of the results because if they find new countermeasures for the attacks, then the attackers are also taking new forms to exploit the systems.

This is where data science comes in. Most companies these days have a team of data scientists, but they do not work in security. Data scientists working with the security team can inform what the data needs to be focused on. on As the organization starts to look to gain continuous visibility to risk and security performance, there are three critical questions that need to be answered. They are:

1. What are the available data and the quality of the available data?
2. What does that mean for the insight we can get in?
3. What is the plan to follow and to improve data sources to answer the questions that matter most?

The Impact of Data Science on Cybersecurity:

Generally, data scientists use machine learning tools and algorithms to predict cyber-attacks and to stop them. So that the data scientists can identify the risks based on past attacks, machine learning algorithms can find the attacks that might take place by analyzing the past data. This is very useful to organizations that are prone to attacks. Machine learning tools can also be used to make repetitive security tasks occur automatically.

Machine Learning in Cyber Security:

Generally, any machine learning algorithm that is used in cyber security contains two phases which are the training phase and the protection phase.

• Training Phase: In this phase, both positively labeled and negatively labeled features are given as input to a system which makes a predictive model out of that.
• Protection Phase: In this phase, the predictive model identifies whether the incoming feature is benign or harmful.

Clustering Algorithm:

Clustering is a technique of separating the data points which are of the same kind. That means all the data points in a cluster contain similar features, and those features are different from the data points of another cluster.

The above figure represents the clustering algorithm in a two-dimensional space. The x-axis and y-axis represent two different features, and the input data is represented in the form of data points in that space. The algorithm involves several steps. They are:

Step 1: Firstly, the input data is represented in data points in two-dimensional space, then two random points are selected from all the data points.

Step 2: In the second step, the distance from each selected point to the rest of the points in that space is calculated.

Step 3: The points which are nearest to the selected points are formed into clusters. As there are two selected data points, there will be two clusters.

Step 4: After the clusters are formed then, the mean point of each cluster is determined. The mean is calculated as the sum of all the data points divided by the number of data points. As there are two clusters, two means are determined in our example.

Step 5: In this step distance from each mean point to all other points is measured, and the nearest points to the mean points are again formed as clusters.

Step 6: Steps 4 and 5 are repeated until we get the same mean points consecutively. Then the clusters formed are considered the final ones.

Initially, all the incoming executables are sent into the algorithm. Then based on the number of clusters required, the initial clusters are formed. Then as explained in Figure 1, after several iterations, final clusters are formed. In this way, the clustering algorithm is used to identify the malicious objects in a network.

Challenges:

By using a clustering algorithm in the field of cyber security, any unusual activities on the network can be identified immediately, and the chances of the occurrence of attacks can be predicted. But there are a few challenges that a data scientist is facing. Those include:

1. Number of Clusters:

Identifying the count of the clusters that need to be formed is a difficult task because without knowing the exact clusters, the analysis may not be appropriate to consider. Also, there is no perfect way to determine the number of clusters.

2. Distance Measuring:

The distance can be calculated by using Manhattan, Euclidean, or the maximum distance measure. Finding the correct method of measuring the distance based on the labels is difficult.

3. Choosing Initial Data Points:

Choosing the initial data points is very crucial as the rest of the functions depends on that.

Conclusion:

Cyber security and machine learning can help many organizations in identifying and predicting several cyber-attacks in advance. Companies are losing millions of dollars as a result of cyber-attacks each year. Machine Learning algorithms are used to predict the possibility of the occurrence of data breaches in advance based on past data. Clustering is one such algorithm that is used for identifying malicious objects in a network. The importance of data science in cyber security and functionality and one example of a clustering algorithm are explained in this paper.

References:

1. Howe, S. (Jul 18, 2018). The Value of Data Science in Security. Retrieved from: https://www.csoonline.com/article/3500646/the-value-of-data-science-in-security.html
2. James, M. (August 27, 2019). How To Improve Cybersecurity With Data Science. Retrieved from: https://www.smartdatacollective.com/how-to-improve-cybersecurity-with-data-science/
3. Tianfield, H. (2017). Data Mining Based Cyber-Attack Detection. Retrieved from: https://www.researchgate.net/publication/321491605_Data_Mining_Based_Cyber-Attack_Detection
4. Drinkwater, D. (December 12, 2017). 5 Top Machine Learning Use Cases for Security. Retrieved from: https://www.csoonline.com/article/3240925/5-top-machine-learning-use-cases-for-security.html
5. Raghupathi, K. (2018). 10 Interesting Use Cases for the K-Means Algorithm. Retrieved from: https://dzone.com/articles/10-interesting-use-cases-for-the-k-means-algorithm
6. Agarwal, P., Alam, M. A., & Biswas, R. (2011). Issues and Tools of Clustering Algorithms. Retrieved from: https://www.semanticscholar.org/paper/Issues%2CChallenges-and-Tools-of-Clustering-Agarwal–Alam/7b49bd891f632ca6e86e5ccccdc3761ceb3fd277

Cybersecurity technical experts only: Make sure you break down all the tools li

Cybersecurity technical experts only: Make sure you break down all the tools like example burpsuite tool all the features or Nmap tool all features it has. give example if needed.
Ans the questions below.
Part 1:
Tenable network security in deep explain
Explain all in deep with expamples how to identify flaws like Injection, XSS, Insecure direct object reference, Security Misconfiguration, Sensitive data exposure, Functional level access control, CSRF, and Invalid redirects.
Explain web application security testing tools like Acunetix, Metasploit, Burp Suite, SQLmap, OWASP Zed Attack Proxy, and HP Fortify.
How to initiative like Threat Modelling and security awareness sessions?
How to Simulate how an attacker would exploit the vulnerabilities identified during the dynamic analysis phase?.
Explain in deep Web technologies like HTTP, HTML, CSS, and Database Connectivity?
Explain automated vulnerability assessment tools Qualys, Nmap, Retina, and Nessus.
How to Perform security tests on different (SAST) static application security testing, (DAST) dynamic application security testing, and manual penetration testing of applications?
Explain SOC tools Splunk and SIEM systems in deep and break down technical parts how to use it.
Following explain with examples
HP Web Inspect
OWASP Top 10 all 10 with examples
Vulnerability Assessment
Paros Proxy
Live HTTP Header
Tamper data
Part 2:
Web ScarabDirBuster
Sqlmap
Nikto
Metasploit
Kali Linux
Qualys
Tenable network security.
how to Documented information security guidance in step-by-step operational procedures?
How to Perform static code reviews with the help of automation tools?
Explain Burp Suite, DirBuster, HP Fortify, and Nmap tools were used as part of the penetration testing, daily to complete the assessments?
How to Establish and improve the processes for privileged user access request?
How toReview firewall rules and policies in web proxy?
6. Explain all the Environment in deep with example: MS SQL, MySQL, Web scarab, HTML, Kali Linux, OWSP, DirBuster, NMAP, IBM AppScan, Burp Suite, HP Fortify, Windows XP, PH
Part 3:
How to perform Security assessment of online applications to identify the vulnerabilities in different?
Explain in deep Categories like Input and data Validation, Authentication, Authorization, Auditing & logging?
How to perform Vulnerability Assessment of various web applications used in the organization using Paros Proxy, Burp Suite, Web Scarab, HP Web Inspect, Qualys?
How to Coordinate with the dev team to ensure closure of reported vulnerabilities by explaining the ease of exploitation and the impact of the issue?
How to perform Security testing of APIs using SOAP UI, OWASP Mobile Top Ten vulnerabilities.
How to use Kali Linux to do web application assessment with tools like Dirbuster, Nikto, and Nmap.
How to perform IBM AppScan to enhance web application security?
How to Perform security code review of JAVA, .Net, and PHP code using static code analysis tools e.g.?
Explain HP Fortify and IBM source edition in deep?
How to Help the team remediate security issues with sample code?
How to Training the development team on the most common vulnerabilities and common code review issues and explaining the remediation?
How to Follow up and ensure the closure of the raised vulnerabilities by revalidating and ensuring 100% Closure?
Explain in deep HTTP, HTML, CSS, and Database Connectivity?
How to Ensure SDLC to be a Secure SDLC?
What is Manual (DAST) security testing on web applications against OWASP’s top 10 standards?

Cybersecurity technical experts only: Make sure you break down all the tools li

Cybersecurity technical experts only: Make sure you break down all the tools like example burpsuite tool all the features or Nmap tool all features it has. give example if needed.
Ans the questions below.
Part 1:
Tenable network security in deep explain
Explain all in deep with expamples how to identify flaws like Injection, XSS, Insecure direct object reference, Security Misconfiguration, Sensitive data exposure, Functional level access control, CSRF, and Invalid redirects.
Explain web application security testing tools like Acunetix, Metasploit, Burp Suite, SQLmap, OWASP Zed Attack Proxy, and HP Fortify.
How to initiative like Threat Modelling and security awareness sessions?
How to Simulate how an attacker would exploit the vulnerabilities identified during the dynamic analysis phase?.
Explain in deep Web technologies like HTTP, HTML, CSS, and Database Connectivity?
Explain automated vulnerability assessment tools Qualys, Nmap, Retina, and Nessus.
How to Perform security tests on different (SAST) static application security testing, (DAST) dynamic application security testing, and manual penetration testing of applications?
Explain SOC tools Splunk and SIEM systems in deep and break down technical parts how to use it.
Following explain with examples
HP Web Inspect
OWASP Top 10 all 10 with examples
Vulnerability Assessment
Paros Proxy
Live HTTP Header
Tamper data
Part 2:
Web ScarabDirBuster
Sqlmap
Nikto
Metasploit
Kali Linux
Qualys
Tenable network security.
how to Documented information security guidance in step-by-step operational procedures?
How to Perform static code reviews with the help of automation tools?
Explain Burp Suite, DirBuster, HP Fortify, and Nmap tools were used as part of the penetration testing, daily to complete the assessments?
How to Establish and improve the processes for privileged user access request?
How toReview firewall rules and policies in web proxy?
6. Explain all the Environment in deep with example: MS SQL, MySQL, Web scarab, HTML, Kali Linux, OWSP, DirBuster, NMAP, IBM AppScan, Burp Suite, HP Fortify, Windows XP, PH
Part 3:
How to perform Security assessment of online applications to identify the vulnerabilities in different?
Explain in deep Categories like Input and data Validation, Authentication, Authorization, Auditing & logging?
How to perform Vulnerability Assessment of various web applications used in the organization using Paros Proxy, Burp Suite, Web Scarab, HP Web Inspect, Qualys?
How to Coordinate with the dev team to ensure closure of reported vulnerabilities by explaining the ease of exploitation and the impact of the issue?
How to perform Security testing of APIs using SOAP UI, OWASP Mobile Top Ten vulnerabilities.
How to use Kali Linux to do web application assessment with tools like Dirbuster, Nikto, and Nmap.
How to perform IBM AppScan to enhance web application security?
How to Perform security code review of JAVA, .Net, and PHP code using static code analysis tools e.g.?
Explain HP Fortify and IBM source edition in deep?
How to Help the team remediate security issues with sample code?
How to Training the development team on the most common vulnerabilities and common code review issues and explaining the remediation?
How to Follow up and ensure the closure of the raised vulnerabilities by revalidating and ensuring 100% Closure?
Explain in deep HTTP, HTML, CSS, and Database Connectivity?
How to Ensure SDLC to be a Secure SDLC?
What is Manual (DAST) security testing on web applications against OWASP’s top 10 standards?

research and lost top 50 intermediate level penetration tester technical intervi

research and lost top 50 intermediate level penetration tester technical interview questions and answers. Note: it needs to cover technical interview questions and answers. Not junior level questions. Thanks