All language subtitles for 02. General definitions

Welcome to the general definition section. In this section, we'll go over some of the most common terms
1

used in cyber security.
2

So let's dive in.
3

First off, we have infosec or information security.
4

InfoSec is the practice of protecting information.
5

This usually involves protecting or at least reducing the risk of unauthorized access, disclosure,
6

modification, corruption or deletion of information. To make it more concrete
7

let's think of a few examples where infosec would be needed.
8

First off, think of an application that contains your medical records.
9

Only you and your doctor should be able to see those medical records, so your data should be protected
10

against unauthorized access.
11

Another example would be your private messages and emails. We would definitely not want them to be leaked
12

publicly on the Internet.
13

And finally, think of your bank account.
14

That account should be protected against modification, corruption or deletion.
15

You wouldn't want to wake up with less money in your account or without an account altogether.
16

Next, we have cyber security, also known as computer security or information technology security.
17

Cybersecurity is part of infosec and is the practice of protecting I.T. systems against digital attacks.
18

It basically means protecting computers, servers, mobile devices, electronic systems, networks and
19

data from malicious attacks.
20

These attacks can have as purpose the theft or damage of electronic data, such as personal data as
21

well as software and hardware.
22

Other common purposes are to disrupt and/or misdirect the services provided by I.T. systems.
23

For example, attackers can target the bank and make online banking unavailable.
24

Or, in another scenario, an attacker would misdirect us to a malicious website where we would be tricked
25

into giving our credit details to hackers. In the previous slide
26

we learned that cybersecurity means protecting components such as data, software, and hardware that
27

support information related activities.
28

In infosec, such a component is called an asset.
29

Assets can be devices such as a PC, a server or a smartphone.
30

Assets can also be software, for example, a website, an online shop, an online banking app, a car
31

infotainment system, an operating system such as Windows, Linux, or MacOS, or just a regular application.
32

Finally, assets can also be information such as a database with customer information, emails, personal
33

messages and so on.
34

Now that we learn what an asset is, let's have a look at vulnerability.
35

A vulnerability is a weakness in an asset.
36

Usually, an attacker uses one or more vulnerabilities to commit their attack.
37

Some common vulnerability examples are using outdated software and libraries, bugs, and miss configurations
38

of I.T. systems.
39

Next, term is threat. In computer security
40

a threat is the potential negative action or event caused by exploiting a vulnerability.
41

Threats can be intentional or unintentional.
42

A few examples of intentional threats are malware, phishing, hackers, or even an employee that is
43

angry with the company. For unintentional threats
44

some examples would be natural events such as an earthquake, a flood, or a hurricane, or a technical
45

failure such as a hardware or software failure.
46

Another term commonly used is attack. An attack is a deliberate assault on an I.T. system with malicious
47

purpose. You might see some similarities between a threat and an attack.
48

So let's compare them.
49

An attack is a deliberate action against the target with the intention of doing harm, while a threat
50

is the potential for the occurrence of an attack.
51

Since an attack is a deliberate action, it's always intentional,
52

while a threat can be intentional or unintentional.
53

Last but not least, an attack is an attempt to cause damage, while a threat has the potential to cause
54

damage.
55

The final term that we'll discuss in this section is IT risk. IT risk is the potential that a given
56

threat will exploit vulnerabilities of an asset and cause harm.
57

The risk is basically a combination of impact and likelihood. To better understand the risk,
58

let's have a look at an IT risk matrix. On the horizontal axis
59

we have the impact which goes from negligible, on the left side, to severe, on the right side.
60

On the vertical axis, we have likelihood, going from very unlikely at the bottom, to very lightly at
61

the top.
62

Let's take two scenarios to better understand risk. In the first scenario.
63

we have a website which is hosted on multiple data centers,
64

and for one of the data centers, there is a very small chance that an earthquake can happen in that
65

area.
66

Because of that, the likelihood of the threat is very unlikely.
67

And since the website is hosted on multiple data centers, the impact is negligible.
68

Even if one of the datacenter goes down, the website will still work.
69

Based on the information, the risk is very low.
70

For the second scenario, let's think of an online shop, due to a bug, when you log in on the online shop, you
71

have the rights of an admin and you can access data from other customers.
72

In this case, likelihood is very likely because all users have admin rights and the impact is severe,
73

because everyone can access data of other customers.
74

This results in a critical risk. Now that we have knowledge of the terms used in cybersecurity,
75

let's use what we learned in a couple of examples.
76

In the first scenario, we have an online shop which contains private information such as contact details
77

of customers. Besides that we have Alice, the owner of the online shop who uses insecure credentials,
78

such as admin, admin for username and password.
79

And finally, we have Eve, the hacker, who tries to obtain private information using combinations of commonly
80

known credentials. Let's map the terms used to date to this scenario.
81

First, we have the online shop, which is an asset.
82

The database containing the details of the customers can also be considered an asset.
83

Then we have the vulnerability, which in this case is the use of insecure credentials.
84

Next, the threat, which in this case is information disclosure by exploiting the vulnerability and
85

then, we have the attack, which in this case is Eve's attempt to log in as administrator using common,
86

insecure credential combinations.
87

Finally, we have the risk.
88

As we discussed, risk is a combination of likelihood and impact. In this case, the likelihood is likely,
89

since this is a simple attack, and the impact is severe, because private information would be leaked to
90

Eve, the hacker.
91

This results in a critical risk.
92

In our second scenario, we again have an online shop which contains private information such as contact
93

details of customers.
94

In this case, the online shop is hosted on an unpatched server.
95

Besides that, we have Bob, a regular user, just buying stuff online.
96

On the other side, we have again, if the hacker who tries to obtain confidential information using
97

vulnerabilities from the unpatched server.
98

This may seem a bit abstract, so let's see a more concrete example. Let me introduce Heartbleed.
99

Heartbleed was a bug in the open SSL library, in the Heartbeat implementation.
100

The Heartbeat is used to check that the connection between the server and the client is still active.
101

Due to improper input validation,
102

this bug could result in leaking confidential information from the server.
103

The bug was first introduced in 2012 but was only detected in April 2014.
104

As of July 2019, over 90000 devices who are still vulnerable to Heartbleed.
105

To better understand this, we have here an oversimplified example of how hard it works and how hard
106

it works.
107

From time to time, the client wants to check that the connection with the server is still open and
108

will send the message to the server and wait for a reply. On the left, we have the normal usage in which
109

the client would say something like: "Hey, server, are you still there?
110

Send me this three letter word back if you are there."
111

And then it would give a three-letter word such as "Cat", then the server would reply with the message "Cat".
112

Now, the client knows that the connection with the server is still open.
113

On the right, we have the malicious usage using the Heartbleed bug. Similarly to the normal usage,
114

the malicious client would send a message to the server.
115

The client would say something like: "Hey, server, are still there?
116

Send me this 128 letter word back if you are there."
117

And then it would just send a three letter word such as "Cat". Due to improper input validation
118

the server would send back the three letter word, followed by 128 letters filled with whatever else
119

is after that word
120

in the memory of the server. The malicious client could get an answer such as cat, followed by some
121

secret key stored on the server, or confidential information about users such as their credentials, or
122

personal details.
123

Now that we have a concrete example with Heartbleed, we will update the second scenario.
124

So we have an online shop which is using OpenSSL version 1.0.1
125

This version of Open SSL is vulnerable to Heartbleed.
126

As we discussed previously, the online shop contains private information such as details of customers.
127

Besides that, on the left side, we have Bob, a regular user, just buying stuff online.
128

And on the right side, we have Eve, the hacker, who tries to obtain confidential information by exploiting
129

Heartbleed.
130

Once again, let's map the terms learned today to the scenario.
131

First, we have the online shop, which is an asset. The database containing the details of the customer
132

is also an asset.
133

Next, let's see
134

the vulnerability. In this case, is the usage of OpenSSL version 1.0.1
135

.
136

Then, we have the threat, which is again, information disclosure, by exploiting the vulnerability, in
137

this case, Heartbleed.
138

Now, let's have a look at the attack, which in this case is Eve's attempt to obtain confidential information
139

using Heartbleed.
140

Finally, we'll have a look at the risk.
141

Again, we will have a look first
142

at the likelihood, then the impact.
143

Finally, we will calculate the risk.
144

In this case, the likelihood is likely, since this is a relatively simple attack and the impact is severe,
145

because private information would be leaked to Eve, the hacker. Because of this, we have a critical risk.
146

To recap, in this section, we learned the definitions of infosec, cybersecurity, asset, vulnerability,
147

threat, attack, IT risk, and how to map these terms to scenarios.
148

With that, we conclude this section.
149

If you have any questions, don't hesitate to ask us.
150

See you soon in the next section.