Cybersecurity - Key Cybersecurity Concepts

When it comes to cybersecurity, there's some common terminology and concepts that you're going to need to know. We're going to use it throughout this course, and you'll use it throughout your career, so let's go over some key concepts.

There are quite a few different concepts and several different definitions to cover, to include assets, threats, threat agents, risk, mitigation, vulnerabilities, exploitation, exposure, breach and defense in depth. These are a lot of terms and concepts that you're going to encounter in the cybersecurity field.

Assets

An asset to a company is simply things that hold value. Certainly money would fall in that category, but other things would fall in that category as well, such as the data that it holds, maybe some sort of code if it's a software company, perhaps the company reputation if it has a good reputation, the equipment and buildings that it holds. The customer data could be a very valuable asset to the company, and the people that work for that company could be considered an asset as well.

Threats and Threat Agents

A threat is something that can happen to that asset which would diminish its value. For instance, money could be stolen, and that obviously is a diminish in value. Or let's use the example of data. Data could be stolen, which is a breach in confidentiality, and that could have loss in other areas such as our reputation if it's customer data. Also, this data could be altered, and that's an attack on its integrity, and data that's altered, that we can't rely on, is obviously useless to us, so it loses its value. Or that data could be deleted. If it's unavailable to our users or when it's needed, then obviously that data no longer has value to us.

A threat agent is a person or organization that's intending to do harm. So in the example right here, this threat agent may be trying to steal, alter or delete our data. They are carrying out the threat on our asset.

Risk

Risk, in its simplest form, is just what are the chances something's going to happen. But there is an equation for this which actually takes it a step further, and that is risk equals probability times impact. The probability is what are the chances something's going to happen, so what are the chances this threat agent is going to steal this asset right here. And it also is times the impact, so if that data is stolen, what is the impact going to be to the company.

Mitigation

Mitigation is the steps that we're going to take to reduce risk. In this example right here, we have our data, and we're going to put a wall around it and a gate around it. In other words, access control. We're going to have some sort of access control around this data to reduce the probability, and therefore reduce the risk that this is going to happen.

The other thing that we could do is take steps to reduce the impact if the data is stolen. In this case right here, what we could do is reduce the amount of data that we have, so if it's stolen then it won't be as impactful to the company.

Vulnerabilities

A vulnerability is a weakness in the system. As an example of this right here, we have our data, we have our threat agent, we put up our mitigation for this, but this gate is a vulnerability in our system right here because it's not as strong as the wall. Or we could also take a look at the lock right here and say, well, that lock is easily pickable, and so that is a weakness to the gate. Or we could take a look and see right here that this gate is in disrepair, it's broken, and so that brokenness is actually a vulnerability to that gate.

Exploitation

An exploitation is an action that happens, and that's when a threat agent utilizes some sort of vulnerability to carry out a threat. So in this example right here, this threat agent is utilizing this broken gate that it's aware of to be able to get access and steal this data.

Exposure

An exposure happens when one of our assets goes unprotected. In the case right here, we had a gate that was protecting this asset right here. Let's say a user gained access to this data right here, and then when they left they forgot to close the gate, leaving it wide open. That leaves the opportunity for a threat agent to exploit that and be able to gain access to that data.

It's important to note that just because something was exposed doesn't necessarily mean that this threat agent took advantage of that, but even so, we don't fully know if that threat agent gained access to that, which is one of the reasons why we do monitoring, to monitor that. In the case where we don't know if this threat agent had access to it or not, we still have to notify our customers. So even a simple exposure, whether it was taken advantage of or not, can be really devastating to a company's reputation.

Breach

When a threat agent does get access into our assets, we call that a breach. So in our example right here we have data, and if this threat agent gains access to that data, we now have a breach.

Defense in Depth

The thing is that your people, processes and technologies will fail you at some point in time. That is, somebody is going to leave that gate open, and if that gate doesn't get repaired there's going to become a vulnerability in that gate, or somebody might discover a different way to pick that lock which makes it easier to gain access.

So what we have to do is practice defense in depth. The idea behind defense in depth is that we don't rely on any one system, process or technology. Instead we're going to put up multiple things within our network to protect it. An example of this is that we're going to just figure that somebody's going to be able to scale that wall or be able to get through that gate, and so we also add a guard, which is going to protect that facility to make sure that no one is going to scale that wall or dig underneath it, or whatever the case may be. But that guard could also be bribed or blackmailed, so we're going to have an extra security camera that can go back and see if we were ever breached, to make sure that nothing has happened, and to keep that guard that we've hired honest.

We also want to protect from the impact that is going to happen, so maybe we encrypt the data that we have, so if it is stolen no one can really do anything with it because it's encrypted data. So it's going to lessen the impact if that data is stolen.

In summary, we have threat agents out there that possess threats towards our assets, so what we're going to do is put mitigations in place to reduce the amount of risk. We reduce the amount of risk by either reducing the probability that it's going to happen, or the impact if it does happen. Each one of those mitigations has its own set of abilities to it, so we're going to practice defense in depth by putting in multiple levels of mitigation.