Cyber Security Mindset

Question 1

Summarize the Security Mindset

Answer 1

-Learning to think like the attacker
-Thinking critically about the system being examined
-Understanding both technical and non-technical countermeasures
-Trying to see how you can break something

Question 2

Example of the Mindset

Answer 2

Security professionals can’t walk into a store without noticing how they might shoplift. They can’t use a computer without wondering about the security vulnerabilities.

Question 3

Security Mindset vs Crime

Answer 3

Thinking about the weaknesses of a system is different than acting on those weaknesses.
Ex:
- Thinking about how encryption can be exploited allows one to make more secure systems.

Question 4

Thinking Like a Defender Includes:

Answer 4

-Security policy
-Threat model
-Risk Assessment
-Countermeasures

Question 5

Security Policy

Answer 5

What are we trying to protect?
What properties are we trying to enforce?

Question 6

Confidentiality

Answer 6

Ensuring that information is accessible only to those authorized to view it.

Question 7

Integrity

Answer 7

Ensuring that data is accurate and has not been altered in an unauthorized way.

Question 8

Availability

Answer 8

Ensuring that systems and data are accessible and usable when needed by authorized users.

Question 9

Privacy

Answer 9

Ensuring that personal or sensitive data is collected, stored, and used appropriately.

Question 10

Authenticity

Answer 10

Ensuring that users, systems, and data are genuine.

Question 11

Threat Model

Answer 11

Who are the attackers?
-Motives?
-Capabilities
-Access

Question 12

Risk Assessment

Answer 12

1. What would security breaches cost us?
   -Direct costs: Money, property, safety…
   -Indirect costs: reputation, future, business, well being..
2. How likely are these costs?
   -Probability of attacks?
   -Probability of success?

Question 13

Countermeasures

Answer 13

1. Technical countermeasures
   - What most of this course is about!
2. Non-technical countermeasures
   -Law, policy, procedures, etc.

Question 14

Security Costs

Answer 14

1. No security mechanism is free
   -Direct costs: design, implementation, enforcement, false positives
   -Indirect costs: lost productivity, added complexity
2. Challenge is rationally weigh costs vs. risk
   -Human psychology makes reasoning about high cost/low probability events hard