2.1 Cyber Foundations

Social engineers use psychology to get a target to act. The course names seven tactics, and one message often uses several:

Attacks unfold in phases, though not every attack uses all six: (1) reconnaissance, gathering information, often from open source intelligence (OSINT), meaning freely available information; (2) initial access, getting a foothold, often through social engineering or weak or stolen credentials; (3) persistence, keeping access, often with malware like a remote access trojan (RAT) or rootkit that talks to the attacker over a command and control (C2) channel; (4) lateral movement, reaching other computers and accounts to gain higher privileges; (5) taking action, collecting data, sending it out (exfiltration), disrupting services or destroying data; (6) evading detection, deleting or editing logs and erasing planted files.

• Script kiddies: low-skilled adversaries who use tools made by others without understanding them, often for money or bragging rights.
• Hacktivists: attack to support a social, political or personal cause, believing the cause justifies breaking the law.
• Insiders: people with legitimate credentials and access, like employees, which makes them especially dangerous. Greed or revenge can motivate them, and outsiders may recruit them.
• Cyberterrorists: driven by politics or beliefs, they try to disrupt whole communities or nations, for example by attacking a power grid or water plant. They may act alone or for governments or criminal groups.
• Transnational criminal organizations: profit-driven groups that mainly deploy ransomware and steal intellectual property to sell.

You have a risk whenever some threat could use a vulnerability (a weakness) to harm an asset (anything valuable: money, intellectual property, data, digital infrastructure, physical property or reputation).

A risk assessment weighs two factors. Likelihood depends on how valuable the target looks to adversaries, how much skill the exploit takes (well-documented exploits are easier, so more people can use them) and how motivated and capable the likely adversaries are. Severity is the projected damage, usually measured in money, including reputational and operational harm.

Ratings can be quantitative (a number, like 7 on a 1–10 scale or a $25,000-a-year risk) or qualitative (a label, like low, medium, high or severe, or likely-high-impact). Good documentation lists each vulnerable asset and its value, the likely threats, the specific vulnerability and how it could be exploited, the severity and likelihood, and a final rating.

Organizations favor controls that are cost-effective (cheaper to install and maintain than the loss they're expected to prevent) and easy to run.

• Avoid: stop the activity that creates the risk. Impossible if the activity is central to the organization's mission.
• Transfer: shift the burden to someone else, like an insurance company, a government or consumers.
• Mitigate: add security controls that lower the likelihood or the impact.
• Accept: live with the residual risk, the risk left after avoiding, transferring and mitigating. Perfect security doesn't exist, so some risk is always accepted.

Every control protects at least one part of the CIA triad: confidentiality (only authorized people can access data), integrity (data stays accurate and unaltered) or availability (data and services work when authorized people need them).

By type, controls are physical (locks, fences, cameras, bollards, guards), technical (firewalls, anti-malware, encryption) or managerial (policies and procedures, like password policies, access reviews and incident response plans). By function, they are preventive (stop an attack, like locks and encryption), detective (spot an attack, like cameras, an intrusion detection system or a SIEM) or corrective (fix the problem and restore service, like patching, repairing a broken card reader or an intrusion prevention system that stops an attack in progress).

Defense in depth means layering different controls across human, physical, network, device, application and data layers. Each threat meets the control best suited to it, and if an adversary gets past one layer, the next can still stop them or limit the damage.