AS I

SEC 3302, Advanced IS Security 1

Course Learning Outcomes for Unit I Upon completion of this unit, students should be able to:

5. Explain the importance of information security (IS). 5.1 Identify potential cyberthreats presented with electronic communications. 5.2 Develop a security policy. 5.3 Investigate strategies for instigating an email security testing campaign.

Required Unit Resources Chapter 1: The Threat Environment In order to access the following resources, click the links below. You can access transcripts for the videos by clicking on the three dots below the video on the right, then clicking “Open transcript.” Professor Messer. (2020, December 10). Other social engineering attacks - SY0-601 CompTIA Security+ :

1.1 [Video]. YouTube. https://www.youtube.com/watch?v=trAs7C5h1BU Professor Messer. (2020, December 10). Principles of social engineering - SY0-601 CompTIA Security+ : 1.1

[Video]. YouTube. https://www.youtube.com/watch?v=ndwCR1kYz5M Professor Messer. (2020, December 10). Threat actors - SY0-601 CompTIA Security+ : 1.5 [Video]. YouTube.

https://www.youtube.com/watch?v=JeYTS3RtLGE Professor Messer. (2020, December 20). Bots and botnets - SY0-601 CompTIA Security+ : 1.2 [Video].

YouTube. https://www.youtube.com/watch?v=CHrES3Swpw4 Professor Messer. (2021, January 7). Denial of service - SY0-601 CompTIA Security+ : 1.4 [Video]. YouTube.

https://www.youtube.com/watch?v=dpgGMMHa-lU Professor Messer. (2021, January 11). Attack vectors - SY0-601 CompTIA Security+ : 1.5 [Video]. YouTube.

https://www.youtube.com/watch?v=6CTl2CSS2oI Unit Lesson

The Threat Environment Corporate security is vitally relevant in today's business world. One cannot look at their newsfeed on any day without seeing a story about an organizational cyberattack, customer data theft, or some newly detected threat. These types of attacks can have an enormous impact on infrastructure, resources, reputation, assets, customer information, and corporate data. Attacks come in many forms, evolve almost daily, and may include malware, phishing, social engineering, web-based attacks, malicious code, botnets, stolen devices, denial of service (DoS), malicious insiders, or ransomware (Boyle & Panko, 2021). Businesses obviously have a strong interest in protecting infrastructure from these threats, but protection requires corporations to have comprehensive information technology (IT) security policies, procedures, hardened applications, and secure hardware. Because all of these topics are also covered in your Chapter 1 readings, you may have guessed that the topic for this unit is the threat environment.

UNIT I STUDY GUIDE IS Security and Basic Threats

SEC 3302, Advanced IS Security 2

UNIT x STUDY GUIDE Title

Threats to the Entity Are Threats to the Individual Let's start with a general understanding of how the threat environment impacts both entities and individuals. While we could separate personal from corporate threats, the reality is that the potential for exploits overlaps both worlds. For instance, although we do not generally concern ourselves with corporate espionage in our personal lives, most security issues can affect us both personally and professionally. For example, a data breach happens when an unauthorized person views, alters, or steals secured data (Boyle & Panko, 2021). While these breaches are extremely expensive for an organization to rectify—in both direct and indirect costs—there are also costs for the individuals whose information was stolen. Often, this is because personally identifiable information (PII), such as bank account information and social security numbers, is stolen during the attack and used illegally by the attackers. Thus, it is important to understand security holistically. We need to understand what the threat is, how it is perpetrated, how we can mitigate the threat, and how we can clean up the mess. Motivations for Attacks To start, we must understand the terminology and basic differences in malware, exploits, and types of attacks. However, the purpose of this lesson is not to define and explain each of the types of attacks. You can read that information in your textbook. The purpose of this lesson is to give you some context and to discuss some of the concepts of attacks and why they occur. Why are individuals and organizations attacked? What is it the attacker wants? It is important to understand that motivations have changed over the years. Initially, years ago, hackers did not aim to cause massive damage to systems or seek financial gain. Instead, that era of hackers were more interested in the thrill of break-ins, the validation of their skills, and a sense of power. Hackers who communicated and operated within groups could demonstrate their ability by breaking into well-defended hosts, which would increase their reputations amongst other hackers. Attacks were, therefore, an essential part of climbing the hacker social hierarchy. Today, these motivations have largely changed in modern society. Whereas early hackers were interested in social status and being part of a social group, nowadays, hackers are more interested in financial gain. Therefore, they often desire personal information, such as credit card information, that may provide them with access to financial resources. Obtaining social security numbers and other personal information may lead to identity theft, resulting in the potential for theft of large sums of money from multiple victims. There have even been instances when identity thieves filed bankruptcy on behalf of their victims in an attempt to buy themselves more time to get away with their crimes.

Hackers are a reality in today's world, and their work is becoming more prevalent and far-reaching.

Whether they are beginners working in a basement with purchased malware or highly skilled experts working in a terrorist cell, they can cause issues for individuals as well as for large companies. Note:

As shown in the photo on the right, hacking is not limited to computers—cellphones and other devices may also be used as tools or become targets.

(Photos from left: Stevanovicigor, n.d.; Hackcapital, 2018; Flynt, n.d.)

SEC 3302, Advanced IS Security 3

UNIT x STUDY GUIDE Title

These segments (Segments 1–4) from the video The Rise of the Hackers provide interesting information concerning hackers, and, as a part of that information, it details the experiences of one man who was hacked. In the video, hackers’ keyboards are being equated to bombs when describing the amount of destruction they can cause. For a transcript of the video, click on “Transcript” at the top of the video segment menu to the right of the video. Attacks for Financial Gain Password gathering may mean obtaining bank account information, which means the potential for stolen money. In an organization, accessing the network via hacking usually means the hacker is looking for information. That information could include employee social security numbers or customer credit card information. The thieves may be middlemen who sell that information to others rather than using it themselves, but either way, the end result is always financial gain. In rare cases, the attacks may involve extortion or the selling of trade secrets. Again, the result being sought is financial gain. There are also known cases of corporate identity theft. Imagine gaining access to the personal information of the owners of a partnership or small business that is incorporated. If the business owners have good credit and the business is in good standing, the thief could potentially borrow a lot of money in the name of the business owners. Although financial gain is often the major reason for hacking, it is not the only one. In some cases, such attacks are not about financial gain. Attacks Intended to Harm Infrastructure Besides monetary gain, what are some other reasons that organizations are attacked by hackers? Let's take the example of a distributed denial-of-service (DDoS) attack to illustrate our inquiry. DDoS attacks are created to disrupt systems and stall operations. A fundamental question is, “Why?” Why would someone put in the time, effort, risk, and resources to do something like that if there is no monetary return? The answer must take into account the multiplicity of reasons that attacks occur in our modern society. Usually, it is because the attacker is upset and trying to either make a political statement or do malicious harm to the infrastructure of the victim. Hacktivism, for instance, is the use of hacking techniques to promote an activist agenda or express an opinion. These tactics may be illegal, but they do not create a high degree of fear or concern among the larger community. On the other hand, cyberterrorism is an ideologically motivated attack against electronic data, applications, and networks that is intended to cause serious harm to noncombatant targets to effect ideological, political, or social change. In contrast, the attacker may simply be an angry customer who feels wronged. There are many possibilities and motivations that are not necessarily financially driven. As you may have guessed, the victims of these attacks can come from a variety of sectors. Victims may be government offices, financial institutions, educational institutions, political sites, news sites, and the like. Cyberwarfare DDoS can also be a form of cyber warfare. One government may use DDoS to attack the governmental websites of another country. This is because militaries, in recognition of cyberspace's communications and critical infrastructure aspects, have started to treat cyberspace as a new warfare domain like land, air, and sea. Cyberwarfare may, therefore, be classified as an act of violence. This is like using military operations by virtual means to achieve the same ends that could be obtained by using conventional means. An interesting contemporary example of cyber warfare that you may want to research is the Soviet-Estonia conflict over removing a war memorial that had honored Russia. This conflict resulted in riots in the streets as well as virtual attacks on Parliament, news agencies, and banks. Another example is the development and use of Stuxnet, a worm used against an Iranian uranium enrichment facility. Stuxnet accessed supervisory

SEC 3302, Advanced IS Security 4

UNIT x STUDY GUIDE Title

control and data acquisition (SCADA) systems and logic controllers controlling centrifuges and allowed them to be remotely controlled. Unfortunately, in most cases, it is hard to tell who the perpetrator of the attack is, so it may be difficult to definitively determine the reason for the attack. In most cases, hacking seems to originate from highly skilled individuals. However, that is not always the case, as a hacker may have only basic skills but can buy the scripts and software they need. There is no longer a need for them to be able to write their own programming. Accessibility of Malicious Software Boyle and Panko (2021) describe amateur hackers as script kiddies. This term refers to new hackers who rely on premade scripts or tools but do not understand how they work, which can cause their efforts to fail or to create more damage than intended. It reflects the reality that many of the tools one needs in order to hack or send malware to an individual or organization can be purchased illegally and do not require a great deal of programming skill. This does not mean that all hackers are amateurs. Many hackers are very skilled individuals. They may be members of teams and may work in groups, which are called cells, and may be located in a number of countries. International Attacks As we discussed earlier, attacks can take the form of cyber warfare or cyberterrorism. Nation-state actors from foreign nations may also effectuate them. For instance, in late 2020, hackers perpetrated a massive computer breach that enabled them to spend approximately four months exploring the systems of several U.S. government networks and private companies in numerous countries. Industry experts say a country mounted the complex hack—and government officials allege that Russia is the country responsible for the attack (Chappell et al., 2020). The hackers attached their malware to a software update from SolarWinds, a company based in Austin, Texas. Many federal agencies and thousands of companies worldwide use the SolarWinds Orion software to monitor their computer networks. SolarWinds says that nearly 18,000 of its customers received the tainted software update in the government and the private sector (Chappell et al., 2020). The effects of this breach have been massively expensive and reveal the increasingly sophisticated attacks that will, unfortunately, be a part of our everyday lives in our increasingly digital world. A quick Google search will give you a fascinating glimpse into this series of attacks and its impact on IT security.

Conclusion Today’s reality is that in the world in which we live, the threat environment is very real and can be very costly. To an individual, an information breach can be devastating. Banks will usually reimburse stolen money, but damage may also occur in the form of such things as bounced payments. In the case of identity theft, it may take years to reverse the effects. A serious breach can cost an organization millions of dollars in fees and in refunded money. The organization's reputation may also be damaged in the process. In an increasingly technological world, the implications must be met with a focus on security. Many of these concepts will be addressed throughout this course.

References Boyle, R. J., & Panko, R. R. (2021). Corporate computer security (5th ed.). Pearson.

https://online.vitalsource.com/#/books/9780135823354 Chappell, B., Myre, G., & Wamsley, L. (2020, December 21). What we know about Russia’s alleged hack of

the U.S. government and tech companies. NPR. www.npr.org/2020/12/15/946776718/u-s-scrambles- to-understand-major-computer-hack-but-says-little

SEC 3302, Advanced IS Security 5

UNIT x STUDY GUIDE Title

Flynt. (n.d.). Computer hacker with mobile phone (ID 127216995) [Photograph]. Dreamstime. https://www.dreamstime.com/computer-hacker-mobile-phone-smartphone-stealing-data-computer- hacker-mobile-phone-image127216995

Hackcapital. (2018, February 21). Hack capital [Photograph]. Unsplash.

https://unsplash.com/photos/uv5_bsypFUM Stevanovicigor. (n.d.). Ransomware computer virus concept, hacker with monitor (ID 132496548)

[Photograph]. Dreamstime. https://www.dreamstime.com/ransomware-computer-virus-concept- hacker-monitor-screen-internet-cyber-security-image132496548

SEC 3302, Advanced IS Security 1

Course Learning Outcomes for Unit I Upon completion of this unit, students should be able to:

5. Explain the importance of information security (IS). 5.1 Identify potential cyberthreats presented with electronic communications. 5.2 Develop a security policy. 5.3 Investigate strategies for instigating an email security testing campaign.

Required Unit Resources Chapter 1: The Threat Environment In order to access the following resources, click the links below. You can access transcripts for the videos by clicking on the three dots below the video on the right, then clicking “Open transcript.” Professor Messer. (2020, December 10). Other social engineering attacks - SY0-601 CompTIA Security+ :

1.1 [Video]. YouTube. https://www.youtube.com/watch?v=trAs7C5h1BU Professor Messer. (2020, December 10). Principles of social engineering - SY0-601 CompTIA Security+ : 1.1

[Video]. YouTube. https://www.youtube.com/watch?v=ndwCR1kYz5M Professor Messer. (2020, December 10). Threat actors - SY0-601 CompTIA Security+ : 1.5 [Video]. YouTube.

https://www.youtube.com/watch?v=JeYTS3RtLGE Professor Messer. (2020, December 20). Bots and botnets - SY0-601 CompTIA Security+ : 1.2 [Video].

YouTube. https://www.youtube.com/watch?v=CHrES3Swpw4 Professor Messer. (2021, January 7). Denial of service - SY0-601 CompTIA Security+ : 1.4 [Video]. YouTube.

https://www.youtube.com/watch?v=dpgGMMHa-lU Professor Messer. (2021, January 11). Attack vectors - SY0-601 CompTIA Security+ : 1.5 [Video]. YouTube.

https://www.youtube.com/watch?v=6CTl2CSS2oI Unit Lesson

The Threat Environment Corporate security is vitally relevant in today's business world. One cannot look at their newsfeed on any day without seeing a story about an organizational cyberattack, customer data theft, or some newly detected threat. These types of attacks can have an enormous impact on infrastructure, resources, reputation, assets, customer information, and corporate data. Attacks come in many forms, evolve almost daily, and may include malware, phishing, social engineering, web-based attacks, malicious code, botnets, stolen devices, denial of service (DoS), malicious insiders, or ransomware (Boyle & Panko, 2021). Businesses obviously have a strong interest in protecting infrastructure from these threats, but protection requires corporations to have comprehensive information technology (IT) security policies, procedures, hardened applications, and secure hardware. Because all of these topics are also covered in your Chapter 1 readings, you may have guessed that the topic for this unit is the threat environment.

UNIT I STUDY GUIDE IS Security and Basic Threats

SEC 3302, Advanced IS Security 2

UNIT x STUDY GUIDE Title

Threats to the Entity Are Threats to the Individual Let's start with a general understanding of how the threat environment impacts both entities and individuals. While we could separate personal from corporate threats, the reality is that the potential for exploits overlaps both worlds. For instance, although we do not generally concern ourselves with corporate espionage in our personal lives, most security issues can affect us both personally and professionally. For example, a data breach happens when an unauthorized person views, alters, or steals secured data (Boyle & Panko, 2021). While these breaches are extremely expensive for an organization to rectify—in both direct and indirect costs—there are also costs for the individuals whose information was stolen. Often, this is because personally identifiable information (PII), such as bank account information and social security numbers, is stolen during the attack and used illegally by the attackers. Thus, it is important to understand security holistically. We need to understand what the threat is, how it is perpetrated, how we can mitigate the threat, and how we can clean up the mess. Motivations for Attacks To start, we must understand the terminology and basic differences in malware, exploits, and types of attacks. However, the purpose of this lesson is not to define and explain each of the types of attacks. You can read that information in your textbook. The purpose of this lesson is to give you some context and to discuss some of the concepts of attacks and why they occur. Why are individuals and organizations attacked? What is it the attacker wants? It is important to understand that motivations have changed over the years. Initially, years ago, hackers did not aim to cause massive damage to systems or seek financial gain. Instead, that era of hackers were more interested in the thrill of break-ins, the validation of their skills, and a sense of power. Hackers who communicated and operated within groups could demonstrate their ability by breaking into well-defended hosts, which would increase their reputations amongst other hackers. Attacks were, therefore, an essential part of climbing the hacker social hierarchy. Today, these motivations have largely changed in modern society. Whereas early hackers were interested in social status and being part of a social group, nowadays, hackers are more interested in financial gain. Therefore, they often desire personal information, such as credit card information, that may provide them with access to financial resources. Obtaining social security numbers and other personal information may lead to identity theft, resulting in the potential for theft of large sums of money from multiple victims. There have even been instances when identity thieves filed bankruptcy on behalf of their victims in an attempt to buy themselves more time to get away with their crimes.

Hackers are a reality in today's world, and their work is becoming more prevalent and far-reaching.

Whether they are beginners working in a basement with purchased malware or highly skilled experts working in a terrorist cell, they can cause issues for individuals as well as for large companies. Note:

As shown in the photo on the right, hacking is not limited to computers—cellphones and other devices may also be used as tools or become targets.

(Photos from left: Stevanovicigor, n.d.; Hackcapital, 2018; Flynt, n.d.)

SEC 3302, Advanced IS Security 3

UNIT x STUDY GUIDE Title

These segments (Segments 1–4) from the video The Rise of the Hackers provide interesting information concerning hackers, and, as a part of that information, it details the experiences of one man who was hacked. In the video, hackers’ keyboards are being equated to bombs when describing the amount of destruction they can cause. For a transcript of the video, click on “Transcript” at the top of the video segment menu to the right of the video. Attacks for Financial Gain Password gathering may mean obtaining bank account information, which means the potential for stolen money. In an organization, accessing the network via hacking usually means the hacker is looking for information. That information could include employee social security numbers or customer credit card information. The thieves may be middlemen who sell that information to others rather than using it themselves, but either way, the end result is always financial gain. In rare cases, the attacks may involve extortion or the selling of trade secrets. Again, the result being sought is financial gain. There are also known cases of corporate identity theft. Imagine gaining access to the personal information of the owners of a partnership or small business that is incorporated. If the business owners have good credit and the business is in good standing, the thief could potentially borrow a lot of money in the name of the business owners. Although financial gain is often the major reason for hacking, it is not the only one. In some cases, such attacks are not about financial gain. Attacks Intended to Harm Infrastructure Besides monetary gain, what are some other reasons that organizations are attacked by hackers? Let's take the example of a distributed denial-of-service (DDoS) attack to illustrate our inquiry. DDoS attacks are created to disrupt systems and stall operations. A fundamental question is, “Why?” Why would someone put in the time, effort, risk, and resources to do something like that if there is no monetary return? The answer must take into account the multiplicity of reasons that attacks occur in our modern society. Usually, it is because the attacker is upset and trying to either make a political statement or do malicious harm to the infrastructure of the victim. Hacktivism, for instance, is the use of hacking techniques to promote an activist agenda or express an opinion. These tactics may be illegal, but they do not create a high degree of fear or concern among the larger community. On the other hand, cyberterrorism is an ideologically motivated attack against electronic data, applications, and networks that is intended to cause serious harm to noncombatant targets to effect ideological, political, or social change. In contrast, the attacker may simply be an angry customer who feels wronged. There are many possibilities and motivations that are not necessarily financially driven. As you may have guessed, the victims of these attacks can come from a variety of sectors. Victims may be government offices, financial institutions, educational institutions, political sites, news sites, and the like. Cyberwarfare DDoS can also be a form of cyber warfare. One government may use DDoS to attack the governmental websites of another country. This is because militaries, in recognition of cyberspace's communications and critical infrastructure aspects, have started to treat cyberspace as a new warfare domain like land, air, and sea. Cyberwarfare may, therefore, be classified as an act of violence. This is like using military operations by virtual means to achieve the same ends that could be obtained by using conventional means. An interesting contemporary example of cyber warfare that you may want to research is the Soviet-Estonia conflict over removing a war memorial that had honored Russia. This conflict resulted in riots in the streets as well as virtual attacks on Parliament, news agencies, and banks. Another example is the development and use of Stuxnet, a worm used against an Iranian uranium enrichment facility. Stuxnet accessed supervisory

SEC 3302, Advanced IS Security 4

UNIT x STUDY GUIDE Title

control and data acquisition (SCADA) systems and logic controllers controlling centrifuges and allowed them to be remotely controlled. Unfortunately, in most cases, it is hard to tell who the perpetrator of the attack is, so it may be difficult to definitively determine the reason for the attack. In most cases, hacking seems to originate from highly skilled individuals. However, that is not always the case, as a hacker may have only basic skills but can buy the scripts and software they need. There is no longer a need for them to be able to write their own programming. Accessibility of Malicious Software Boyle and Panko (2021) describe amateur hackers as script kiddies. This term refers to new hackers who rely on premade scripts or tools but do not understand how they work, which can cause their efforts to fail or to create more damage than intended. It reflects the reality that many of the tools one needs in order to hack or send malware to an individual or organization can be purchased illegally and do not require a great deal of programming skill. This does not mean that all hackers are amateurs. Many hackers are very skilled individuals. They may be members of teams and may work in groups, which are called cells, and may be located in a number of countries. International Attacks As we discussed earlier, attacks can take the form of cyber warfare or cyberterrorism. Nation-state actors from foreign nations may also effectuate them. For instance, in late 2020, hackers perpetrated a massive computer breach that enabled them to spend approximately four months exploring the systems of several U.S. government networks and private companies in numerous countries. Industry experts say a country mounted the complex hack—and government officials allege that Russia is the country responsible for the attack (Chappell et al., 2020). The hackers attached their malware to a software update from SolarWinds, a company based in Austin, Texas. Many federal agencies and thousands of companies worldwide use the SolarWinds Orion software to monitor their computer networks. SolarWinds says that nearly 18,000 of its customers received the tainted software update in the government and the private sector (Chappell et al., 2020). The effects of this breach have been massively expensive and reveal the increasingly sophisticated attacks that will, unfortunately, be a part of our everyday lives in our increasingly digital world. A quick Google search will give you a fascinating glimpse into this series of attacks and its impact on IT security.

Conclusion Today’s reality is that in the world in which we live, the threat environment is very real and can be very costly. To an individual, an information breach can be devastating. Banks will usually reimburse stolen money, but damage may also occur in the form of such things as bounced payments. In the case of identity theft, it may take years to reverse the effects. A serious breach can cost an organization millions of dollars in fees and in refunded money. The organization's reputation may also be damaged in the process. In an increasingly technological world, the implications must be met with a focus on security. Many of these concepts will be addressed throughout this course.

References Boyle, R. J., & Panko, R. R. (2021). Corporate computer security (5th ed.). Pearson.

https://online.vitalsource.com/#/books/9780135823354 Chappell, B., Myre, G., & Wamsley, L. (2020, December 21). What we know about Russia’s alleged hack of

the U.S. government and tech companies. NPR. www.npr.org/2020/12/15/946776718/u-s-scrambles- to-understand-major-computer-hack-but-says-little

SEC 3302, Advanced IS Security 5

UNIT x STUDY GUIDE Title

Flynt. (n.d.). Computer hacker with mobile phone (ID 127216995) [Photograph]. Dreamstime. https://www.dreamstime.com/computer-hacker-mobile-phone-smartphone-stealing-data-computer- hacker-mobile-phone-image127216995

Hackcapital. (2018, February 21). Hack capital [Photograph]. Unsplash.

https://unsplash.com/photos/uv5_bsypFUM Stevanovicigor. (n.d.). Ransomware computer virus concept, hacker with monitor (ID 132496548)

[Photograph]. Dreamstime. https://www.dreamstime.com/ransomware-computer-virus-concept- hacker-monitor-screen-internet-cyber-security-image132496548