Journal #1
Just what is a framework and why can it be useful? Briefly describe the 5 core activities of NIST’s Cybersecurity framework.
A framework is a guideline for organizations that lays out a set of rules a business should follow to best understand and manage their cybersecurity risks. It is important to have a plan of action before a cybersecurity incident occurs to make sure an organization can mitigate damages or avoid incidents in the first place.
The five core activities of NIST’s Cybersecurity Framework are Identify, Protect, Detect, Respond, and Recover.
The Identify function is very important, as its name states, it is used to help an organization “identify” and understand its potential risks and assets. This function also identifies the risk management strategy, and the legal requirements for the organizations cybersecurity plan.
The Protect function is aimed at preventing attacks before they happen. Some precautions are taken here such as maintenance of systems, implementing data security protection, and properly training employees.
The Detect Function is about discovering a cyber attack or breach as it happens as early as possible. This means making sure monitoring systems are in place and can efficiently catch any threats may they occur.
The Respond Function is the steps taken after a cyber attack has been detected. The organization should make sure the response plan is carried out. The process should aim at assessing the current damage, contain the attack to avoid future damage, and work towards eliminating the threat.
The final activity is the Recover Function. The recover function is aimed towards making the sure all the systems and services are back to working condition and have the organization back to normal.
Journal #2
Using both the NSF article “The Impact of Cyber Security on Small Businesses.“, and the NIST publication “Small Business Information Security: The fundamentals.“, as a basis, examine & discuss the costs and benefits of developing cyber security programs in small businesses, starting with understanding where to start. By their very nature, small businesses have limited funds to spend on cyber security related activities. So, start with how would you determine where and how to spend these limited dollars.
Cybercrime is an ever-growing concern for small businesses, cyber attacks can cost a business thousands of dollars, which is devastating for small businesses with less revenue to make up for the loss. in some cases it could cause the businesses to go bankrupt and close. By developing a cyber security program, these businesses can help protect themselves and their customer’s data against threats. The first step in creating a program is to identify the risks and vulnerabilities that a business may have. The big three types of threats are environmental, business resources, and hostile actors. With these threats in mind, businesses should understand the likelihood of each of threat, and the potential harm they could have on a business. With this in mind small businesses can avoid spending money on unnecessary protection. Small businesses may also want to use a penetration test on themselves to further identify any weak points.
Because small businesses will have limited funds to spend on cybersecurity activities, there are things they can do without spending money, such as
- Making sure devices are up to date
- Making sure devices are password locked
- Making sure passwords are changed regularly
- Ensuring a firewall is installed on the business network and on each computer system
- Limiting employee access to sensitive information
- Installing surge protectors
Funds should be spent on ensuring that all employees are properly trained on the company’s security policies and protocals.
Small businesses should also invest in anti-virus programs that can detect malware and spyware, and create a response plan in case an incident is detected.
Journal #3
What is FIDO and what problems does this organization address?
FIDO also known as Fast ID Online is a non-profit organization that aims to help with the security problems that come with using passwords online. According to FIDO the problem with passwords is that because users have so many online accounts, that it is hard to users to not reuse passwords. FIDO also says that “passwords are the root cause of over 80% of data breaches”. To get around this, FIDO uses technologies such as multifactor authentication, biometric authentication, and public key cryptography.
The way FIDO works is that a user registers online and their device creates a key pair (a private and public key). The private key is saved on the device and can be accessed with biometric data such as a fingerprint scan, voice recognition, a pin, etc. To avoid data breaches, the biometric data is only stored locally on the user’s device. The public key is stored in FIDO’s database and is linked to the users account. After registering, when a user needs to sign into one of their accounts, they simply have to use their device and solve the biometric challenge that they have chosen, then the device lets the online service know that it is in possession of the private key and the account is able to be accessed.
FIDO can be very valuable for businesses and users alike, as businesses can save money by not having to reset passwords as often, and users don’t have to remember their passwords to login to their accounts.
Sources:
https://fidoalliance.org/what-is-fido/.
https://www.identiv.com/resources/blog/what-is-fido-and-how-does-it-work
Journal #4
How can cryptography help us with authenticity and integrity?
“Cryptography is the art, science, practice and study of securing communications.” Integrity means ensuring that information is accurate and making sure that the receiver is confident that the data received has not been manipulated or tampered with. One of the core uses of cryptography is establishing data integrity; some of the cryptography methods used for this is hashing algorithms, using a pair of public and private keys, and encryptions. Hashing is when plaintext is converted to unreadable text that uniquely identifies the plaintext. Unlike encryption, hashes cannot be reverted. The hash of the data a user receives is compared to the hash sent by the sender; if the values match, the data is unaltered.
Another core use of cryptography is authenticity. Integrity guarantees that the data has not been altered, whereas authenticity verifies that the sender is who they claim to be and is not an imposter. The three main ways of proving authenticity are with certificates, digital signatures, and keys. The purpose of certificates is to confirm that the person claiming to be the owner of a public key actually is the owner. Digital signatures are similar to real life hand written signatures, as both of their purposes are to bind the identity of the signer to the data being sent. When a sender wants to send data, they “sign” it with their private key, and then run the data through an algorithm. Anyone in possession of the matching public key can then decrypt the signature, verifying the sender as the source of the data.
Sources:
https://privacy.net/cryptography/.
https://proprivacy.com/guides/how-why-and-when-you-should-hash-check.
https://www.ibm.com/docs/en/b2badv-communication/1.0.0?topic=overview-digital-signature.