Richard Henson University of Worcester September 2016 COMP3371 Cyber Security Richard Henson University of Worcester September 2016

By the end of this module you should be able to: Analyse the information security issues and threats facing both users and information managers in organizations Identify methods, tools and techniques for combating security threats Demonstrate and understanding of methods used to protect a device, computer or network from malware and unauthorized access Review real-world security and/or forensics issues and synthesize appropriate solutions using a combination of technical and user controls

Week 1: Securing digital data in the hyperconnected world Objectives: Explain the difference between “data” and information” Explain why Data Security has become so hard Know where to start in managing the security of digital information

Is it data… or information? Kids stuff? the difference between the two is subtle but crucial. And it should be clearly understood… Exercise in pairs… discuss what is (a) similar (b) different about data and information give an example of digital data that could be categorised as (a) data and (b) information be prepared to explain why each can be categorised as such…

Data… or Information? All about context… Great confusion about this if on its own…. just numbers & characters if linked to something else… really important information Great confusion about this certainly among mangers even among IT professionals…

Scenario Within the organisation/department a few bytes sent may be “just data” employees may not see it as personal or sensitive relaxed attitude? Outsider… still just data? e.g. taken via a wireless link With help from an internal “informer”… The data has context! It becomes information

How Valuable is Data? (1) Data breach an external agency… gets organisational data… without permission If what is compromised remains just “data”, perhaps a breach is not so serious… data is worthless without context

How Valuable is Data? (2) However… If the data becomes information… it will have value… maybe a lot… breach could be very serious indeed Examples: rival organisation gets corporate information … then uses it to undermine the hacked organisation hacker accesses customer personal information (e.g. Ashley Madison) and threatens to leak it…

How much is Data worth? Well, how much is the organisation worth… ? classically based on physical assets & trading BUT… data or information not physical… classical model therefore out of date!? What is the value of e.g. company database?

Black Market Value… Information has intrinsic value e.g. personal data record - if contextualised, becomes “personal information” worth e.g. £50 on the black market? e.g. spreadsheet, confidential memo could become financial or corporate information may be worth a lot more than £50… By contrast, data only has potential value just add context, though… and…

Keeping Data Secure If data can easily become information, it needs to be kept safe… Prime concern for all organisations! take special care of any digital data of importance could be contextualised to become information…

Information Security and Organisations Nothing new! always kept information… important to the extent that the organisation IS its information loss of vital data could therefore be curtains for the organisation!!! information kept very secure… in fireproof, lockable, filing cabinets

Nowadays, usually held digitally Until 1980s, always held in expensive, secure computer areas well-paid experts looked at computer operations completely beyond scope of an SME! Then came the PC… the network… the portable storage device… and… public access to the Internet!

Navigating data round the Internet Over 1 biilion Internet servers!

Users, Users Everywhere! 2 billion!

Mission Impossible? another group exercise coming up…

Data Security? Digital Security? Information Security? Cyber Security? Matters relating to digital stuff referred to by organisations as “data security” regarded as an IT matter “Information Security” also takes account of contextualisation & human factors 2009 on… became Cyber Security woke up to “cyber threats…”

Group Exercise Define: Which would be the best to use with Data Security Information Security Cyber security Digital Security Which would be the best to use with small businesses (SMEs) <250 employees larger organisations?

Users: E-commerce from home… Principles of good data management not just about business computing… computer at home connected to the Internet… (!) family members sharing the computer/home network could get hold of each other’s information All much, much more important when a whole organisation’s data is being managed…

Information Security: Technology & Management Basic problem… technology is useless if people won’t stick to procedures procedures are equally useless if the technology can’t detect intrusions or prevent them

A Company like Yours? http://www2.deloitte.com/au/en/pages/ri sk/articles/cyber-video-companies-like- yours.html Watch carefully… how do the hackers get in…? and then wreak havoc…?

Client-Server Networks Most organisations have their own centrally controlled network access to files and applications on the network should be carefully controlled the network manager does the controlling! A taste of this, in the practical seminar… Next week… Malvern “cyber day”… Bus leaves at 9.15 am, Thursday 6th Oct