CYS401 · Chapter 1 · Annotated SlidesIntroduction to Cybersecurity
Original
Overview

Introduction to Cybersecurity

What cybersecurity is, defence in depth and the layers of security, the critical characteristics of information (C.I.A. plus accuracy, authenticity, utility, possession), the McCumber cube, the components of an information system, and the SDLC vs. the SecSDLC. Both Quiz 1 papers (222 and 232) and Major A were built almost entirely from this deck.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 38 slides
  1. 1 Cyber Security: Introduction
  2. 2 Outline
  3. 3 ICE-BREAKING
  4. 4 Introduction
  5. 5 GETTING STARTED!
  6. 6 Introduction
  7. 7 Introduction
  8. 8 Introduction
  9. 9 Introduction
  10. 10 Introduction
  11. 11 Introduction
  12. 12 Critical characteristics of information
  13. 13 Critical characteristics of information
  14. 14 Critical characteristics of information
  15. 15 Critical characteristics of information
  16. 16 Critical characteristics of information
  17. 17 Critical characteristics of information
  18. 18 Critical characteristics of information
  19. 19 Critical characteristics of information
  20. 20 Components of an Information System
  21. 21 Components of an Information System
  22. 22 Components of an Information System
  23. 23 Components of an Information System
  24. 24 System Development Life Cycle (SDLC)
  25. 25 System Development Life Cycle (SDLC)
  26. 26 System Development Life Cycle (SDLC)
  27. 27 System Development Life Cycle (SDLC)
  28. 28 System Development Life Cycle (SDLC)
  29. 29 System Development Life Cycle (SDLC)
  30. 30 Security System Development Life Cycle (SecSDLC)
  31. 31 Security System Development Life Cycle (SecSDLC)
  32. 32 Security System Development Life Cycle
  33. 33 Security System Development Life Cycle
  34. 34 Security System Development Life Cycle
  35. 35 Security System Development Life Cycle
  36. 36 Security System Development Life Cycle
  37. 37 SDLC vs. SecSDLC
  38. 38 Slide 38
Slide 1 / 38

Cyber Security: Introduction

Slide 1: Cyber Security: Introduction

Notes

  1. Tip Characteristics of information: Confidentiality (no disclosure) · Integrity (accurate, complete, unaltered) · Availability (access when needed) · Accuracy (no errors, the value expected) · Authenticity (genuine, as originally created) · Utility (useful for a purpose) · Possession (ownership/control).

Slide 2 / 38

Outline

Slide 2: Outline
Slide 3 / 38

ICE-BREAKING

Slide 3: ICE-BREAKING
Slide 4 / 38

Introduction

Slide 4: Introduction

Notes

  1. Why cybersecurity matters: everything is connected, attacks are constant and costly.

Slide 5 / 38

GETTING STARTED!

Slide 5: GETTING STARTED!
Slide 6 / 38

Introduction

Slide 6: Introduction

Notes

  1. Cybersecurity = protecting systems, networks and data from digital attacks.

Exam angle

Slide 7 / 38

Introduction

Slide 7: Introduction

Notes

  1. “Cyber” = anything related to computers, networks and the internet (ICT = Information and Communication Technology).

Slide 8 / 38

Introduction

Slide 8: Introduction

Notes

  1. Security is a process, not a product.

Slide 9 / 38

Introduction

Slide 9: Introduction

Notes

  1. Defence in depth: layered safeguards: physical (guards, locks), perimeter (firewalls, border routers, VPN), network (segments, NIDS), host (OS hardening, patching, antivirus), application, data (encryption, ACLs), plus policies and awareness.

  2. If one layer fails, the others still protect.

  3. Trap Defence in depth ≠ fail-over. “When one device fails another takes over” is redundancy (availability), not layering.

Exam angle

Past exam · Quiz 1 · 222

Q1 · characteristic of defence in depth

Past exam · Quiz 1 · 232

Q1 · characteristic of defence in depth

PredictionQ1

What is a characteristic of a layered defence-in-depth approach?

PredictionQ2

Border firewalls and screening routers belong to which defence-in-depth layer?

PredictionQ3

Encryption at rest and ACLs on records belong to the ___ layer.

Slide 10 / 38

Introduction

Slide 10: Introduction

Exam angle

PredictionQ1

Which is NOT a physical security measure against physical hacking?

Slide 11 / 38

Introduction

Slide 11: Introduction

Notes

  1. Cybersecurity covers information security, network security, application security…

Slide 12 / 38

Critical characteristics of information

Slide 12: Critical characteristics of information

Exam angle

Past exam · Final 221 · A

Related question: MCQ · cybersecurity pillars

Slide 13 / 38

Critical characteristics of information

Slide 13: Critical characteristics of information

Notes

  1. Tip Characteristics of information: Confidentiality (no disclosure) · Integrity (accurate, complete, unaltered) · Availability (access when needed) · Accuracy (no errors, the value expected) · Authenticity (genuine, as originally created) · Utility (useful for a purpose) · Possession (ownership/control).

Slide 14 / 38

Critical characteristics of information

Slide 14: Critical characteristics of information

Exam angle

Past exam · Major A

A · protection from modification = integrity

Past exam · Major B

A · preventing disclosure = confidentiality

Past exam · Major AQ1

Protection of data from modification by unauthorised users is:

Past exam · Major BQ2

Preventing disclosure or exposure to unauthorised individuals is:

Slide 15 / 38

Critical characteristics of information

Slide 15: Critical characteristics of information

Exam angle

Past exam · Major B

A · raw hex instead of a report = utility

PredictionQ1

Information that is the same as when originally created, placed, stored or transferred is:

PredictionQ2

A value different from what the user expects because of a modification means the information is no longer:

Past exam · Major BQ3

A doctor receives a patient file as raw hexadecimal instead of a readable report. Which characteristic is lost?

Slide 16 / 38

Critical characteristics of information

Slide 16: Critical characteristics of information

Notes

  1. Possession = ownership/control. A breach of confidentiality always breaches possession, but losing possession (a stolen encrypted disk) doesn’t always breach confidentiality.

Exam angle

Past exam · Quiz 1 · 232

Related question: Q2 · unauthorised user obtains the procedure = possession

PredictionQ1

A breach of possession always results in a breach of confidentiality.

Slide 17 / 38

Critical characteristics of information

Slide 17: Critical characteristics of information
Slide 18 / 38

Critical characteristics of information

Slide 18: Critical characteristics of information

Notes

  1. McCumber cube: 3 × 3 × 3 = 27 cells; each cell is a goal × state × measure combination to secure.

  2. Memory trick McCumber axes: GOALS (C, I, A) · STATES (storage, transmission, processing) · MEASURES (technology, policy, education).

Exam angle

Past exam · Major A

Related question: B · T/F McCumber: data protected only in one state

PredictionQ1

Which is NOT an information state on the McCumber cube?

Past exam · Major AQ2

In the McCumber cube, data needs to be protected only while it is stored.

Slide 19 / 38

Critical characteristics of information

Slide 19: Critical characteristics of information
Slide 20 / 38

Components of an Information System

Slide 20: Components of an Information System

Exam angle

PredictionQ1

Which IS component is often the weakest link?

Slide 21 / 38

Components of an Information System

Slide 21: Components of an Information System
Slide 22 / 38

Components of an Information System

Slide 22: Components of an Information System
Slide 23 / 38

Components of an Information System

Slide 23: Components of an Information System
Slide 24 / 38

System Development Life Cycle (SDLC)

Slide 24: System Development Life Cycle (SDLC)
Slide 25 / 38

System Development Life Cycle (SDLC)

Slide 25: System Development Life Cycle (SDLC)

Notes

  1. SDLC phases: investigation, analysis, logical design, physical design, implementation, maintenance and change.

Slide 26 / 38

System Development Life Cycle (SDLC)

Slide 26: System Development Life Cycle (SDLC)

Notes

  1. Analysis phase.

Slide 27 / 38

System Development Life Cycle (SDLC)

Slide 27: System Development Life Cycle (SDLC)

Notes

  1. Design phases.

Slide 28 / 38

System Development Life Cycle (SDLC)

Slide 28: System Development Life Cycle (SDLC)

Notes

  1. Implementation.

Slide 29 / 38

System Development Life Cycle (SDLC)

Slide 29: System Development Life Cycle (SDLC)

Notes

  1. Maintenance and change.

Slide 30 / 38

Security System Development Life Cycle (SecSDLC)

Slide 30: Security System Development Life Cycle (SecSDLC)

Exam angle

Past exam · Major A

B · T/F secure SDLC only applies to requirements and testing (false)

Past exam · Major AQ1

A secure SDLC applies security only to the requirements and testing phases.

Slide 31 / 38

Security System Development Life Cycle (SecSDLC)

Slide 31: Security System Development Life Cycle (SecSDLC)
Slide 32 / 38

Security System Development Life Cycle

Slide 32: Security System Development Life Cycle

Notes

  1. SecSDLC investigation: management defines the security project, goals and budget.

Exam angle

Past exam · Quiz 1 · 232

Q4 · two security points for each SDLC phase

Slide 33 / 38

Security System Development Life Cycle

Slide 33: Security System Development Life Cycle

Notes

  1. SecSDLC analysis: study threats, existing controls, legal issues; risk management starts.

Slide 34 / 38

Security System Development Life Cycle

Slide 34: Security System Development Life Cycle

Notes

  1. SecSDLC logical design: security blueprint, incident response and continuity plans.

Slide 35 / 38

Security System Development Life Cycle

Slide 35: Security System Development Life Cycle

Notes

  1. SecSDLC physical design and implementation: choose and install the technology; test.

Slide 36 / 38

Security System Development Life Cycle

Slide 36: Security System Development Life Cycle

Notes

  1. SecSDLC maintenance: monitor, test, update, respond to incidents.

Exam angle

PredictionQ1

Give two security activities for the design and maintenance phases of the SecSDLC. (Quiz 1 232, Q4)

Compare with the model answer

Design: threat modelling and a secure architecture/security blueprint; review the design against the security requirements. Maintenance: apply patches and security updates; continuously monitor logs and run periodic vulnerability assessments and incident response.

Slide 37 / 38

SDLC vs. SecSDLC

Slide 37: SDLC vs. SecSDLC
Slide 38 / 38

Slide 38

Slide 38: Slide 38

Notes

  1. Recap.