What is Cybersecurity? Computer Security Principles

What is Cybersecurity?

March 13, 2023

Cybersecurity is a relatively new science, so many people have a slightly incorrect definition of it. The most popular answer is “the science that studies ways to counteract malware”, but that is not the real object of cybersecurity. So let’s have a detailed look at this perspective newbie and figure out all of its edges.

So, what is cybersecurity? This science may look like a way to avoid malware injection, prevent data leaks, or organize more reliable information storage. However, cybersecurity researches all these things simultaneously, so it can indeed be called the science of digital data protection.

Cybersecurity is defined as the defense of networks, data, and information from unauthorized access, tampering, or destruction. All the networks, data, and knowledge have something in common; they're the equivalent of data and data stored in a bank. An attacker can physically access the building and manipulate the security systems to get into the bank's vaults.

This happens because, in the physical world, criminals can't manipulate physical systems like the type found in IT. So the idea is to use these vulnerabilities to attack the information contained in the computer network.

An influx of new threats, technologies, and business models have emerged in the cybersecurity space as the world shifted to a more remote work model in response to the COVID-19 pandemic.

The technology landscape that is constantly changing isn't a new revelation, but it's certainly been taken to a new level in the last year. Here, we analyze the emerging threat landscape that results from and what cybersecurity trends pose the most risk in 2023, and beyond.

Why Cybersecurity is Important?

Nowadays, too many things rely on the digital form of data storing and transferring. Each company has a database with clients, work documents, statistics, and other things. It is important to be sure that this info can be reached any moment and only by the primarily designated users. As one of the ways to provide the latter, cybersecurity offers the use of security mechanisms and methods of malware counteraction. Another thing this science tries to control is the human factor - still one of the most often reasons for data breaches in large companies.

The main focus of that science is how to protect the data from third-party intruders. Such an intruder may be a malicious program called spyware or a person who gained unauthorized access to this data. Either way, you must understand how to avoid and counteract it if it happens. Having to deal with all possible issues simultaneously is a very non-trivial task - that’s why all solutions are very complex. So cybersecurity is a science that searches for ways to secure the computer networks and data stored and transferred in them.

What are Cybersecurity Threats?

It is time to mention the dangers that cybersecurity is called to face in more detail. They usually depend on which target they aim for. The more important or valuable information these victims have - the more complicated security tools they supposedly use. Hence, the ways of stealing this info (i.e., making it through all the barriers) must become gradually more complex. Stealing conversations from individual users’ PCs is much easier than getting them from a company with many security features. And both malware and human-related tricks will be much more complicated.

Let’s have a look at most of the contemporary cyber security threats. They are positioned by their complication level.

Malware

Malware. You heard this word and likely knew its definition. However, the majority of users can barely tell anything more. Malware is more than just “malicious software”, as people used to describe this definition, and, in fact, not a synonym for “virus”. So how can it correctly be characterized?

Malicious software has surrounded us since the late ‘90s and will surely exist as long as computers do. Even though not each malware sample is supposed to be a direct threat to the information, it likely has a way of reaching it. These days even such things as the adware can steal cookies and search history. And imagine what spyware or stealers can do.

Phishing

Tricky social engineering does not always aim to sell something to us. When it comes to malicious actions, phishing is pretty popular for getting users’ credentials from social networks or online banking accounts. There are a lot of counterfeited pages online that mimic Facebook, Twitter, or other widespread networks. They are usually spread via spamming in social networks or in emails. However, the biggest losses are related to the counterfeits of banking sites and apps: say them your password, and also say “bye” to your savings.

Ransomware

The thing that is right amidst the orientation of individuals and corporations. There are enough ransomware variants that attack only individuals and only companies; some of them take both. It is obvious that attacks on companies bring much more profit but can also expose the ransomware group to a significant risk. Meanwhile, the ransomware market among the groups that aim at individuals got its leader and monopolist several years ago. STOP/Djvu has a share of more than 75%.

While attacks on individuals are based on bait emails and illegal software - pretty classic methods, groups that aim at companies were forced to find less predictable ways. And they did - vulnerabilities in RDP are one of the most exploited among all other ones. Besides that, crooks sometimes use hack tools and spyware - to get confidential information from the company and then ask a separate ransom for this info to remain unpublished.

Man-in-the-Middle

Old-but-gold thing was almost entirely wiped using HTTPS encryption standard in web browsers. This attack supposes the traffic packages' interception on their way to the server. While “classic” MitM attacks were performed in the unsecured Wi-Fi network, modern ones are usually done as a part of insider threat activity. The disguised crook sniffs the packages that are transferred to the local corporate network without any encryption. But still, even inside corporate networks, data transfer without any security measures is rare. Man-in-the-Middle is almost unused these days.

DDoS

This type of cybersecurity threat is rather about blocking access to any data than about stealing it. Flooding the servers with requests so they fail to respond looks pretty easy until you think about where to get all these requests. Distributed denial of service will barely occur because of the requests from a dozen computers. Hence, cybercriminals who attack something more serious than the site of a local chain of supermarkets in Texas usually make use of botnets or similar stuff.

Occasionally, people may commit an unintentional DDoS attack on a certain site. For example, such a situation occurred during the last Eurovision song contest when folks flooded the website with the results. But the real DDoS attack is almost always complimented with attempts to brute force the website's admin panel.

Insider threats

Almost unavoidable if your company is large and well-known. A person who works for your rivals, or even the exact fraudsters. It is not obligatory for a new employee - one of the persons you thought was well-proven may also be an insider. The third party could offer him a large remuneration for such a sly job. An insider, especially one that has worked for you for some time, can do very bad things - from data leaks to malware injection.

Advanced persistent threats (APT)

Exactly, the king of all threats. Most complex and most successful if everything is done right. This type of cybersecurity threat supposes the use of multiple tools that act during a relatively long period. It can be both spyware, stealer, or other malware that can deliver confidential data, in combination with an insider that manages all these things. However, there are many more possible combinations.

Cybersecurity Trends

To respond to the threats you can see above, cybersecurity as a science developed solutions for different attack vectors. It is essential to understand that they have a high efficiency only when applied together and on the scale corresponding to threats. And to be the most competitive against all possible dangers, , it is better to implement specific measures against certain threats and common cybersecurity elements.

Network security

These days, most application software has embedded elements of network security. HTTPS certificates are used on almost every website, and most web browsers block access to ones that do not have it. From your side, security is about to be provided with passwords on Wi-Fi routers and complicated passwords in the local network.

Cloud security

In some situations, local cybersecurity applications are not enough. The secureness of the connection to cloud services may be in danger as a security solution rarely controls it. And while they became increasingly popular as a way to store data and cooperate, the risks grew correspondingly. To be sure that the attack is not possible, cloud security solutions offer their control over the connection between the employee and the cloud service.

App security

Data handling, user authentication rules, networking protocols - all these elements in the apps you use must be applied by design. Even if you are not worried about developers collecting your personal information, it is better to have it secured. Most enterprise-quality applications usually do everything to avoid exposing user data.

Storage security

When we talk about embarrassing cases, the saddest one is when you have done everything to protect your data from external dangers and got your data center collapsed. Storage units - HDD or SSD - may fail because of different reasons. Fortunately, it is pretty easy to counteract these unpleasant cases - buying the disks with a bigger lifespan or protecting the equipment from damage.

Another edge of storage security is more about the physical security of the place where the data is kept. Such a room must be accessed only by authorized personnel and - what is more important - without anything that can be used to extract data. Securing the computers with different passwords and ciphering the disks is a standard measure.

Information security

General Data Protection Regulation, or GDPR, is a thing that explains almost everything. This European data protection law regulation stands for top privacy for the data of people who use any application available to the public. All information about users that is kept on servers must be encrypted. Otherwise, you will face lawsuits from the official EU authorities. In case someone uncovers this, of course.

Critical infrastructure security

That part of cybersecurity is for vital governmental organizations rather than companies. These organizations usually have a lot of confidential information, and overall the workability of these structures is a matter of national importance. Leakage of this info may significantly influence folks or non-governmental organizations. The cyberattack on the Colonial Pipeline is a great example of such a case.

That’s why these organizations sometimes have paranoid safety measures. You are not allowed to take a photo or video from the inside, cannot use removable drives in their networks, and all actions in these systems require authorization with a password.

Mobile security

In contrast to the globalized security of critical infrastructure, mobile security is more about the choice of each particular user. If you want (or even need) to secure the data on your phone, it is better to use anti-malware programs and disk ciphering tools. Following the rules of network safety is also recommended - use only secured networks and sites with HTTPS certificates.

End-user education

Any threat will be ineffective when users know how to recognize them before launching. Knowledge always gives a right of first move, and even the best security tools will fail when everything is done intentionally wrong. Using doubtful USB drives, visiting untrustworthy sites, and opening any attachments on the email is the way to get infected, regardless of how well you are protected.

Cybersecurity Technologies and Tips to Follow

Zero-trust

Most anti-malware programs currently use the rule “if the program is installed and run by the user - it is legit”. Hence, these programs will ignore everything that goes under this rule. Such a decision is normal from a certain point of view, but the malware spreading evolution makes this rule dangerous for the protected system. The development of deeply-integrated malware made it easy to exploit this rule to provide additional persistence for the threat. When it comes to human-related threats, the trust of long-working employees is a thing to abuse.

The specific solutions for corporate security - Endpoint Detection and Response applications - usually use zero-trust policy. That means that anything, from a simple script to a full-fledged app, must be checked as potentially dangerous. Such paranoia can minimize the risk of deeply-embedded malware injection and will not even give any false detections with modern technologies. Another example of the program that offers zero-trust policy is Microsoft Defender - it is likely known by everyone.

Identity and Access Management (IAM)

This principle stands for setting strict access privileges not for each group of users - for each certain user. It may look like overkill, but when you deal with confidential or classified data - it is exactly what you need. However, this division may start from some simple steps - forbid your employees to use an administrator account for work. Most apps work great with user privileges; you can enter the admin password if needed. Such an easy step significantly reduces the chance of successful usage of exploit malware.

When it comes to a higher level, it is essential to restrict access to sensitive info for employees who do not need it. People are curious by nature, so having access to some secret info will cause them to attempt to check it. You need to understand that each user with access to the secret documents is a potential leak source. Giving the employees access only to documents they need for work means having your company secured.

Security Information and Event Management (SIEM)

As mentioned multiple times, malware and its distribution methods constantly evolve. Having complete information on how it tries to get into the system and provide itself persistence makes the protection from all further attacks. The protection application that logs all events which take place in your network will clearly show you where your weak spots are. But even without any attacks, such logging may help you to detect the suspicious activity of the applications you use or even your employees.

Cybersecurity Myths and Misconceptions

There are enough myths and wrong facts about cybersecurity. Some of them are based on real events but are just random coincidences. More critical misunderstandings appear in topics that are massively covered in the media. Let’s have a look at the most popular of those false opinions.

Risks can easily be estimated

Cybercriminals never act in the same manner twice. Some steps may repeat from one attack to another, but you can never foresee how much they will grab. Crooks may steal your data, leave it be, reach your domain controller, and cipher it, or even fail the initial steps. It is always good to hope for the best and be ready for the worst.

Attacks are committed in the same way. It is enough to be protected from well-known attack vectors

This statement is both true and false simultaneously. Yes, you will make it impossible for lazy cybercriminals to attack you if no “classic” breaches are available. But as you could read in the previous paragraph, it is better to be ready for the worst. And as statistics show, the most inventive attackers are the most successful ones. LockBit group - the leading ransomware gang - is notorious exactly for their non-linearity in new attacks.

All cybercrimes are committed from the outside

The press covers most of the cyberattacks as something that is done by bad boys in Guy Fawkes masks, who have no relation to the target company. However, the detailed research of the wide-known attacks uncovers many details that refute such a thesis. Cyberattacks often happen because of the negligence of employees, but the cases of collaboration with crooks are not single. Paying attention to the strange actions of your employees is the way to prevent cyberattacks and data leaks.

My company will not be attacked. It is not attractive for crooks/it works in the sector that will not be attacked

Many companies happily exhaled when ransomware groups declared the list of sectors they would avoid in their attacks. The news was pleasant, but some companies turned too reckless after this announcement. Not every ransomware group agreed to follow these rules, and there are even more new groups that did not ever say anything about their opinion about “ethical hacking”. Hence, it is too early to relax.

Cybersecurity Reality in Numbers

• 85% of cyberattacks are due to human error
• 61% of cyberattacks target small businesses
• 65% of data breaches involve insiders
• 50% of companies with a BYOD policy experienced a mobile data breach
• 81% of data breaches are due to weak, stolen, and default user passwords
• 68% of C-suite executives feel their cybersecurity risks are increasing
• 7% of companies’ folders are adequately protected, on average
• ~200 days - Average time to identify a breach in 2021
• ~1.2 billion records were breached in the first half of 2021
• 4,421 – Average number of times hackers attack in a day

Frequently Asked Questions