Internet of Things, Cyber Security and Physical Vulnerabilities
The Internet of Things (IoT) is the network of physical objects such as devices, vehicles, and buildings that are embedded with electronics, software, sensors, and network connectivity that enables them to collect and exchange data and concerns have been raised that this is being developed without appropriate consideration of the security challenges involved.
Cyber security is the assemblage of technology, procedures and practices intended to shield and protect data, projects, codes and valuable information from unapproved access. In other words, it means authorized eyes are supposed to be kept out -for good. In the computing setting, this kind of security incorporates both cyber security and physical security.
Cyber security has never been as easy as it sounds. In a fast paced technology driven world, cyber-attacks turn out to be more innovative as time progresses. It is therefore expedient to appropriately characterize cyber security and recognize what constitutes great cyber security.
Cyber security is essential because year in and year out, the expenditure on cyber security keeps growing. In reference to Forbes, the global cyber security market reached $75 billion for 2015 and is expected to hit $170 billion in 2020. Organizations are beginning to comprehend that malware is a publicly accessible product that makes it simple for anybody to end up distinctly as a cyber-attacker. Sadly, more organizations offer security arrangements that do little to guard against cyber-attacks. Cyber security requests deep focus and a whole lot of commitment.
While the IoT creates opportunities for more direct integration of the physical world into computer-based systems, it also provides opportunities for misuse. In particular, as the Internet of Things spreads widely, cyber-attacks are likely to become an increasingly physical (rather than simply virtual) threat. If a front door's lock is connected to the Internet, and can be locked/unlocked from a phone, then a criminal could enter the home at the press of a button from a stolen or hacked phone. People could stand to lose much more than their credit card numbers in a world controlled by IoT-enabled devices. Thieves have also used electronic means to circumvent non-Internet-connected hotel door locks.
Serious financial damage has been caused by security breaches, but because there is no standard model for estimating the cost of an incident, the only data available is that which is made public by the organizations involved. "Several computer security consulting firms produce estimates of total worldwide losses attributable to virus and worm attacks and to hostile digital acts in general. The 2003 loss estimates by these firms range from $13 billion (worms and viruses only) to $226 billion (for all forms of covert attacks). The reliability of these estimates is often challenged; the underlying methodology is basically anecdotal."
However, reasonable estimates of the financial cost of security breaches can actually help organizations make rational investment decisions. According to the classic Gordon-Loeb Model analyzing the optimal investment level in information security, one can conclude that the amount a firm spends to protect information should generally be only a small fraction of the expected loss (i.e., the expected value of the loss resulting from a cyber/information security breach).
As with physical security, the motivations for breaches of computer security vary between attackers. Some are thrill-seekers or vandals, others are activists or criminals looking for financial gain. State-sponsored attackers are now common and well resourced, but started with amateurs such as Markus Hess who hacked for the KGB, as recounted by Clifford Stoll, in The Cuckoo's Egg.
A standard part of threat modelling for any particular system is to identify what might motivate an attack on that system, and who might be motivated to breach it. The level and detail of precautions will vary depending on the system to be secured. A home personal computer, bank, and classified military network will face very different threats and computer protection. In computer security, a countermeasure is an action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken. Security by design, or alternately secure by design, means that the software has been designed from the ground up to be secure. In this case, security is considered as a main feature.
Some of the techniques in this approach include:
The principle of least privilege, where each part of the system has only the privileges that are needed for its function. That way even if an attacker gains access to that part, they have only limited access to the whole system. Automated theorem proving to prove the correctness of crucial software subsystems.
Code reviews and unit testing, approaches to make modules more secure where formal correctness proofs are not possible.
Defense in depth, where the design is such that more than one subsystem needs to be violated to compromise the integrity of the system and the information it holds.
Default secure settings, and design to "fail secure" rather than "fail insecure" (see fail-safe for the equivalent in safety engineering). Ideally, a secure system should require a deliberate, conscious, knowledgeable and free decision on the part of legitimate authorities in order to make it insecure.
Audit trails tracking system activity, so that when a security breach occurs, the mechanism and extent of the breach can be determined. Storing audit trails remotely, where they can only be appended to, can keep intruders from covering their tracks.
Full disclosure of all vulnerabilities, to ensure that the "window of vulnerability" is kept as short as possible when bugs are discovered.
Cyber security protects the information and integrity of computing resources having a place with or interfacing with an organization's system. Its purpose is to protect those assets against dangerous threats all through the life cycle of a cyber-assault.
Worthy of note amongst the trickiest components of cyber security is the rapidly and continually advancing nature of security dangers. The conventional approach has been to concentrate most resources on the most critical system segments and secure against the greatest known dangers. This requires abandoning some less vital system parts undefended and some less perilous dangers unprotected.
Cyber criminals, risk performing artists, hackers'they all know what you know- cybercrime pays. Your IT, put away in systems and the cloud, can do little. What's more, despite the fact that the strategies, targets and technology of assaults are exceedingly critical, your most intense protection against cyber-crime is to understand how attackers work in their own domain.
Cyber-attacks have changed and may go undetected for a while. Talk about a thief in the night! Expansive, scattershot assaults intended for fiendishness have been supplanted with cutting edge relentless determination. Dangers are concentrated on securing profitable information from a particular source. Modern cyber assaults are frequently led over various vectors and stages. They have an arrangement to get in, flag again from the bargained system, and collect significant information in spite of system security measures. To viably anticipate and react to cyber-crime, you have to understand what the inspirations and philosophy of cyber attackers are, in addition to all the levels and forms which cyber-attacks could come as.
Cyber Risks can be isolated into three unmistakable territories:
Cyber crime
Cyber-crime is usually conducted by people working alone, or in groups, with their major aim being on extricating cash, information or bringing about disturbance. Cyber-crime can take many structures, including the procurement of credit/debit card information, intellectual property, and hindering the operations of a site or service.
Cyber war
Cyber war comes about when a nation intends to bring harm on another nation by trying to gain access to classified information not meant for public consumption. In most cases, wars have been started for less. Cyber wars lead to harm and it involves undercover work against another country keeping in mind the end goal is to bring about disturbance or to extract information. This could include the utilization of Advanced Persistent Threats (APTs).
Cyber Terror
An organization, working freely of a nation state can decide to instigate terrorist activities through the medium of cyberspace. This is known as cyber terror. Organizations need to consider measures against all these including governments of nations, those inside the basic national framework, and prominent establishments. It is possible that most organizations will suffer from cyber war or cyber terror.
Types of Cyber Security
They include virus, spyware and malware. Be that as it may, those are just the tip of ice berg. To help you comprehend the types of computer security, I have separated the whole hypothesis into the accompanying three sections:
' Internet and Network Security
' Standalone Computer Security
' Information Loss by Accidents
Web Security gives sleepless nights to a lot of organizations. Majority of people and organizations are worried about malware and hackers. Network Security, manages the security issues on systems of any size. This incorporates outer issues and additional issues of computers inside the system. Standalone computers allude to computers that are not associated with any system (but rather might be associated with Internet). This part covers the conceivable security vulnerabilities on such systems. Lastly, data loss is pertinent to systems and computers in addition standalone computers.
There are many types of computer security dangers today. Some are really unsafe while some are absolutely innocuous albeit irritating. In addition, there are some viruses which do not harm your computer rather, they have the ability to empty the numbers in your bank account.
Here are some threats you really should avoid. They are as dangerous as they come:
Who are Cyber Criminals?
Most cybercrimes are perpetuated by individuals or small groups. In any case, a person who offers an item on the web and does not send it, or somebody who professes to be another person keeping in mind that the end goal is to acquire private information for blackmail purposes is a cybercriminal. However, while they are without a doubt obnoxious people, they don't pose much hazard to large organizations. The hazard to businesses usually comes from attackers with higher desires or personal vendetta.
"Prankster" is a name given to individuals who hack into systems for no particular reason. A case is the notorious cyber bunch called LulzSec who were students of computer science at school. Their name was inspired by their yearning to 'laugh in the face of the casualty's security measures'. However, cybercrime is no laughing matter. In 2011, LulzSec partook in an extensive assault on Sony, completing DDoS assaults and purportedly taking source codes from their Developer Network.
A second group can be alluded to as 'attackers with a cause'. They, more often than not, have a political or social cause and normally work as a little or closely associated gathering of criminals. Like these are the 'nation/ state attackers' who likewise serve a cause and are frequently the most in fact advanced of their type. One late case of country state assaults happened directly under the nose of a noteworthy cyber security firm, Kaspersky Labs. Kaspersky reported that Stuxnet and Duqu malware dug in themselves with an end goal to leech data about national-state attacks that were under scrutiny, and in addition, information in regards to the recognition programming that can alleviate attacks. These attackers additionally pose a threat to organizations on the grounds that their political targets are very much served by producing salary from cybercrime in nations other than their own.
According to a survey by 'Flipping the Economics of Attacks' by Palo Alto Networks and the Ponemon Institute, 67% of UK hackers conceded that cash is their principle motivating force for their criminal activities, despite the fact that the same research uncovered that the normal UK cyber-criminal makes simply over ''20,000 every year (a normal of ''8600 per attack). These are not over the top measures of cash and are lower than one would have expected, particularly when you consider a cyber-security expert can make up to four-times that much in wages. This suggests that cyber-hackers will probably center their endeavors on brisk, simple focuses with reasonable budgetary payouts.
What do hackers really want?
With the data breach ticking higher than at any other time in the world today, it shows plainly that cyber security is one of the greatest difficulties confronting organizations today. Also, with every breach affecting at least 20,000 individual records, consumers can no longer choose not to see.
Cybercrime does not discriminate. It affects organizations of all sizes. However, we can distinguish the trends and high-risk sectors that will probably pull in their attention and endeavors.
Here are four focuses that are at the highest point of hackers' list:
' Identity
Identity extortion is not specifically new. However, reports of late recommend that while it is hard for newer technology create fake identities, cybercriminals are resorting to take genuine identities with more steadiness.
The Veda 2015 Cybercrime and Fraud Report found that almost 60 percent increment in fake credit applications including identity takeovers in Australia in the previous two years and a 17 for every penny increment took place in the previous year. Furthermore, with every data breach of consumer information, identity theft turns into a very easy thing.
' Company Information
Smaller companies/ businesses are almost always defenseless against cyber-attacks. Cyber storms that numerous large companies can go through easily can without much of a stretch sink littler ones. Tragically, private ventures hoping to upgrade their financial plans frequently see vigorous security arrangements as resentment buy.
Be that as it may, the most perilous thing for small business proprietors to believe is, "We're not big enough for cyber attackers." Research has found that Ransom ware assaults are presently focusing on SMBs because of their more careless security measures and ability to pay.
' Convenient Cloud based platforms
Some platforms like MyGov offer consumers a helpful approach to get to government organizations and data. Utilizing only one login and password, the platform empowers you to do everything from recording pay charges or applying for kid support to dealing with your ABN. Be that as it may, this basic or combined arrangement makes a nectar pot for hackers.
Organizations entrusted with shielding these sorts of platforms need to guarantee the strictest levels of security, particularly in the wake of the late breach of finance systems and assessment document numbers.
' Medical
It might appear to be surprising for cybercriminals to be bothered with what occurred amid your last visit to the hospital, yet healthcare and medical associations offer a fortune of data rich information. That information, if utilized as a part of the correct route by the wrong individuals, can pulverize for purchasers and organizations.
Gossipy tidbits around the strength of the late Steve Jobs created a sharp fall in Apple stocks and it was later uncovered that Charlie Sheen's HIV diagnosis was initially revealed in the Sony hack. In any case, you don't need to be a big name or prominent focus to be a casualty of hackers utilizing your very individual data for their own gain.
Consumers take a huge risk each time they trust their own information to poorly prepared and underprepared organization and they're beginning to take note. A late review found that, while considering new innovations, privacy is presently the greatest concern toward more than 66% of customers in the world.
It is high time organizations and businesses made full moves to secure their IP and all their client data. Encrypting what you deem important to your business is a decent place to begin. However, far superior are arrangements that use multilayer encryption with private keys that are claimed and overseen by the client. It's about discovering arrangements that strike the correct adjust of security and efficiency.
It is quite safe to state that this is a fight that won't be won at any point in the near future yet in the event that cyber-criminals can misuse human vulnerabilities for 'snappy wins', IT needs to venture in and proffer security that permit to human shortcoming.