Why cyber security
Confidentiality, integrity and availability, who attacks and why, and ranking risk.
Do this lesson in the simulatorEvery computer holds something worth protecting: your messages, your school's records, a company's money, a robot's controls. Cyber security is keeping computers, networks and data safe from harm and from people who should not have them. This module is about the ways systems are attacked, and the ways they are defended. It starts with what we are protecting, and from whom.
What are we protecting?
Security has three goals, sometimes called the CIA triad:
- Confidentiality: only the right people can read the data. Your password should be secret.
- Integrity: the data is correct and has not been changed. A bank balance must not be altered by anyone but the bank.
- Availability: the system works when it is needed. A hospital's computers must not be knocked offline.
An attack breaks one or more of these. Reading someone's private messages breaks confidentiality; changing an exam grade breaks integrity; flooding a website until it crashes breaks availability.
Who attacks systems, and why?
| Attacker | Motivation |
|---|---|
| criminals | money: stealing data to sell, or holding it to ransom |
| hackers showing off | reputation, or the challenge |
| an unhappy insider | revenge, or theft, using access they already have |
| activists | to make a political point |
| other countries | spying, or disruption |
Not every threat is an attacker. Data is also lost to accidents, faulty hardware, and honest mistakes, and a good security plan protects against those too.
The weakest link is usually people
Most breaches do not start with clever code. They start with a person: someone who uses password123, clicks a link in a fake email, or props a secure door open. Attacks that trick people are called social engineering, and they are lesson F11.3. Technology can only do so much when someone gives the attacker the key.
A quick risk model
You cannot protect everything equally, so security is about managing risk: how likely is each threat, and how bad would it be? Sort the biggest risks to the top.
# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()
# each risk: name, how likely (1 to 5), how bad (1 to 5)
risks = [("weak passwords", 4, 5), ("lost laptop", 2, 4), ("phishing email", 5, 4), ("power cut", 3, 2)]
risks.sort(key=lambda r: r[1] * r[2], reverse=True) # likelihood times impact
for name, likelihood, impact in risks:
print(f"{name}: risk score {likelihood * impact}")
Task: rank the risks
Give each risk in risks a score of likelihood times impact. Print each as <name>: <score>, sorted from the highest score to the lowest. Then print biggest risk: <name> for the one at the top.
# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()
# name, likelihood (1 to 5), impact (1 to 5)
risks = [("weak passwords", 4, 5), ("stolen laptop", 2, 4), ("phishing email", 5, 4), ("power cut", 3, 2), ("out-of-date software", 4, 3)]
Challenges
- Add a risk of your own and see where it ranks.
- For each risk, say which of confidentiality, integrity and availability it threatens.
- Which two risks would you spend money on first, and why?