Health information security 3 vulnerability threat and risk
•Download as PPTX, PDF•
1 like•67 views
The document discusses common cybersecurity concepts including vulnerabilities, threats, and exploits. It defines vulnerabilities as weaknesses that can be exploited, threats as potential events that can harm systems or data, and exploits as techniques used to breach security. Examples of threats include natural disasters, human threats from insiders like employees or hackers, and technology threats such as malware, denial of service attacks, and social engineering. Common types of malware are discussed like viruses, worms, Trojans, and ransomware, as well as attack methods like backdoors, brute force attacks, spoofing, and man-in-the-middle assaults. Social engineering tricks people using phishing, baiting, pretexting, and scareware.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Health information security 3 vulnerability threat and risk
Similar to Health information security 3 vulnerability threat and risk (20)
More from Dr. Lasantha Ranwala
Recently uploaded
Recently uploaded (20)
Health information security 3 vulnerability threat and risk
- 1. Vulnerability , Threat & Exploit Dr. Lasantha Ranwala MBBS, MD- Health Informatics Cert. in Ethical Hacking & Cyber Forensic Senior Registrar in Health Informatics Health information security session 03
- 2. Vulnerability A characteristic or specific weakness that renders an organization or asset (such as information or an information system) open to exploitation by a given threat or susceptible to a given hazard.
- 3. Threat A circumstance or event that has or indicates the potential to exploit vulnerabilities and to adversely impact organizational operations, organizational assets (including information and information systems), individuals, other organizations, or society.
- 4. Exploit A technique to breach the security of a network or information system in violation of security policy. A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.
- 5. Vulnerability ,Threat & Exploit Ex: Asset: digital document: vulnerability: access control scheme is not properly defined (potential loss of confidentiality, integrity and availability) Threat: unauthorized access;
- 6. Threat agent Specific object, person who poses such a danger (by carrying out an attack) e.g.: DDoS attack from a Hacker DDOS attack >> Threat Hacker >> Threat Agent
- 7. Types of Threats Natural treats Human threats Technology threats
- 9. Human Threats: Insiders Employees are among the greatest threats to an organization’s data 3 Types 1. Non-malicious insider 2. Malicious insider 3. Compromised insider
- 10. Non-malicious Insider Acts of Human Error Acts performed without malicious intent but cause harm to an organization due to : Inexperience Improper training Incorrect assumptions carelessness Shadow IT users (using non-approved tools) Eg:use a application such as a file-sharing app to increase productivity, but inadvertently expose the company to threats
- 11. Non- malicious Insider Continu..... • Revelation of classified data • Entry of erroneous data • Accidental data deletion or modification • Data storage in unprotected areas • Failure to protect information Employee mistakes can cause
- 12. Malicious Insider Aware of their actions and the negative implications on the organization, yet still pursue that course of action. What insiders can do Espionage: The act of using a position of trust or an individual within an organization to the benefit of a third party Sabotage: Disrupting the normal course of operations of an organization by damaging or otherwise adversely affecting a process, equipment, or other property Embezzlement: Theft of money or appropriating company resources for personal use Vandalism: Willful destruction of company property Violence: Can be threats of violence or physical violence
- 13. Compromised Insider A person with no malicious intent who becomes an unknowing accomplice of third parties who gain access to their device and/or user credentials. • credentials have been guessed or captured as part of a targeted attack • actor behind the account is not an employee - the use of legitimate credentials would show up as if it were an employee
- 14. Technology threats Act or action that exploits vulnerability in controlled system Accomplished by threat agent which damages or steals organization’s information Attacks
- 15. Common Attacks Types 1.MALWARE : any malicious software designed to harm a computer without the user’s permission VIRUS computer program designed to copy itself and attach itself to other files stored moves from computer to computer /can be sent through a network Almost all viruses are attached to an executable file, which means the virus may exist on a system but will not be active or able to spread until a user runs or opens the malicious host file or program.
- 16. WORM self replicating computer program that uses a network to send copies of itself to other computers on the network It replicates and eats up the computer storage Computer worms are similar to viruses in that they replicate functional copies of themselves and can cause the same type of damage In contrast to viruses, worms are standalone software and do not require a host program or human help to propagate. To spread, worms either exploit a vulnerability on the target system or use some kind of social engineering to trick users into executing them.
- 17. TROJAN They appear to be harmless but secretly gather information about the user. They upload hidden and malicious programs on the computer without the user’s knowledge. Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate. Trojans must spread through user interaction such as opening an e- mail attachment or downloading and running a file from the Internet. .
- 18. Ransomware: a type of malicious software designed to block access to a computer system until a sum of money is paid. Video : https://www.youtube.com/watch?v=d_ dyi9CWieo&t=62s
- 19. Browser Hijacker unwanted software that modifies a web browser's settings without a user's permission, inject unwanted advertising into the user's browser. may replace the existing home page, error page, or search page with its own. increasing its advertising revenue. Some browser hijackers also contain spy ware.
- 20. 2.Backdoor gaining access to system or network using known or previously unknown/newly discovered access mechanism
- 21. 3.Brute force: A password and cryptography attack that does not attempt to decrypt any information, but continue to try a list of different passwords, words, or letters. The higher the type of encryption used (64-bit, 128-bit or 256-bit encryption), the longer it can take
- 22. 4: Denial-of-service (DoS) Attempts to prevent legitimate users from accessing information or services. may be able to prevent you from accessing does not usually result in the theft of information or other security loss, Typically the loss of service is the inability of a particular network service email, websites, online accounts (banking, etc.),
- 23. 5.Distributed denial- of-service (DDoS): multiple compromised systems, which are often infected with a Trojan, are used to target a single system causing a Denial of Service (DoS) attack. botnets—large clusters of connected devices Victims of a DDoS attack consist of both the end targeted system and all systems maliciously used and controlled by the hacker in the distributed attack. http://www.digitalattackmap.com Video
- 24. 6.Spoofing impersonation of a user, device or client on the Internet. It's often used during a cyberattack to disguise the source of attack traffic. DNS server spoofing – Modifies a DNS server in order to redirect a domain name to a different IP address. It's typically used to spread viruses. ARP spoofing – Links a perpetrator’s MAC address to a legitimate IP address through spoofed ARP messages. It's typically used in denial of service (DoS) and man-in-the-middle assaults. IP address spoofing – Disguises an attacker’s origin IP. It's typically used in DoS assaults.
- 25. 7.Man-in-the- middle attack where a user gets between the sender and receiver of information and sniffs any information being sent. If user send unencrypted data, man-in-the-middle (MITM) can obtain any unencrypted information. If user send encrypted data he may able to obtain information from the attack, but have to decrypt the information before it can be read
- 28. 8.social engineering Social engineering is an attack vector that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. Phishing: Phishing is when a malicious party sends a fraudulent email disguised as a legitimate email, often purporting to be from a trusted source. The message is meant to trick the recipient into sharing personal or financial information or clicking on a link that installs malware. Baiting: Baiting is when an attacker leaves a malware-infected physical device, such as a USB flash drive in a place it is sure to be found. The finder then picks up the device and loads it onto his or her computer, unintentionally installing the malware. Pretexting: Pretexting is when one party lies to another to gain access to privileged data. For example, a pretexting scam could involve an attacker who pretends to need personal or financial data in order to confirm the identity of the recipient Scareware: Scareware involves tricking the victim into thinking his computer is infected with malware or has inadvertently downloaded illegal content. The attacker then offers the victim a solution that will fix the bogus problem; in reality, the victim is simply tricked into downloading and installing the attacker's malware.
- 29. 8.Social engineering Phishing: Phishing is when a malicious party sends a fraudulent email disguised as a legitimate email, often purporting to be from a trusted source. The message is meant to trick the recipient into sharing personal or financial information or clicking on a link that installs malware. Baiting: Baiting is when an attacker leaves a malware-infected physical device, such as a USB flash drive in a place it is sure to be found. The finder then picks up the device and loads it onto his or her computer, unintentionally installing the malware. Pretexting: Pretexting is when one party lies to another to gain access to privileged data. For example, a pretexting scam could involve an attacker who pretends to need personal or financial data in order to confirm the identity of the recipient Scareware: Scareware involves tricking the victim into thinking his computer is infected with malware or has inadvertently downloaded illegal content. The attacker then offers the victim a solution that will fix the bogus problem; in reality, the victim is simply tricked into downloading and installing the attacker's malware. Social engineering is an attack vector that relies heavily on human interaction and often involves tricking people into breaking normal security procedures.
- 30. Phishing Eg: