All
right, let's dive in and take a look at
Module 1, which deals with information security threats and vulnerabilities.
Again, I'm using what I like to call Eric's Director's Cut version of the
slides, which distills everything down to the most pertinent
points, initial definitions, initial concepts, without
enumerating or elaborating too much on them for the first pass.
Now, you will see examples of different flavors of, laundry lists of,
characteristics of, pretty much any of these topics we talk about.
You have several different examples.
I'm going to give you a quick overview.
We're really at this point trying to get concepts down, basic definitions to load
up with that initial framework infrastructure, and then you can start
expanding on that as you go through and read the course more in depth.
So, first off, what is a threat?
A threat is defined as the potential occurrence of an undesirable event.
So the potentiality, something bad may happen.
Now, typically that means something that threatens the confidentiality, the
integrity, or the availability of a data resource or competing resource.
So there's lots of different examples of that.
Attackers use cyber threats to infiltrate and steal data, personal information,
financial information, login credentials, etc.
The threat is a possibility, right?
Threat sources.
The sources can be natural threats,
natural disasters, fires, floods, earthquakes, hurricanes, etc.
They can be unintentional, which is typically due to user error.
The human is always the weak link in the security chain.
So if something can screw it up along the
way, it's probably going to be a human, improper policy, configuration, so forth.
They're always the weak link in the security chain.
So unskilled administrators, accidents, lazy, or untrained employees.
And then intentional is intentional wrongdoings.
Fired employees, disgruntled employees,
service providers, external threat actors, hackers, criminals, terrorists, etc.