Summary of Cybersecurity: Concepts, Threats, and Defenses

## Introduction Cybersecurity threats and risks evolve constantly. This material focuses on specific network- and email-based attacks and insider risks that target organizations' communications and endpoints. You will learn how these threats work, how to detect them, and practical defenses. > **Definition:** Business Email Compromise (BEC) — an attack where an adversary spoofs or compromises an executive's email to instruct finance staff to make fraudulent wire transfers. ## Email-based Threats ### Business Email Compromise (BEC) - How it works: - An attacker spoofs or gains access to an executive's email account. - The attacker sends urgent-looking instructions to finance or procurement staff to transfer funds or reveal sensitive information. - Impact: - Direct financial loss (often large wire transfers) - Reputational damage and costly recovery processes - Practical example: - A CFO account is spoofed and the finance team receives an email stating an urgent vendor payment is due. The team wires $250{,}000 to an account controlled by the attacker. > **Definition:** Email spoofing — forging the sender's address to impersonate a trusted entity such as a bank, government agency, or company executive. ### Defenses for Email Threats - Technical controls: - Implement **SPF**, **DKIM**, and **DMARC** to validate sender authenticity - Deploy enterprise email gateways that scan for phishing indicators and attachment threats - Human controls: - Train staff to verify unusual or urgent payment requests through a separate channel (phone call or face-to-face) - Establish payment approval workflows requiring at least two independent verifications - Detection tips: - Check email headers for SPF/DKIM/DMARC results - Look for subtle domain typos and unusual reply-to addresses Fun fact: Implementing DMARC with a reject policy can drastically reduce spoofed emails reaching users and has prevented millions of phishing attempts for major organizations. ## Network-based Attacks ### Man-in-the-Middle (MitM) - How it works: - An attacker positions themselves between two communicating parties and intercepts, reads, modifies, or injects messages without detection. - Common scenarios: - Unsecured Wi‑Fi hotspots where attackers intercept traffic - Compromised routers or proxy servers - Real-world application: - An attacker intercepts credentials sent over HTTP and reuses them to access services. ### ARP Poisoning (Local Network MitM) - How it works: - The attacker sends forged ARP messages on a LAN to associate the attacker's MAC address with the IP of a legitimate host (gateway or server). - Traffic meant for the legitimate host is routed through the attacker’s device. - Indicators: - Sudden bursts of ARP traffic - Multiple IP addresses resolved to a single MAC - Defenses: - Use static ARP entries for critical devices - Deploy network segmentation and VLANs - Use network intrusion detection systems (NIDS) to detect anomalous ARP activity ### DNS Spoofing / Cache Poisoning - How it works: - An attacker inserts fraudulent DNS records into a resolver’s cache, causing users to be redirected to attacker-controlled sites without visible signs. - Consequences: - Credential theft via fake login pages - Distribution of malware or fraudulent content - Defenses: - Use DNSSEC to sign DNS records and validate responses - Harden recursive resolvers and limit cache lifetimes - Monitor unexpected DNS answers and unusual domain-to-IP mappings Table: Comparison of network interception techniques | Technique | Scope | Typical target | Defenses | |---|---:|---|---| | MitM (general) | Broad (end-to-end sessions) | Clients on insecure networks, proxy servers | TLS with certificate validation, VPNs, HSTS | | ARP Poisoning | Local LAN | Devices on same broadcast domain | Static ARP, VLANs, NIDS | | DNS Spoofing | DNS resolution process | All clients using poisoned resolver | DNSSEC, hardened resolvers | ## Endp