Sesión 6

Main ideas / lessons conveyed

• Cybersecurity is for everyone (digital citizenship), not just IT experts.
• Information is valuable (“new gold”) and should be treated as a company/institution asset.
• Cybersecurity is a culture and a shared responsibility across individuals, institutions, and organizations.
• The core model of cybersecurity is the CIA triad:
  • Confidentiality (authorized access only)
  • Integrity (no unauthorized alteration)
  • Availability (accessible when needed)

Recap: What cybersecurity is (definition + CIA triad)

• Cybersecurity: a set of practices, technologies, and processes to protect:
  • networks, devices, programs, and data
  • from attacks, damage, or unauthorized access

CIA triad

• Confidentiality

  • Information/networks/devices/data are visible only to authorized people
  • Example concept: when information is entrusted to you, you must safeguard it

• Integrity

  • Information is not altered without authorization
  • Example: medical data (diagnosis, treatment, lab/pregnancy study) must remain correct and complete

• Availability

  • Information is accessible when required
  • Example: a doctor must be able to retrieve a patient’s medical history during diagnosis or hospitalization

Common cybersecurity threats described

• Malware

  • Malicious software such as: virus, worm, Trojan, spyware, ransomware
  • Goals include damaging systems/apps, causing malfunction, or stealing information

• Phishing

  • Impersonation of identity via emails/text/fake websites
  • Example: a message claiming you “won” a large item; you must fill a form with personal data → identity theft

• Social engineering

  • Psychological manipulation to make people reveal confidential information or take dangerous actions
  • Examples: messages/phone calls (including WhatsApp) claiming emergencies (e.g., “I’m stuck at the border, send money”)
  • Notes: not only older adults; young people/students can also be targeted

• Ransomware

  • Attack where data is hijacked (commonly via encryption) and a ransom is demanded
  • Often attackers “kidnap” data and demand payment to unlock it

• Brute force attacks

  • Automated guessing of passwords using millions of combinations
  • Weak passwords (e.g., pet name, birthdate) make this easier

• Man-in-the-middle (MitM)

  • Interception between two communicating parties/devices
  • The attacker captures transmitted information (including passwords, data)

---

Method / “how to protect” (detailed practical components)

1) Infrastructure security and risk management (organizational defense)

• Understand cybersecurity in the digital age
  • Not only large companies: attacks can target small businesses, hospitals, and individuals’ phones
• Core strategy begins with the operating system
• Define and apply techniques/frameworks/best practices for protecting the OS

Risk management cycle (prevention-focused)

• Inventory all assets
  • Data, software, hardware, networks
  • Also people: who has access to servers/networks/systems
• Identify threats and likelihood
  • How likely an attacker can access/hack
• Assess impact
  • What damage occurs if the threat becomes an incident
• Mitigate/avoid/reduce risk using controls
  • Reduce, eliminate, or transfer risk
• Consider legal requirements
  • Examples implied: service providers must not misuse or disseminate data
• Use technical solutions to reduce risk
  • Firewalls, intrusion detection/prevention, antimalware
  • Encryption in transit
  • Immutable backups

2) Operating system protection (OS-level controls)

• Keep OS updated
  • Install security patches/service packs
  • Analogy: updates “raise the fence” and close “windows/back doors” left by vulnerabilities
• Install and maintain antivirus
  • Acts as a “digital immune system”
  • Must be up-to-date
  • Run scans periodically because new malware emerges
• Use a firewall
  • Monitors and controls incoming/outgoing traffic
  • Allows/blocks connections based on predefined security rules
• Use backups
  • Periodic backups allow recovery after an attack
  • Frequency depends on data importance (hourly/daily/weekly/monthly)
  • Example emphasized: banking may require hourly backups and strong offline protection
• Verify user identity and permissions
  • Authentication (who logs in)
  • Authorization (what programs/data the user can access)
  • Example: separated access by role (e.g., doctors seeing only relevant patient data)

3) Mobile device protection (digital device defense)

• Recognize what phones contain
  • Banking info, private conversations, credentials, sensitive documents
  • Also location/geolocation data (e.g., routine movement, cities connected from)
• Encryption
  • Convert information into unreadable code so attackers can’t access it
  • Encrypt passwords/data “in transit” on banking/social/government/health systems
  • Caution: posting QR codes can enable someone else to use them first at an entrance
• Common-sense data privacy (avoid oversharing)
  • Don’t publish sensitive QR codes that grant access
  • Avoid posting sensitive biometric/digital identity signals (e.g., “I already voted” + digital fingerprint)
• Multi-factor authentication (MFA)
  • Adds an extra barrier beyond a password
  • Examples of second factors:
    • token, facial recognition, PIN, email, or SMS to phone
• Mobile antivirus
  • Blocks malicious apps, detects infected files/dangerous links, protects device and data
• Use VPNs
  • Encrypts connections on public Wi‑Fi
  • Creates an encrypted “tunnel” to keep activity private and protect traffic
• Use strong passwords
  • Avoid trivial patterns (“12345”, consecutive letters, pet names)
  • Complexity guidance: uppercase + lowercase + special character + number
• Password management caution
  • Avoid unsafe storage practices (like writing simple passwords where attackers can find them)
  • Discusses password manager tradeoffs: losing a device can affect access

4) Data protection standards and regulations

• General Data Protection Regulation (GDPR)
  • Created because humans recognized vulnerability to information theft
• ISO 27001
  • International standard defining requirements to establish, implement, and maintain a secure system
• ISO 27000 (referenced)
  • Describes what information and protections should be addressed

Risk and control expectations

• Identify risks/threats
• Ensure CIA (confidentiality, integrity, availability)
• Specify scope, policies, critical files
• Prevent unauthorized access and ensure data accuracy/no duplication
• Continuously review/update controls for new threats

5) Technical security tools described (network/data)

• Firewall
  • Barrier controlling traffic, monitoring connections, allowing/blocking by rules
• Intrusion detection/prevention systems (IDS/IPS)
  • Monitor network traffic and detect suspicious activity
  • Block attacks in real time
• Antimalware
  • Detects/block malware (viruses, ransomware, Trojans, spyware) in real time
• Encryption in transit
  • Uses keys so only authorized people can read data
  • Analogy: “packaging” protects contents so intermediaries don’t know what’s inside
• Immutable backups
  • Backup copies that cannot be altered or deleted after creation
  • Purpose: historical integrity (e.g., bank/hospital records shouldn’t change retrospectively)

---

Cybersecurity operations: monitoring, incident detection, and response (cycle)

• Define an incident
  • Any event compromising CIA (confidentiality, integrity, availability)
  • Can involve an application, network, or devices
• Continuous monitoring
  • Observe network activity, servers, applications, devices
  • Detect anomalies (e.g., sudden large increases in accesses)

Incident response cycle stages

• Collect information during monitoring
• Analyze to confirm if it’s a real incident
• Containment
  • Isolate affected equipment or network segment
  • Slow/stop propagation (attack can continue even if devices are turned off if networking paths remain)
• Preserve evidence
  • Logs, timestamps, screenshots, unusual artifacts
• Notify appropriate people / support process activation

Tools supporting monitoring

• 24/7 monitoring tools
• Centralized event management to detect anomalous patterns

---

Examples used to reinforce concepts

• Medical system example (medical record + devices)

  • Medical records, network-connected X-ray equipment, and doctor tablets are digital assets
  • If connected, they can be attacked
  • Protect via:
    • OS/network protection, encryption, firewalls, secure passwords
    • CIA compliance
    • Strong authentication and separated access by role

• Smart home / home automation example

  • Devices controlling lights/doors/sprinklers must be secured
  • Example scenario: baby monitor camera accessed by others shows why isolation/authentication matters

---

Key Q&A clarification points included

• MFA meaning

  • Multi-factor authentication: password + second verification method (e.g., code to phone)

• Immutable backups meaning

  • Backups that remain fixed and cannot be altered or deleted after creation
  • Should not be “rolled back” to change the past (e.g., July 10 deposit must remain July 10)

• Malware possibly affecting backups

  • Proposed mitigation:
    • update antivirus/antimalware
    • scan backup data before restoring/reusing it
    • verify stored backup information is clean before uploading again

---

Speakers / sources featured

• Professor Alberto (mentioned as discussing cybersecurity principles in the previous session)