QUESTION(S):
In response to your peers, using your security analyst perspective to counteract the adversarial mindset, how would you address the risks to the CIA that your peers have identified?
PEER POST # 1
In my first week’s discussion, I spoke about Cloud computing and some of the advantages that it offers to companies. Cloud computing also poses several disadvantages and risks. Cloud computing downtime is a huge negative as it could cause massive harm to business productivity and cost the company a massive amount of money depending on how long the downtime lasts. A couple of potential security risks with cloud computing are that even though cloud computing service providers implement industry standards security protocols, storing data of importance on external servers always exposes you to more risk. In addition, Having all of your files online opens you up to many vulnerabilities. In this discussion downtime ties into Availability, Hosting your data on external servers ties into Confidentiality and having all of your data online leaving it vulnerable to bad actors ties into integrity. PEER POST # 2
The technology I discussed previously was the remote workforce. Remote customer-facing services such as Tech/Customer support are a cost effective solution in reducing the expense of brick and mortar locations. Thinking with an adversarial mindset and determining the risks or dangers would be largely in assessing damage I could do. I’d be aware of the fact that using a remote workforce increases an organization’s attack surface space and I would target companies with BYOD policies. I would also depend largely on human error and lack of compliance in order to find the weak spots. To attack confidentiality, I’d attempt to steal credentials either through phishing or a key logging attack installed via a phishing attack. Or, if Windows 10 or 11 is installed, accessing and manipulating the “inking and typing dictionary” feature may be beneficial in a dictionary attack. I would attack the integrity of the data by utilizing ransomware that encrypted the data with my own key. Or, I’d implement a backdoor attack so that I could access the system whenever I wanted and steal sensitive customer data, payroll data, and proprietary information. To attack availability, I’d deploy a denial of service attack and interrupt daily operations.
The post QUESTION(S):
In response to your peers, using your security analyst perspective appeared first on Scholars Hub Blog.
