Introduction to Cyber Security
Cyber security refers to the body of technologies, processes and practices designed to protect networks, devices, programs and information from unauthorized access.
Cyber security is important because government and organizations collect, process, store and send information. Much of this information is sensitive, and unauthorized access or exposure could have negative consequences.
The most difficult challenge in cyber security is the rapidly evolving nature of security risks.
What is cyber security?
Cyber security describes the discipline dedicated to protecting information and the systems used to process or store it.
Cyber security encompasses the following elements:
What is cybercrime?
Cybercrime is generally defined as a criminal offence that targets a computer system or an electronic device, or where a computer system is used as a tool to commit the crime.
Cybercrime occurs when malicious actors take advantage of vulnerabilities in software, hardware and human behavior online. Their goals include obtaining information, which can be sold, traded, revealed or used to perpetrate more cybercrime.
These malicious actors are often referred to as threat actors.
Cybercrime costs include damage and destruction of data, stolen money, lost productivity, theft of intellectual property, theft of personal and financial data, embezzlement, fraud, post-attack disruption to the normal course of business, forensic investigation, restoration and deletion of hacked data and systems, and reputational harm.
Cybercrime is a significant threat to every organization, government and individual in the world. Cybercrime is increasing in frequency and complexity every year. By 2025, cybercrime is expected to cost the world $10.5 trillion USD.1 To put that number in perspective, the gross domestic product (GDP) of the United States was $22.68 trillion USD in 2021.
Why am I a target?
If you handle information and use information systems, you are a target.
Like anyone in your organization, you could be targeted by threat actors attempting to get access to organizational information or information systems.
While your organization takes steps to reduce and eliminate threats, threat actors will target people like you to gain access to information and information systems. Your organization therefore relies on you to stay vigilant and help detect anomalies that may indicate that an attack is imminent or underway.
To understand why you might be a target for threat actors, you need to consider:
- What services does my organization provide? If these services were disrupted, would this cause hardship?
- What information and networks do I have access to? Could the information or networks hold value for a threat actor?
- Am I an easy target? Am I skeptical of requests asking me to do something, and am I willing to think critically and ask questions before taking action?
We all play a significant part in protecting our organization’s information and assets. If we are part of an organization, no matter what our job title is, we are a conduit to the organization’s most critical information and information systems. In cyber security, these are known as crown jewels.
What to do if you're a victim?
If you think that you may have been the victim of a cybercrime, you should take the following steps:
Best practices
Here are common cyber security best practices that you can adopt. Use them on all your devices – laptops, desktop computers, mobile phones, and smart devices. These best practices are easy to adopt and significantly reduce risk.
Cyber hygiene
Cyber hygiene refers to incorporating good cyber habits or practices into your daily routine.
Adopt these habits to help you and your organization stay cyber safe:
Best practices for managers
People managers have a critical role to play in cyber security. As a leader, you help ensure your team has the resources it needs to protect your organization’s information and assets.
Help your team prepare by:
- Learning the indicators and signs of compromise and ensuring that your team is aware of them as well
- Providing team members with training such as regular simulations so they can recognize social engineering attacks
- Building rapport with the security personnel in your organization to ensure that you have open lines of communication and established trust
- Empowering team members to question any communication that seems suspicious (even from senior leaders) and to hold off taking any requested action until the communication is confirmed as authentic
- Identifying processes for reporting suspicious communication and determining the authenticity of suspicious communication
- Listening to people who have concerns about suspicious communications and directing them to the appropriate authority
- Supporting people should they mistakenly identify a legitimate email as a threat
You need to understand your information environment and any possible threats to this information.
You should regularly conduct a team security audit with a focus on:
- Compliance with local security policies
- Proper information handling
- Team member security responsibilities
- Adherence to policies and best practices
- Regular security awareness activities
People manager checklist
- Are all the information assets within your team appropriately identified with the correct sensitivity classification label?
- Are your employees fully aware of their security responsibilities for the information they handle?
- Do they know what needs to be protected and what doesn’t?
- If you’re not sure, consult with your security official to better understand the team’s information environment, and provide your team with adequate guidance
Free applications (apps)
While you may not pay financially to use free apps, when you accept the terms of use, you agree to share your personal information. This information is sold or shared with third parties, generating revenue for the company who collected your information.
Here are some tips to help protect your personal information when downloading free software or apps:
Choose trusted sources such as Apple’s App Store or Google Play for downloading software or applications. Although they’re not entirely free of malware, these sources have security mechanisms to limit malicious and insecure software and apps.
Check permissions that the apps request and determine if they are justified. If they seem excessive, it’s better to opt for a less intrusive option.
Know what you’re agreeing to. Before you install software or applications, review the terms and conditions.
Use the private browsing option on your device. This safeguard deletes cookies, temporary internet files and browsing history after you close the browser.
Download cautiously. It’s better to avoid danger than to deal with the consequences of a malicious app.