Human Dimensions of Cybersecurity

Cover
Half Title
Title Page
Copyright Page
Contents
Foreword
Preface
Glossary
List of Cyber Nuggets
Authors
1 Introduction
	1.1 That Could Have Been Me
	1.2 A Brief History of Cybersecurity
		1.2.1 The German Celebrity Hack
		1.2.2 The Australian Parliamentary Hack
	1.3 The Big Picture
	1.4 Overview
2 Case Studies
	2.1 Denial of Service
		2.1.1 Motivation and Frequency of DoS Attacks
		2.1.2 Preventing and Countering a DoS Attack
	2.2 Ransomware
		2.2.1 WannaCry
		2.2.2 Petya and NotPetya
	2.3 Check Before You Send: Business Email Compromise (BEC) Attacks
		2.3.1 Blockchain Land Titles
	2.4 When Too Much Concern over Cybersecurity Is Too Much: Opting Out of My Health Records in Australia
	2.5 Corporate Data Breaches
		2.5.1 Supply Chain Attacks
		2.5.2 Illustrative Floods
			2.5.2.1 Guard Your CV
			2.5.2.2 The Equifax Hack
			2.5.2.3 Don’t Organize an Affair Online
			2.5.2.4 Flood Prevention
	2.6 The Nation State and CyberSecurity: Firewalls, Friends, and Enemies
		2.6.1 The Great Firewall, Golden Shield, and the Great Cannon of China
		2.6.2 Social Credits Anyone?
	2.7 Encryption: The Government Is Your Friend but Not Always Your Best Friend
		2.7.1 Can the Law of the Land Defeat the Law of Mathematics?
		2.7.2 Who Watches the Watchers and the Impact on the Economy
	2.8 Cambridge Analytica
	2.9 Trampling over Transport Layer Security
	2.10 Beware the Insider
3 Networks and Norms
	3.1 Introduction
	3.2 Mindsets
	3.3 Social Networks
		3.3.1 Some Elementary Graph Theory
			3.3.1.1 Small Worlds
			3.3.1.2 Scale-Free Networks
			3.3.1.3 Network Motifs
		3.3.2 Some Measures on Networks
			3.3.2.1 Clustering and Assortativeness
			3.3.2.2 Betweenness Centrality
			3.3.2.3 Modularity
		3.3.3 Network Discovery
		3.3.4 Using and Transforming Networks
		3.3.5 Friends of Friends
		3.3.6 Secure Networks
	3.4 Social Norms
		3.4.1 Emergent versus Agreed Norms
		3.4.2 Trends and Social Media Marketing
		3.4.3 Some Adverse Social Norms in Cybersecurity
			3.4.3.1 Terms and Conditions
			3.4.3.2 Data Security
			3.4.3.3 Cyber Hygiene
			3.4.3.4 Distributed Trust
			3.4.3.5 Slack Email
			3.4.3.6 Good and Bad Advice
			3.4.3.7 The Ups and Downs of Virtual Private Networks
			3.4.3.8 Data Fragility
	3.5 Modularity in Cybersecurity
		3.5.1 Concluding Comments
4 Consumer Choice
	4.1 Introduction
	4.2 Cybersecurity as Predicted by Demographics
	4.3 Cybersecurity and the Theory of Reasoned Action
	4.4 Motivation To Avoid Harm (MTAH) and Cybersecurity
	4.5 The Technology Acceptance Model (TAM) and the Adoption of New Technologies in Cybersecurity
	4.6 Social and Situational Factors in Cybersecurity
		4.6.1 Trust and Risk in the Online Environment
		4.6.2 Cybersecurity as Predicted by Personality
		4.6.3 Stress and Time Pressures on Users
		4.6.4 Information Overload
	4.7 Improving the Security Behavior of Users
		4.7.1 A Need for a Systematic Approach to Cybersecurity
5 Risk Perspectives in Cybersecurity
	5.1 Introduction
	5.2 Costs and Occurrences of Cyberattacks as of 2018
	5.3 Types of Threats and Their Associated Risks
		5.3.1 Threats by Source of Attack
		5.3.2 Threats by Type of Attack
			5.3.2.1 DDoS Attacks
			5.3.2.2 Middleware Attacks
			5.3.2.3 Spoofing Attacks
			5.3.2.4 Social Engineering Attacks
			5.3.2.5 Advanced Persistent Threat (APT)
6 Government Policy and Statecraft in Cybersecurity
	6.1 Legal Frameworks and Their Effects on Reducing Risk
	6.2 Accreditation and National Frameworks to Reduce Cyber-Risks
		6.2.1 CBEST
		6.2.2 Framework for Improving Critical Infrastructure Cybersecurity or the National Institute of Standards and Technology (NIST) Framework
		6.2.3 The Australian Signals Directorate Essential Eight
	6.3 Other Approaches to Corporate Governance to Reduce Cyber-Risk
	6.4 Cyber Warfare
	6.5 Conclusion and Recommendations
7 Technical Perspectives
	7.1 Public–Private Key (PPK) Cryptography
	7.2 Some Preliminary Concepts
		7.2.1 Asymmetric Cyphers
		7.2.2 Diffie–Hellman, with Apologies to Mary Poppins
			7.2.2.1 Numerical Example
		7.2.3 The RSA Algorithm
			7.2.3.1 The Really Hairy Part
		7.2.4 Elliptic Curve Cryptography (ECC)
	7.3 Symmetric Encryption
		7.3.1 Advanced Encryption Standard (AES)
		7.3.2 Stream Cyphers
	7.4 Keys Galore
		7.4.1 Communication Keys
		7.4.2 Good and (Very) Bad Signatures
		7.4.3 Antiencryption Legislation
	7.5 Passwords
		7.5.1 The Password File
		7.5.2 Good Passwords
		7.5.3 Password Managers/Safes
			7.5.3.1 Using the Browser
			7.5.3.2 Rainbow Tables
			7.5.3.3 Key Exchange Precomputation
			7.5.3.4 Storing Passwords Locally
			7.5.3.5 Online Password Safes
		7.5.4 Two-Factor Identification
	7.6 Biometrics
	7.7 Basic Ideas of Computer Networks
		7.7.1 Network Layers
			7.7.1.1 Protocol Stacks. A Simple Analogy
			7.7.1.2 Abstraction
			7.7.1.3 TCP: The Transport Control Protocol
			7.7.1.4 UDP: The User Datagram Protocol
			7.7.1.5 The Application Layer
		7.7.2 Addresses of All Sorts
			7.7.2.1 IP Addresses for the Internet
			7.7.2.2 Ethernet
			7.7.2.3 WiFi
		7.7.3 Domain Name Server (DNS)
	7.8 Increasing Internet Security
		7.8.1 IPSec: Going a Bit Deeper
		7.8.2 Ports, Firewalls, and Filters
			7.8.2.1 Detecting Open Ports
	7.9 Virtual Private Networks
		7.9.1 Virtual Private Networks in the Home
		7.9.2 Choosing a VPN
		7.9.3 Value of a Virtual Private Network
		7.9.4 Avoiding the Need for VPNs
	7.10 Onions and the Dark Web
		7.10.1 The Dark Web and Onion Routing
	7.11 Local Threats and Malware
	7.12 Certificates and Trust
		7.12.1 Public Key Infrastructure (PKI)
	7.13 Email
		7.13.1 Spoofing
		7.13.2 Email Security
			7.13.2.1 Sender Policy Framework Results
	7.14 Blockchains
		7.14.1 The Hard Fork
	7.15 EU Data Protection Rules
	7.16 Quantum Computing
		7.16.1 Mr Hyde: Superposition and Parallel Computation
		7.16.2 Dr Jekyll: Entanglement
8 The Future
	8.1 Keeping Nasties Out
		8.1.1 Formal Validation
	8.2 Use of Encryption
	8.3 Encouraging Good Cyber Practice
		8.3.1 The Scourge and Salvation of Email
	8.4 Teaching People Safe Practices
		8.4.1 Gamification
			8.4.1.1 Marketing Campaigns for Cybersecurity
	8.5 Changing Criminal Models and the Arms Race with the Authorities
		8.5.1 Do People Learn?
		8.5.2 New Legal Agendas
	8.6 Hyperstorage and Machine Learning and Privacy
		8.6.1 Protecting the Vulnerable from Themselves
	8.7 The Mink and the Porcupine
	8.8 Take It Away, Renatus
References
Index