Lecture

Cybersecurity: Threat Modeling and Attack Strategies

Graph Chat

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

Description

This lecture covers threat modeling, attack methods, and cybersecurity tools. It explores the Social-Engineer Toolkit, web attacks, and the importance of reducing the attack surface. Concepts like STRIDE methodology, risk computation, and security controls are discussed. The instructor emphasizes the need for detection and reaction capabilities in cybersecurity.

Official source

Ontological neighbourhood

Computer engineering

Computer security: Information security

Related concepts (32)

Security controls

Security controls are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information. Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency.

Information security

Information security, sometimes shortened to InfoSec, is the practice of protecting information by mitigating information risks. It is part of information risk management. It typically involves preventing or reducing the probability of unauthorized or inappropriate access to data or the unlawful use, disclosure, disruption, deletion, corruption, modification, inspection, recording, or devaluation of information. It also involves actions intended to reduce the adverse impacts of such incidents.

Attack surface

The attack surface of a software environment is the sum of the different points (for "attack vectors") where an unauthorized user (the "attacker") can try to enter data to, extract data, control a device or critical software in an environment. Keeping the attack surface as small as possible is a basic security measure. Worldwide digital change has accelerated the size, scope, and composition of an organization's attack surface. The size of an attack surface may fluctuate over time, adding and subtracting assets and digital systems (e.

Threat (computer)

In computer security, a threat is a potential negative action or event facilitated by a vulnerability that results in an unwanted impact to a computer system or application. A threat can be either a negative "intentional" event (i.e. hacking: an individual cracker or a criminal organization) or an "accidental" negative event (e.g. the possibility of a computer malfunctioning, or the possibility of a natural disaster event such as an earthquake, a fire, or a tornado) or otherwise a circumstance, capability, action, or event.

Cloud computing security

Cloud computing security or, more simply, cloud security, refers to a broad set of policies, technologies, applications, and controls utilized to protect virtualized IP, data, applications, services, and the associated infrastructure of cloud computing. It is a sub-domain of computer security, network security, and, more broadly, information security. Cloud computing and storage provide users with the capabilities to store and process their data in third-party data centers.

Related lectures (63)

Cybersecurity: Threat Modeling and Solutions

Explores cybersecurity fundamentals, threat modeling, real-world case studies, and digital forensics procedures.

HTTP Desync: Request Smuggling Reborn

Explores HTTP request smuggling, a vulnerability to bypass security controls, with examples and defense strategies.

Cybersecurity Fundamentals

Covers the basics of cybersecurity, including the importance of protecting systems from digital attacks and the motivation behind cybercrimes.

Protecting Work: Threats

Discusses the importance of protecting work and EPFL through laws, regulations, threat identification, data protection, risk prevention, and security controls.

Data, big data, clouds and IoT