Cybersecurity Crash Course

CYBERSECURITY
CRASH COURSE
Lesson 1: Cybersecurity Basics
Patch Management
Patching is a very important security control. Start by listing the apps, operating
systems and browsers that you use:
Windows Patch Newsletter:

Follow this link:
https://www.microsoft.com/en-us/msrc/technical-security-notifications
Encryption Exercise
You can test various encryption algorithms at this link:
https://www.tools4noobs.com/online_tools/encrypt/
Lesson 2: NIST Cybersecurity Framework
NIST Cybersecurity Framework

Check out the security framework here:
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
Framework Structure:
Lesson 3: Physical Security
Physical Security
Here are some physical security issues you should take into consideration:
○ Ceiling tiles over secure rooms

○ Hinges on outside of doors
○ Bar handle doors that can be open with hooks
○ Wide gaps around door latch
Security Training
Train your employees on physical security issues including:
● Document shredding
● Erasing data correctly
● Promote security in ALL locations
● Know the response plan
Lesson 4: Ransomware
The Start
Here are some of the common ways that attackers are able to deploy
ransomware on your network:
● Phishing & Scam Emails

● Vulnerabilities on your network
● Infectected websites
● Malicious Ads
Awareness Training
Training your employees on the risk of cybersecurity threats like ransomware can
drastically improve the security of your organization. We have partnered with
Wizer training to provide completely free security awareness training to your
employees.
training.cyberx.tech
Lesson 5: Phishing
Spotting Phishing Emails

It can be difficult to spot phishing emails. Here are some ways that you can:
● Check URLs (browserling.com)

● Look at email headers
● Ask a colleague
● Call the sender using a phone number that you know is legitimate
Protect Your Business
● Have backups in place

● Keep security and operating systems up to date
● Alert and train your staff
● Implement Email Authentication Protocols
● Implement and enforce 2FA
Lesson 6: Business Email Compromise
Protect Your Business
● Email authentication
● Keep security and operating systems up to date
● Policies and procedures around risky activities - money transfers,
changing payment methods, etc
Lesson 7: Tech Support Scams
What the scammers ask for:
● You to give remote access
● Enroll in fake computer maintenance or warranty program
● Install some kind of application
● To give them your credit card info to pay bills or services
● Sell you software or a repair that is worthless
● Send you to websites or forms to collect credit cards, bank account
info, or other personal information

Lesson 8: Vendor Security
Vendor Security Assessment Guides:
https://www.vendorsecurityalliance.org/
Lesson 8: Vendor Security
Vendor Security Assessment Guides:
https://www.vendorsecurityalliance.org/
Lesson 9: Cyber Insurance
Common Cyber Insurance Breakdown
First Party Coverage
Legal counsel to determine your notification and

regulatory obligations
Recovery and replacement of stolen data
Customer notification and call center services
Lost income due to business interruption
Crisis management and public relations
Cyber extortion and fraud
Forensic services
Fees, fines, and penalties
Third Party Coverage
Payments to consumers
Claims and settlements
Losses related to defamation or trademark issues
Cost for litigating to regulatory inquiries
Other settlements, damages, and judgements
Accounting Costs
Lesson 10: Email Authentication
Mechanisms
Mechanisms are used to describe which hosts are designated outbound mailers
for the domain and can have four qualifiers:
+ Pass
- Fail
~ Softfail
? Neutral
Examples:
“v=spf1 =all”
“v=spf1 a -all”
“v=spf1 a mx -all”
“v=spf1 +a +mx -all”
The “all” mechanism
all
This mechanism always matches. It should always be at the end of the SPF
record.
Lesson 10: Email Authentication
The “ip4” mechanism
ip4:0.0.0.0
ip4:0.0.0.0/24
The “mx” mechanism
mx
mx/<prefix-length>
mx:<domain>
mx:<domain>/<prefix-length>
The “include” mechanism
include:<domain>
Lesson 11: Web Security
Web Security Checklist
Use SSL/TLS
Email Authentication (SPF, DKIM, DMARC)
Regularly update
Management and upkeep (who will handle?)
Is MFA available
Lesson 12: Secure Remote Access
Protecting Your Devices:
● Change default passwords on routers

● Keep operating systems up to date
● Full Disk Encryption on devices that travel
● Updating mobile devices
● Use secure WiFi
Tool Spotlight:
Wizer is a completely free security awareness training platform that

you can use to train your employees on the security risks they face.
There is a paid option that includes special items like phishing tests
and gamification, but you can start improving your employees
awareness for free in just 90 seconds.
www.training.cyberx.tech

Cybersecurity Crash Course

Uploaded by

Copyright:

Available Formats

Cybersecurity Crash Course

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cybersecurity Crash Course

Uploaded by

Copyright:

Available Formats

What are some important security controls discussed?

What are some important security controls discussed?

What are some common ways ransomware can be deployed?

What are some common ways ransomware can be deployed?

CYBERSECURITY

Windows Patch Newsletter:

NIST Cybersecurity Framework

○ Ceiling tiles over secure rooms

● Phishing & Scam Emails

Spotting Phishing Emails

● Check URLs (browserling.com)

Protect Your Business

● Have backups in place

Protect Your Business

What the scammers ask for:

● You to give remote access

● Enroll in fake computer maintenance or warranty program

● Install some kind of application

● To give them your credit card info to pay bills or services

● Sell you software or a repair that is worthless

● Send you to websites or forms to collect credit cards, bank account

info, or other personal information

Vendor Security Assessment Guides:

Vendor Security Assessment Guides:

Common Cyber Insurance Breakdown

First Party Coverage

Legal counsel to determine your notiﬁcation and

Recovery and replacement of stolen data

Customer notiﬁcation and call center services

Lost income due to business interruption

Crisis management and public relations

Cyber extortion and fraud

Fees, ﬁnes, and penalties

Third Party Coverage

Claims and settlements

Losses related to defamation or trademark issues

Cost for litigating to regulatory inquiries

Other settlements, damages, and judgements

“v=spf1 +a +mx -all”

The “all” mechanism

The “ip4” mechanism

The “mx” mechanism

The “include” mechanism

Web Security Checklist

Email Authentication (SPF, DKIM, DMARC)

Management and upkeep (who will handle?)

Protecting Your Devices:

● Change default passwords on routers

Wizer is a completely free security awareness training platform that

You might also like