A new weakness is announced
On Monday morning a famous program has a new weakness. Hackers are already using it.
Where does a security team look first? A blog? A friend? In cyber security some sources are official, and they matter most.
Key words
| Word | What it means | Example |
|---|---|---|
| Webinar | a talk or lesson given live on the internet | a security expert shows how an attack works |
| Professional body | a group that sets standards for people in one job | CIISec, CREST, ISACA |
| Regulator | an official group that checks that laws are followed | the ICO |
| Standard | an agreed list of good practice | Cyber Essentials |
| Accreditation | proof from a test or award that a person or company has a skill | |
| Vulnerability | a weakness that an attacker could use | |
| CVE | a public list of known weaknesses, each with its own number | |
| Database | an organised store of information that you can search | |
| Policy | a written rule that a company expects everyone to follow |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name the extra kinds of source used in cyber security and say what each one gives.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Seven sources only security lists
| Source | Example | What it gives you |
|---|---|---|
| Webinar | A live talk by a security expert | Fresh news and a chance to ask questions |
| Professional body | CIISec, CREST, ISACA, UK Cyber Security Council | Standards for the job and trusted guidance |
| Policy | A company information security policy | The rules of your own workplace |
| Guidelines and laws | Data Protection Act 2018 | What you must and must not do |
| Regulating authority | The ICO | Who checks the law, and advice on it |
| Industry standard | Cyber Essentials, CIS Benchmarks | A checklist of good practice |
| Industry accreditation | CompTIA, CCP, ISC2 | Proof that a person was tested |
| Database | CVE | A public list of known weaknesses |
The cells students fill in are left blank in this preview.
Official sources first
A regulator such as the ICO is the official voice on data protection law in the UK. A standard such as Cyber Essentials was written by experts and is used by many firms.
A CVE entry names one vulnerability and gives it a number, so everyone talks about the same weakness. Look the number up before you trust a rumour.
Check
Have a go
Check
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.