Sesión 5

Ciberseguridad: Fundamentos y Principios

Introducción a la Ciberseguridad

• La sesión se centra en la ciberseguridad, un tema que ha evolucionado significativamente en las últimas décadas debido al avance tecnológico y la interconexión de redes.

• Se enfatiza la importancia de proteger dispositivos conectados a internet, incluyendo IoT e inteligencia artificial, para enfrentar los retos de seguridad actuales.

Actividades Cotidianas y Vulnerabilidades

• Las actividades diarias como el uso de redes sociales, correos electrónicos, aplicaciones móviles y servicios en línea nos hacen vulnerables a ataques cibernéticos.

• Al estar conectados a internet, los usuarios están expuestos a ciberdelincuentes que buscan interceptar datos o causar daño.

Hiperconectividad y Riesgos

• La hiperconectividad permite acceder a información globalmente pero también incrementa el riesgo de exposición personal y empresarial.

• Es crucial entender que esta conexión constante puede llevar a situaciones donde nuestros datos son vulnerables.

Prevención como Estrategia Clave

• La prevención es fundamental para proteger sistemas; se compara con estrategias de salud pública donde "más vale prevenir que lamentar".

• La ciberseguridad se define como un conjunto de tecnologías y prácticas diseñadas para proteger sistemas contra daños o accesos no autorizados.

Conceptos Fundamentales en Ciberseguridad

• El estudio de la ciberseguridad debe enfocarse en entenderla como una herramienta defensiva más que una fuente de miedo.

• Los participantes buscan adquirir conocimientos para defenderse tanto individualmente como institucionalmente ante amenazas digitales.

Protegiendo Datos: Contraseñas y Permisos

Importancia de Proteger Datos

• Los datos son considerados el recurso más valioso para las empresas; su protección es esencial dentro del ámbito de la ciberseguridad.

Métodos Iniciales de Protección

• Las contraseñas son la primera línea de defensa; su uso es común para acceder a dispositivos y sistemas.

• Alternativas modernas incluyen métodos biométricos como huellas dactilares o reconocimiento facial, mejorando así la seguridad inicial.

Gestión de Accesos mediante Permisos

• Los permisos permiten controlar quién accede a qué información dentro del sistema; esto incluye gestionar accesos específicos según necesidad.

Anatomía del Ataque Cibernético

Fases del Ataque Cibernético

• Un ataque cibernético sigue cuatro fases: reconocimiento, intrusión, explotación e impacto. Cada fase representa un paso hacia el objetivo final del atacante.

Comparación con Delitos Reales

• Se establece una analogía entre ataques físicos (como robos reales) y ataques digitales, destacando similitudes en sus métodos operativos.

Tipos de Hackers: Delincuentes vs. Héroes

Clasificación por Sombreros

• Existen tres tipos principales de hackers: sombrero negro (delincuentes), sombrero blanco (protectores), y sombrero gris (oportunistas informativos).

Funciones Específicas:

• Sombrero Negro: Infiltradores dañinos que roban información o causan fraudes.

• Sombrero Blanco: Utilizan herramientas para proteger sistemas contra ataques.

• Sombrero Gris: Identifican vulnerabilidades sin intención maliciosa; ofrecen ayuda si se les solicita.

Principios Fundamentales en Ciberseguridad

Triada Fundamental

• En ciberseguridad se manejan conceptos clave como ataque, vulnerabilidad y amenaza; cada uno juega un papel crucial en cómo se gestionan los riesgos digitales.

Definiciones Clave:

• Ataque: Estrategia utilizada por delincuentes para infiltrarse en sistemas.

• Vulnerabilidad: Debilidad que puede ser explotada durante un ataque.

• Amenaza: Potencial acción dañina basada en vulnerabilidades existentes.

Understanding the CIA Triad in Cybersecurity

The Concept of the CIA Triad

• The CIA triad is a fundamental concept in cybersecurity, representing three core principles: Confidentiality, Integrity, and Availability.

• In Spanish, "confidencialidad" corresponds to confidentiality (C), "integridad" to integrity (I), and "disponibilidad" translates to availability (A).

• Confidentiality ensures that information is accessible only to those with explicit authorization. Integrity guarantees that data remains complete and unaltered without permission.

• Availability means keeping systems and resources accessible for authorized users whenever needed, emphasizing constant access (24/7/365).

• Maintaining the CIA triad is crucial for effective cybersecurity practices.

Protecting Secrets: Tools for Confidentiality

• Protecting secrets involves maintaining confidentiality through trustworthiness and concrete tools like encryption.

• Encryption transforms readable data into unintelligible formats, ensuring intercepted information remains secure.

• Identity management defines who can view specific information within given contexts, enhancing security measures.

• Data protection during transit is vital; once data leaves a device, it becomes uncontrollable unless secured beforehand.

• Key pillars of confidentiality include encryption, identity management, and protection both in transit and at rest.

Ensuring Data Integrity

Mechanisms for Maintaining Integrity

• Key mechanisms for ensuring integrity include digital signatures, change control processes, and digital certificates.

• Digital signatures authenticate identities digitally while change controls track modifications made to data or systems.

• Digital certificates serve as electronic identification documents issued by trusted authorities to verify identities online.

• These mechanisms are essential for maintaining trust in digital communications and transactions.

Understanding Availability: The Five Nines

• Availability refers to ensuring systems are operational 99.999% of the time—known as the "five nines."

• This level of availability allows for minimal downtime—approximately 5.26 minutes per year—critical for businesses relying on continuous operations.

• Companies must implement strategies like mirrored servers or disaster recovery plans (DRPs), which ensure service continuity after adverse events.

Identifying Common Threat Vectors

Types of Attackers

• Understanding attackers' motivations is key; they range from cybercriminal groups seeking financial gain to hackivists promoting social agendas.

• State-sponsored actors engage in espionage or sabotage against critical infrastructure or intellectual property theft.

• Internal threats arise from employees or contractors misusing their access rights maliciously.

Recognizing Threat Characteristics

• A threat represents any potential danger compromising the CIA triad's principles within an organization’s systems or personal data.

• Threat sources may include malicious actors, natural disasters, or human errors leading to significant vulnerabilities.

Vulnerabilities: Weaknesses Exploited by Threat Actors

Defining Vulnerabilities

• A vulnerability signifies a weakness within IT systems that can be exploited by threats causing damage.

• Examples include outdated software creating security gaps; regular updates are essential to mitigate these risks.

Types of Vulnerabilities

• Technical vulnerabilities often stem from unpatched software or insecure configurations while human vulnerabilities arise from poor password practices or lack of awareness about security protocols.

Attack Vectors: Methods Used by Cybercriminals

Understanding Attack Vectors

• An attack vector describes a method used by attackers exploiting identified vulnerabilities within a system.

• Steps typically involve reconnaissance (gathering target info), selecting an attack method based on discovered weaknesses, followed by executing the attack itself.

Common Attack Types

• Phishing attacks use fraudulent communications mimicking legitimate sources aiming to extract sensitive information from victims.

• Ransomware encrypt files demanding payment before restoring access—a particularly damaging form of malware affecting organizations significantly.

Understanding Ransomware and Its Impact

What is Ransomware?

• Ransomware involves data hijacking for extortion, not identity theft or unauthorized bank transfers.

• A notable incident in 2024 saw a ransomware attack paralyze a major hospital system for eight days, severely affecting patient care.

• The attackers demanded a ransom of $10 million; however, the institution refused to pay and incurred recovery costs exceeding $25 million.

Consequences of Refusing to Pay

• The refusal to pay the ransom resulted in significantly higher recovery expenses than if they had paid the ransom.

• This highlights the severe financial implications of ransomware attacks on organizations.

Other Cyber Threat Vectors

Types of Cyber Attacks

• Additional vectors include DDoS (Distributed Denial of Service), which floods traffic, and Botnets that take servers offline.

• Persistent threats often involve malware types like Trojans, spyware, and invisible rootkits that steal information over time.

Social Engineering: The Art of Deception

Understanding Social Engineering

• Social engineering exploits human psychology rather than technical vulnerabilities to manipulate individuals into revealing confidential information.

• It is referred to as "the art of deception" due to its reliance on psychological manipulation.

Zero Trust Model in Cybersecurity

Implementing Zero Trust

• The Zero Trust model emphasizes never trusting any entity by default—always verify before granting access.

• Key phases include user education, network segmentation, identity management, continuous monitoring, and response strategies.

Key Global Cybersecurity Regulations

Important Regulations

• GDPR (General Data Protection Regulation): A European regulation focused on data protection and privacy.

• ISO 27001: An international standard for managing information security systems; non-compliance can lead to significant fines.

National Security Framework

• ENS (National Security Scheme): Applicable in Mexico and Spain; it sets minimum security requirements for public and private sectors handling sensitive information.

Operating Systems in Cybersecurity

Linux vs. Windows

• Linux is preferred for server environments due to its stability and lower incidence of attacks compared to Windows.

Recommendations for Users

• For personal devices, antivirus software such as Kaspersky is recommended for comprehensive protection against cyber threats.

Enhancing Home Cybersecurity

Home Security Measures

• While home cybersecurity differs from corporate measures, parental controls are crucial for protecting children online.

Tools Available

• Basic antivirus solutions are essential at home; advanced firewalls are typically unnecessary but can be implemented at a software level.

Case Study: Healthcare Plus Hospital Incident

Overview of the Incident

• In March 2025, an employee fell victim to phishing leading to a ransomware attack that encrypted critical patient data.

• Attackers demanded payment in Bitcoin (50 BTC), highlighting vulnerabilities within legacy systems lacking adequate security measures.

Lessons Learned

• Post-crisis improvements included adopting best practices like multi-factor authentication (MFA), network segmentation, regular backups, and ongoing training.