مقدمة في الأمن السيبراني 2019 || الأسبوع 2 - المحاضرة 1

The lecturer opens by defining cybercrime as a deliberate criminal attack on a person or group that causes harm—whether to hearing, physical health, or mental well-being—through digital means. The harm can be direct or indirect, and the systems used include the internet, chat rooms, emails, notice boards, groups, and cell phones. The section establishes that this type of crime must be identified, classified, and prosecuted, and notes that the US Department of Justice applies the same procedures and definitions as for any other crime.

• Cybercrime is defined by deliberate intent and the causing of direct or indirect harm, not just by the medium used.
• The same legal frameworks that apply to traditional crimes extend to cybercrime under US Department of Justice procedures.

This section establishes the foundational definition that every subsequent part of the lecture depends on.

The lecturer broadens the scope by listing the digital channels through which cybercrime occurs—internet, chat rooms, emails, notice boards, groups, and cell phones—and stresses the need to identify and classify these crimes. The section transitions into the procedural equivalence between cybercrime and traditional crime, noting that the US Department of Justice treats them under the same framework. The section ends by introducing the three classification categories that will structure the rest of the lecture.

• Cybercrime spans a wide range of digital communication channels, not just the internet.
• Classification of cybercrime is a prerequisite for both identification and prosecution.

This section bridges the definition to the classification framework and sets up the lecture's organizational structure.

The lecturer presents the core taxonomy: classification one treats the computer as a target, exemplified by breaking into systems to steal personal or employee data. Classification two treats the computer as a weapon, illustrated by denial of service attacks. Classification three treats the computer as a tool, with identity theft as the primary example. Each classification is introduced with a concrete scenario to help the audience distinguish between them. The section ends by transitioning to the concept of threat actors.

• The three classifications—target, weapon, tool—determine the investigation and defense strategy for any given incident.
• Identity theft is framed as a crime where the computer is merely the instrument, not the objective.

This is the central conceptual framework of the entire lecture and the most important section to understand.

The lecturer introduces the term 'threat actors' and states that companies of any size, field, or perceived worth are always targeted. The Facebook hack is cited as a current, high-profile example causing huge losses due to leaked and stolen information. The section transitions into hacking as one of the most important types of cybercrime attacks, noting that threat actors have used it for many years to search for weak points in networks, technology, and employees.

• No organization is exempt from being targeted by threat actors based on its size or industry.
• Hacking specifically involves probing networks, technology, and people for exploitable weak points.

This section grounds the abstract classifications in a real-world example and introduces the human vulnerability dimension.

The lecturer elaborates on hacking as a long-standing cybercrime method used to infiltrate organizational networks and companies. The attack vector focuses on finding weak points across three dimensions: the network infrastructure, the technology stack, and the employees working within the organization. The section positions hacking as a broad and persistent threat that has been employed by threat actors for many years.

• Hacking targets three distinct layers simultaneously: network, technology, and human.
• The longevity of hacking as an attack method underscores that it remains a relevant and evolving threat.

This section reinforces points already made in the threat actors segment and adds limited new information.

The lecturer introduces ransomware as a very popular attack type obtained through hackers. The mechanism is described: hackers encrypt everything on a system, take full control, and then demand a ransom—hence the name—for the victim to regain access to their information or system control. The section positions ransomware as a distinct and prevalent threat separate from hacking or denial of service.

• Ransomware's defining characteristic is encryption-based extortion, not data theft or service disruption.
• The name 'ransomware' directly reflects the payment-for-restoration model that drives this attack type.

Ransomware is one of the most prevalent real-world threats and this section provides a clear, concise explanation of its mechanics.

The lecturer revisits denial of service, which was briefly mentioned earlier, and provides a simplified explanation. The attack works by using a program or system to send overwhelming traffic that overloads the network or servers, interrupting normal network traffic movement. The lecturer also notes that the attack can simultaneously download the entire network. The section ends the lecture's survey of attack types.

• Denial of service disrupts operations by overloading network or server capacity with programmatic traffic.
• A DoS attack can serve a dual purpose: disrupting service and exfiltrating data simultaneously.

This section completes the attack-type survey and adds a dual-purpose nuance to the DoS explanation.