How Do You Secure Your Accounts and Data Against Threats?

TL;DR

Cybersecurity is best understood not in absolute terms but as a trade-off: a function of risks and rewards for an adversary versus costs and benefits for you, and as a trade-off with usability itself. Raising an adversary's cost and lowering their reward can make them lose interest. Since defenders must be perfect while attackers need only one mistake, detection and monitoring matter as much as prevention.

Transcript

This course is CS50's introduction to cyber security and is for both technical and non-technical audiences. It's taught by one of the world's most loved computer science teachers, Dr. David J. Men from Harvard University. You will learn how to secure your accounts, data, systems, and software against today's threats and how to recognize and evaluat... Read More

Key Insights

• Cybersecurity should be viewed relatively, not absolutely, as a function of risks and rewards for an adversary and costs and benefits for you, and as a trade-off with usability itself rather than a fixed state of being fully secure.
• Defenders face an asymmetric disadvantage: you and I have to be perfect and lock every virtual door and window, but an adversary needs to find just one mistake, a single door or window left a jar, to get in.
• Detection matters as much as prevention, because even if an adversary gets in, auditing and monitoring let you detect the intrusion quickly and minimize the downsides for you and the upsides for them.
• Artificial intelligence can assist cybersecurity defense by detecting patterns and potential adversary behavior that a person might not notice themselves, adding a layer of monitoring beyond manual review.
• Authentication is the digital process of proving who you are, while authorization is the separate question of whether you should have access to something once you have proven your identity.
• A good password should not appear in a dictionary, because a dictionary attack tries actual words from a file of English or other human-language words one at a time to guess passwords faster.
• Even random passwords with letters, numbers, and symbols remain vulnerable to a brute force attack, where software digitally tries all possible passwords, and short passwords fall quickly to an adversary with enough time and savvy.
• A four-digit numeric passcode has only 10,000 possibilities, calculated as 10 to the fourth power, ranging from 0000 up to 9999, which is why such default passcodes offer a low security bar.

Questions & Answers

Q: What is CS50's Introduction to Cybersecurity and who is it for?

CS50's Introduction to Cybersecurity is a full university course taught by Dr. David J. Malan of Harvard University, designed for both technical and non-technical audiences alike. It teaches how to secure your accounts, data, systems, and software against today's threats and how to recognize and evaluate tomorrow's threats as well, both at home and at work. It also covers preserving your own privacy and presents both high-level and low-level examples of threats, giving students the technical grounding to understand both even if they are not programmers.

Q: How should you think about cybersecurity according to the course?

The course teaches you to view cybersecurity not in absolute terms but relative, as a function of risks and rewards for an adversary and costs and benefits for you. You should also recognize cybersecurity as a trade-off with usability itself. If you raise the bar high enough for an adversary, increasing their cost and risk while decreasing their potential reward, they may simply lose interest in you as a target, though an adversary with more resources might win anyway.

Q: Why is detection as important as prevention in cybersecurity?

Detection is critical because in cybersecurity you and I have to be perfect, with all our virtual doors and windows locked, but an adversary has to find just one mistake, a single door or window left a jar. Because perfect prevention is so hard, the course suggests focusing not only on prevention but on detection, especially through auditing and monitoring, so that even if an adversary gets in you can detect it quickly and minimize the downsides for you and the upsides for them.

Q: What is the difference between authentication and authorization?

Authentication refers to the digital process of proving who you are, such as demonstrating that you are David. However, that alone is not enough to keep a system secure, because being David does not necessarily mean you should have access to everything. Authorization is the related topic that speaks to whether or not you should have access to something once you have proven that you are who you claim to be, for example whether David should in fact have access to a door he just walked through.

Q: What is a dictionary attack and how do you defend against it?

A dictionary attack is when an adversary or hacker who wants to get into your account uses a file on their computer containing a whole lot of actual English words, or words in another human language, and tries them one at a time as your password. If you have chosen a guessable password that is an actual word in a dictionary, they will get into your account much faster. To defend against it, your password should not be in a dictionary and should ideally include numbers, letters, and punctuation.

Q: What is a brute force attack in cybersecurity?

A brute force attack in the digital world means using software to digitally try all possible passwords. The name evokes memories of using a big branch of a tree as a battering ram to get into castles in past times. Even if your password is random with letters, numbers, and symbols, you remain vulnerable if it is too short, because an adversary with enough time and technical savvy can try every possible password in the world and eventually get into your system.

Q: How many possible passwords does a four-digit passcode have?

A four-digit numeric passcode has 10,000 possible combinations. This is because with four decimal digits, each ranging from 0 through 9, the smallest possible passcode is 0000 and the largest is 9999. Mathematically, you have 10 possibilities for each of the four positions, or 10 times 10 times 10 times 10, which equals 10 to the fourth power, giving 10,000. Including 0000 as the ten-thousandth possibility is why the total is 10,000 rather than 9,999.

Q: Why are default four-digit phone passcodes considered insecure?

Four-digit passcodes set a low security bar that is common by default on many devices. When setting up a phone, you are often only asked for a numeric passcode of four digits. Because there are only 10,000 possible four-digit combinations, an adversary might have to try as many as 10,000 possibilities to get in, and in the easiest case they get lucky if you kept the default 0000. This limited number of combinations makes such passcodes far weaker than longer passwords using more character types.

Summary & Key Takeaways

• CS50's Introduction to Cybersecurity, taught by Dr. David J. Malan of Harvard, is for both technical and non-technical audiences. It teaches how to secure accounts, data, systems, and software against today's threats and how to recognize and evaluate tomorrow's, both at home and at work, while preserving your own privacy.

• The course frames cybersecurity relatively rather than absolutely: a function of risks and rewards for an adversary and costs and benefits for you, and a trade-off with usability. Because defenders must be perfect while attackers need one mistake, detection through auditing and monitoring, aided by AI, complements prevention.

• The first week focuses on securing accounts through authentication and authorization. Passwords must be strong to resist dictionary attacks, which try real words, and brute force attacks, which try all possibilities. A four-digit passcode has only 10,000 combinations, illustrating how password length and character choice determine security.