What is Cybersecurity?

Cybersecurity professionals strive to contain and mitigate existing and new threats that infiltrate computer systems in different ways. We give some examples of common cyber threats below. 

Malware

Malware stands for malicious software. It includes a range of software programs built to allow third parties to gain unauthorized access to sensitive information or to interrupt the normal working of a critical infrastructure. Common examples of malware include Trojans, spyware, and viruses.

Ransomware

Ransomware refers to a business model and a wide range of associated technologies that bad actors use to extort money from entities. Whether you’re just getting started or already building on AWS, we have resources dedicated to help you protect your critical systems and sensitive data against ransomware.

Man-in-the-middle attack

A man-in-the-middle attack involves an outside party attempting unauthorized access over a network during a data exchange. Such attacks increase the security risks of sensitive information such as financial data. 

Phishing

Phishing is a cyber threat that uses social engineering techniques to trick users into revealing personally identifiable information. For example, cyber attackers send emails that result in users clicking and entering credit card data on a fake payment webpage. Phishing attacks can also result in the downloading of malicious attachments which install malware on company devices.

DDoS

A distributed denial of service attack (DDoS) is a coordinated effort to overwhelm a server by sending a high volume of fake requests. Such events prevent normal users from connecting or accessing the targeted server. 

Insider threat

An insider threat is a security risk introduced by personnel with ill intentions within an organization. The personnel possess high-level access to the computer systems and could destabilize the infrastructure's security from within. 

Organizations implement cybersecurity strategies by engaging cybersecurity specialists. These specialists assess the security risks of existing computing systems, networks, data storage, applications, and other connected devices. Then, the cybersecurity specialists create a comprehensive cybersecurity framework and implement protective measures in the organization. 

A successful cybersecurity program involves educating employees on security best practices and utilizing automated cyber defense technologies for existing IT infrastructure. These elements work together to create multiple layers of protection against potential threats on all data access points. They identify risk, protect identities, infrastructure, and data, detect anomalies and events, respond and analyze root cause, and recover after an event. 

A robust cybersecurity approach addresses the following concerns within an organization. 

Critical infrastructure cybersecurity

Critical infrastructure refers to digital systems important to society such as energy, communication, and transport. Organizations in these areas require a systematic cybersecurity approach because interruption or data loss can destabilize society. 

Network security

Network security is cybersecurity protection for computers and devices connected to a network. IT teams use network security technologies such as firewalls and network access control to regulate user access and manage permissions for specific digital assets.  

Cloud security

Cloud security describes the measures an organization takes to protect data and applications that run in the cloud. This is important to strengthen customer trust, ensure fault-tolerant operations, and comply with data privacy regulations in a scalable environment. A robust cloud security strategy involves shared shared responsibility between the cloud vendor and the organization. 

IoT security

The term Internet of Things (IoT) refers to electronic devices that operate remotely on the internet. For example, a smart alarm that sends periodic updates to your smartphone would be considered an IoT device. These IoT devices introduce an additional layer of security risk due to constant connectivity and hidden software bugs. Therefore, it is essential to introduce security policies on the network infrastructure to assess and mitigate the potential risks of different IoT devices. 

Data security

Data security protects data in transit and at rest with a robust storage system and secure data transfer. Developers use protective measures such as encryption and isolated backups for operational resilience against possible data breaches. In some cases, developers use AWS Nitro System for storage confidentiality and restricting operator access. 

Application security

Application security is a coordinated effort to strengthen an application's protection against unauthorized manipulation during the design, development, and testing stages. Software programmers write secure codes to prevent bugs that can increase security risks.

Endpoint security

Endpoint security addresses security risks that arise when users access an organization's network remotely. Endpoint security protection scans files from individual devices and mitigates threats upon detection. 

Disaster recovery and business continuity planning

This describes contingency plans that allow an organization to respond promptly to cybersecurity incidents while continuing to operate with little or no disruptions. They implement data recovery policies to respond positively to data losses. 

End-user education

People within an organization play a crucial role in ensuring the success of cybersecurity strategies. Education is key to ensuring that employees are trained with good security best practices, such as deleting suspicious emails and refraining from plugging in unknown USB devices. 

These are modern cybersecurity technologies that help organizations secure their data. 

Zero trust

Zero trust is a cybersecurity principle that assumes no applications or users are trusted by default, even if they are hosted within the organization. Instead, the zero trust model assumes a least-privilege access control, which requires strict authentication from the respective authorities and continuous monitoring of applications. AWS uses zero trust principles to authenticate and validate every individual API request. 

Behavioral analytics

Behavioral analytics monitor data transmission from devices and networks to detect suspicious activities and abnormal patterns. For example, the IT security team is alerted of a sudden spike in data transmission or downloads of suspicious files to specific devices.

Intrusion detection system

Organizations use intrusion detection systems to identify and quickly respond to a cyber attack. Modern security solutions use machine learning and data analytics to uncover dormant threats in the organization's computing infrastructure. The intrusion defense mechanism also picks up a data trail in the event of an incident, which helps the security team discover the incident's source.  

Cloud encryption

Cloud encryption scrambles data before storing it in cloud databases. This prevents unauthorized parties from abusing the data in possible breaches. Organizations use AWS Key Management Service to take control of data encryption in AWS workloads.