User:Classiqq/sandbox
Cyber Protection is a framework for preventing and dealing with cyber-attacks, as well as protecting sensitive data, using both backup and endpoint security protection management to handle all aspects of an attack.[1]
Though cyber protection incorporates elements of cybersecurity, because of its expanded framework and much more comprehensive approach to handling attacks, the two are often regarded by IT professionals as individual concepts.
Unlike cybersecurity, which focuses solely on pre-empting and preventing cyberattacks, cyber protection also provides a response to a cyberattack in the event that one should take place. With traditional cybersecurity, once a system has been breached by an attack, nothing more can be done. Cyber protection, however, encompasses several key functions that execute once an attack is underway and after the attack has taken place.
Another key difference between cybersecurity and cyber protection is in their relationship to data. Cybersecurity attempts to prevent access to sensitive data and can provide no support once the system has been breached. Meanwhile, cyber protection also safeguards the data itself.
Concept[edit]
Cyber protection incorporates the preemptive objectives of cybersecurity and attempts to prevent a cyber-attack from occurring in the first place. However, if an attack does take place, cyber protection executes a series of actions. Initially, it attempts to foil the attack and protect the system’s data from being accessed by the invading party. If this prevention fails, the cyber protection framework ensures that all of the data is backed up so as to prevent the organization from losing it. Finally, cyber protection provides forensics in an attempt to explain what happened and who was behind it. These results can then be used to safeguard against future attacks.
A benefit of having a multi-layered cyber protection framework is that all of the involved elements work together harmoniously, ensuring that each individual element is communicating and cooperating.
Five Functions of Cyber Protection[edit]
Cyber protection provides five essential functions, also known as the five pillars. This multi-tiered approach is what distinguishes cyber protection from other forms of cybersecurity and offers a far broader scope of protection. [2]
Prevention[edit]
The first function involves traditional cybersecurity and attempts to prevent attacks by mitigating potential threats. A key element of prevention is assessing the security capabilities and possible weakness of all software used by the protected organization. If system scans reveal vulnerabilities, fail-safe patches are applied as part of the prevention phase. This first step in the process has become vitally important during the Covid-19 pandemic, as the increase in remote work has resulted in more collaboration and networking apps being used by workers, which contain more security vulnerabilities.
Detection[edit]
The detection phase involves scanning full disk backups at a secure, centralized location. This phase checks for both vulnerabilities and harmful malware infections. The latter process is important for backup purposes so that users can confidently restore backup data without fear of introducing malware back into their system.
Response[edit]
In the event of an attack, a swift response is crucial to minimize system downtime and data loss. Prolonged downtime can be incredibly detrimental to any business, so getting everything back up and running promptly takes precedence over all else.
An effective response plan continuously monitors the situation in anticipation of incoming attacks. This monitoring ensures that the company will be promptly notified of any possible threats and that the plan will change accordingly to adapt to the threat, taking whatever actions necessary. These actions could include relevant patch installs, deep AV scans, or increasing the rate at which backups are collected by the system.
Recovery[edit]
Once an attack has run its course, the recovery phase takes place. Antivirus updates are installed, and anti-malware scans are run to prevent the system from recovering backup data that is infected. These steps ensure that users can restore all of their data and files without fear of a recurring infection.
Forensics[edit]
Once the preceding phases have dealt with the aftermath of the attack and everything has been restored to its proper status, the forensics phase commences. This final step is crucial in preparing for and preventing future cyberattacks. The two primary goals of forensics are to determine exactly how the system was breached and discover the party responsible for the breach.
These investigations must be prompt and precise. A strong forensics plan would involve forensic-rich backups which would preserve vital data that, when investigated, could produce key evidence and effective leads.
Artificial intelligence and machine learning play important roles in the forensic process. The data surrounding any given attack would contain billions of transactions - a transaction being a single keystroke, for example - far too many for a team of investigators to sort through. AI and machine learning give us the tools to quickly and accurately analyze the data and identify any anomalies.
A conclusive and thorough forensic investigation can not only expose the perpetrators but make future incidents easier and less costly to deal with.